kernel-guard/BPFCompat eBPF Compatibility Gate
Validate eBPF .bpf.o artifacts across Linux kernel profiles and fail CI on compatibility regressions.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 2, 2026
- License
- Apache 2.0
Pinned Snippet
uses: kernel-guard/bpfcompat@c7ef4fbb39f0054876ab2d286b3a6aaf86d05499 # v0.3.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| suite | Optional suite YAML. When set, the action runs bpfcompat suite instead of single-artifact mode. | no | "" |
| artifact | Path to compiled .bpf.o artifact. | no | "" |
| command | Command-mode validation: shell command run as root inside each kernel VM; the per-kernel verdict is its exit code. Use instead of (or alongside) artifact to validate via your project's own loader binary. Exposes $BPFCOMPAT_BIN, $BPFCOMPAT_ARTIFACT, and $BPFCOMPAT_REMOTE_ROOT. | no | "" |
| command-binary | Local loader executable shipped into each guest and exposed to command as $BPFCOMPAT_BIN. | no | "" |
| command-expect-exit | Exit code that counts as a pass in command mode. | no | 0 |
| matrix | Path to matrix YAML. A bare name (for example quirk-library) that does not exist in the caller repository resolves to the matching matrices/<name>.yaml shipped with the action. | no | "" |
| out | Path to JSON report output. | no | "" |
| suite-out | Path to suite JSON summary output when suite mode is used. | no | reports/bpfcompat-suite.json |
| suite-markdown | Path to suite Markdown summary output when suite mode is used. | no | reports/bpfcompat-suite.md |
| manifest | Path to manifest YAML. | no | "" |
| validation-mode | Optional single-artifact validation mode: load_only, load_attach, or behavior. Suite mode should set validation_mode inside the suite YAML. | no | "" |
| markdown | Path to Markdown report output. | no | "" |
| timeout | Per-target timeout (for example 180s, 8m). | no | 180s |
| workdir | Working directory root. | no | .bpfcompat |
| concurrency | Maximum concurrent VM jobs. | no | 2 |
| keep-vm-on-failure | Keep VM overlays/logs on target failure. | no | false |
| build | Build ./bin/bpfcompat with make before running tests. | no | true |
| prebuilt | Use prebuilt release binaries when the action is pinned to a release tag or to a commit SHA that matches a release tag ("auto"), or always build from source ("never"). Downloads are checksum-verified against the release SHA256SUMS. | no | auto |
| binary | Path to bpfcompat binary. Relative paths are resolved from the caller repository root. | no | ./bin/bpfcompat |
Outputs
no outputs