Report final AMI disk usage to workflow job

.github/actions/build-ami/action.yml

@@ -37,6 +37,9 @@ outputs:
   execution_id:
     description: 'The execution ID for this build'
     value: ${{ steps.set-execution-id.outputs.execution_id }}
+  disk_usage_json:
+    description: 'The stage 2 AMI root disk usage as json'
+    value: ${{ steps.build-stage2.outputs.disk_usage_json }}
 
 runs:
   using: "composite"

.github/workflows/testinfra-ami-build.yml

@@ -19,7 +19,7 @@ env:
   AWS_REGION: ap-southeast-1
 
 jobs:
-  prepare:
+  gen-matrix:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
@@ -37,11 +37,11 @@ jobs:
           echo "postgres_versions=$VERSIONS" >> "$GITHUB_OUTPUT"
 
   test-ami-nix:
-    needs: prepare
+    needs: gen-matrix
     strategy:
       fail-fast: false
       matrix:
-        postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
+        postgres_version: ${{ fromJson(needs.gen-matrix.outputs.postgres_versions) }}
         target:
           - arch: amd64
             instance_type: c6i.4xlarge
@@ -100,20 +100,35 @@ jobs:
           postgres_version: ${{ matrix.postgres_version }}
           region: ${{ env.AWS_REGION }}
 
-      - run: docker context create builders
-
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - name: Save AMI disk usage
+        env:
+          ARCH: ${{ matrix.target.arch }}
+          DISK_USAGE_JSON: ${{ steps.build-ami.outputs.disk_usage_json }}
+          POSTGRES_VERSION: ${{ matrix.postgres_version }}
+        run: >-
+          jq -cnr
+          --arg arch "$ARCH"
+          --arg version "$POSTGRES_VERSION"
+          --argjson disk_usage "$DISK_USAGE_JSON"
+          '{$version,$arch,bytes:$disk_usage.bytes,human:$disk_usage.human}'
+          >"ami-disk-usage-$POSTGRES_VERSION-$ARCH.json"
+
+      - name: Upload AMI disk usage
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          endpoint: builders
+          name: ami-disk-usage-${{ matrix.postgres_version }}-${{ matrix.target.arch }}
+          path: ami-disk-usage-*.json
+          overwrite: true
+          retention-days: 1
 
       - name: Run tests
         timeout-minutes: 10
         env:
           AMI_ID: ${{ steps.build-ami.outputs.stage2_ami_id }}
           EXECUTION_ID: ${{ steps.build-ami.outputs.execution_id }}
         run: |
-          # TODO: use poetry for pkg mgmt
-          pip3 install boto3 "boto3-stubs[essential]" docker ec2instanceconnectcli pytest "pytest-testinfra[paramiko,docker]" requests
+          # TODO: use uv for pkg mgmt
+          pip3 install boto3 'boto3-stubs[essential]' ec2instanceconnectcli pytest 'pytest-testinfra[paramiko]' requests
           pytest -vv -s testinfra/test_ami_nix.py
 
       - name: Cleanup resources on build cancellation
@@ -173,3 +188,26 @@ jobs:
           else
             echo "No stage 2 AMI to clean up"
           fi
+
+  report-disk-usage:
+    needs: test-ami-nix
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Download AMI disk usage
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: ami-disk-usage-*
+          path: ami-disk-usage
+          merge-multiple: true
+
+      - name: Report AMI disk usage
+        run: |
+          cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+          ### AMI Root Disk Usage
+
+          | Version | Arch | Human | Bytes |
+          | ------- | ---- | ----- | ----- |
+          EOF
+          cat ami-disk-usage/ami-disk-usage-*.json |
+          sort -V |
+          jq -rs '.[]|{version,arch,human,bytes}|"| \(join("|")) |"' >>"$GITHUB_STEP_SUMMARY"

ebssurrogate/scripts/nix-provision.sh

@@ -9,21 +9,21 @@ exec 1>&2
 
 function install_packages {
 	# Setup Ansible on host VM
-	sudo apt-get update && sudo apt-get install -y software-properties-common
+	apt-get update && apt-get install -y software-properties-common
 
 	# Install EC2-specific packages that were deferred from stage 1
 	# These packages have post-install scripts that need EC2 metadata service access
 	# which only works on a real running EC2 instance (not in chroot)
-	sudo apt-get install -y ec2-hibinit-agent ec2-instance-connect hibagent
+	apt-get install -y ec2-hibinit-agent ec2-instance-connect hibagent
 
 	# Manually add GPG key with explicit keyserver
-	sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367
+	apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367
 
 	# Add repository and install
 	# TODO (darora): temporarily disabling while Launchpad is under ddos attack and very frequently timing out
 	# sudo add-apt-repository --yes ppa:ansible/ansible
 	# sudo apt-get update
-	sudo apt-get install -y ansible
+	apt-get install -y ansible
 
 	ansible-galaxy collection install community.general
 }
@@ -72,7 +72,14 @@ function cleanup_packages {
 	# sudo add-apt-repository --yes --remove ppa:ansible/ansible
 }
 
+function report_disk_usage {
+	read -r dub _ < <(du -sx -B1 /)
+	read -r duh _ < <(du -sx -h /)
+	printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log
+}
+
 install_packages
 install_nix
 execute_stage2_playbook
 cleanup_packages
+report_disk_usage

nix/packages/build-ami.nix

@@ -194,6 +194,21 @@ writeShellApplication {
         -var "source_ami=$STAGE1_AMI_ID" \
         "$@"
 
+      disk_usage_notice=$(grep '^::notice::disk_usage ' /tmp/ansible-stage2.log | tail -n 1 || true)
+      disk_usage_notice_pattern='^::notice::disk_usage bytes=([0-9]+) human=([0-9]+(\.[0-9]+)?[MGT]?)$'
+      if [[ $disk_usage_notice =~ $disk_usage_notice_pattern ]]; then
+        disk_usage_bytes=''${BASH_REMATCH[1]}
+        disk_usage_human=''${BASH_REMATCH[2]}
+      else
+        echo "Error: Missing or invalid disk usage notice in stage 2 log: '$disk_usage_notice'" >&2
+        exit 1
+      fi
+      echo "::notice::AMI Disk Usage $disk_usage_human $disk_usage_bytes"
+      if [[ -n ''${GITHUB_OUTPUT:-} ]]; then
+        disk_usage_json=$(jq -cnr --arg bytes "$disk_usage_bytes" --arg human "$disk_usage_human" '{$bytes,$human}')
+        echo "disk_usage_json=$disk_usage_json" >>"$GITHUB_OUTPUT"
+      fi
+
       if [ -n "''${PACKER_EXECUTION_ID:-}" ]; then
         STAGE2_AMI_ID=$(aws ec2 describe-images \
           --region "$REGION" \

stage2-nix-psql.pkr.hcl

@@ -132,4 +132,10 @@ build {
     script           = "ebssurrogate/scripts/nix-provision.sh"
     execute_command  = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
   }
+
+  provisioner "file" {
+    source      = "/tmp/ansible.log"
+    destination = "/tmp/ansible-stage2.log"
+    direction   = "download"
+  }
 }