fix(deps): update bcvk-qemu digest to 9be6847 #7370
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI Workflow for bootc | |
| # | |
| # Core principles: | |
| # - Everything done here should be easy to replicate locally. Most tasks | |
| # should invoke `just <something>`. Read the Justfile for more explanation | |
| # of this. | |
| # - Most additions to this should be extending existing tasks; e.g. | |
| # there's places for unit and integration tests already. | |
| name: CI | |
| permissions: | |
| actions: read | |
| contents: read | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| types: [opened, synchronize, reopened, labeled] | |
| merge_group: | |
| workflow_dispatch: {} | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Disable incremental compilation in CI; it wastes disk in the container | |
| # build cache (--mount=type=cache,target=/src/target) and doesn't help | |
| # one-shot builds. Wired into container builds via Justfile --build-arg. | |
| CARGO_INCREMENTAL: "0" | |
| # Something seems to be setting this in the default GHA runners, which breaks bcvk | |
| # as the default runner user doesn't have access | |
| LIBVIRT_DEFAULT_URI: "qemu:///session" | |
| DEV_IMAGE: ghcr.io/bootc-dev/dev-bootc | |
| # Retry parameters for `just build-fetch` (transient Koji/Copr/quay.io failures) | |
| BOOTC_CI_RETRIES: "10" | |
| BOOTC_CI_DELAY: "60" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Determine the OS matrix for CI jobs based on context: | |
| # - merge_group / workflow_dispatch / ci/merge label: all OSes | |
| # - ci/tier-1 label: centos-10 only (fast feedback on the primary target) | |
| # - PR with no merge queue configured: all OSes (the PR is the only gate, | |
| # so it must run the full suite; see the merge-queue check below) | |
| # - plain PR (merge queue active): no heavy jobs | |
| # - push to main: no heavy jobs (already verified pre-merge; a push here | |
| # is a record of what merged, not something new to gate) | |
| compute-ci-level: | |
| # Cheap metadata check (gh api + jq) — no need for a full VM. | |
| runs-on: ubuntu-slim | |
| outputs: | |
| package_os_matrix: ${{ steps.matrix.outputs.package_os_matrix }} | |
| integration_os_matrix: ${{ steps.matrix.outputs.integration_os_matrix }} | |
| upgrade_os_matrix: ${{ steps.matrix.outputs.upgrade_os_matrix }} | |
| run_heavy: ${{ steps.matrix.outputs.run_heavy }} | |
| merge_queue_enabled: ${{ steps.merge-queue.outputs.enabled }} | |
| docs_only: ${{ steps.docs-check.outputs.docs_only }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| if: github.event_name == 'pull_request' | |
| with: | |
| sparse-checkout: . | |
| fetch-depth: 1 | |
| - name: Detect docs-only PR | |
| id: docs-check | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| FILES=$(gh pr diff "${{ github.event.pull_request.number }}" --name-only) | |
| if [[ -z "$FILES" ]]; then | |
| echo "docs_only=false" >> "$GITHUB_OUTPUT" | |
| elif grep -qvE '\.md$' <<< "$FILES"; then | |
| echo "docs_only=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "docs_only=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Detect at runtime whether `main` is currently protected by a GitHub | |
| # merge queue (see https://github.com/bootc-dev/bootc/issues/2177). | |
| # The tiered CI below only makes sense with a queue: it lets heavy jobs | |
| # run for feedback on PRs without gating merges, because the queue | |
| # re-verifies everything before landing. Without a queue, a PR is the | |
| # *only* gate, so the heavy suite must be required directly on PRs | |
| # again. Checking this dynamically means re-enabling the queue later | |
| # doesn't require another manual flip of this workflow to go back to | |
| # the tiered behavior. | |
| # | |
| # A branch's effective rules (aggregated across org- and repo-level | |
| # rulesets) are public, unauthenticated info; a `merge_queue` rule is | |
| # present only while a queue is actually configured for the branch. | |
| - name: Check for a merge_queue rule on main | |
| id: merge-queue | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Let this fail outright if the API call fails, rather than | |
| # guessing: required-checks-heavy (below) needs this job, so we | |
| # never silently skip testing on a transient API hiccup. | |
| rules=$(gh api "repos/${{ github.repository }}/rules/branches/main") | |
| if echo "$rules" | jq -e 'any(.[]; .type == "merge_queue")' > /dev/null; then | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Compute OS matrices | |
| id: matrix | |
| run: | | |
| LABELS='${{ toJson(github.event.pull_request.labels.*.name) }}' | |
| EVENT='${{ github.event_name }}' | |
| MERGE_QUEUE_ENABLED='${{ steps.merge-queue.outputs.enabled }}' | |
| DOCS_ONLY='${{ steps.docs-check.outputs.docs_only }}' | |
| if [[ "$DOCS_ONLY" != "true" ]] && { [[ "$EVENT" == "merge_group" || "$EVENT" == "workflow_dispatch" ]] \ | |
| || [[ "$EVENT" == "pull_request" && "$MERGE_QUEUE_ENABLED" != "true" ]] \ | |
| || echo "$LABELS" | jq -e 'index("ci/merge")' > /dev/null; }; then | |
| # Full suite: all OSes | |
| echo 'package_os_matrix=["fedora-43","fedora-44","fedora-45","fedora-46","centos-9","centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'integration_os_matrix=["fedora-43","fedora-44","centos-9","centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'upgrade_os_matrix=["fedora-44","centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'run_heavy=true' >> "$GITHUB_OUTPUT" | |
| elif [[ "$DOCS_ONLY" != "true" ]] && echo "$LABELS" | jq -e 'index("ci/tier-1")' > /dev/null; then | |
| # Tier-1 only: centos-10 | |
| echo 'package_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'integration_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'upgrade_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT" | |
| echo 'run_heavy=true' >> "$GITHUB_OUTPUT" | |
| else | |
| # Plain PR or docs-only: skip heavy jobs entirely | |
| echo 'package_os_matrix=[]' >> "$GITHUB_OUTPUT" | |
| echo 'integration_os_matrix=[]' >> "$GITHUB_OUTPUT" | |
| echo 'upgrade_os_matrix=[]' >> "$GITHUB_OUTPUT" | |
| echo 'run_heavy=false' >> "$GITHUB_OUTPUT" | |
| fi | |
| # Run basic validation checks (linting, formatting, etc) | |
| validate: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| - name: Validate (default) | |
| run: just validate | |
| # Check for security vulnerabilities and license compliance | |
| cargo-deny: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| log-level: warn | |
| command: check -A duplicate bans sources licenses | |
| # Test bootc installation scenarios and fsverity support | |
| # TODO convert to be an integration test: this would also | |
| # ensure we inherit the `package` job (and in theory | |
| # this could be a proper matrix) | |
| install-tests: | |
| name: "Test install" | |
| # Disabled: this job is hanging in the chunkah/podman step even after | |
| # switching to native overlay (see "test-install: Fix chunkah hang"). | |
| # Re-enable once the underlying hang is root-caused. | |
| if: false && needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: compute-ci-level | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| - name: Use native overlay instead of fuse-overlayfs | |
| run: | | |
| sudo sed -i 's|mount_program.*|mount_program = ""|' /etc/containers/storage.conf | |
| - name: Enable fsverity for / | |
| run: sudo tune2fs -O verity $(findmnt -vno SOURCE /) | |
| - name: Install utils | |
| run: sudo apt -y install fsverity just | |
| - name: Fetch external dependencies (with retry) | |
| run: just build-fetch | |
| - name: Integration tests | |
| run: | | |
| set -xeu | |
| # Build images as regular user, then copy to root's podman storage | |
| # This avoids cargo cache permission issues when running cargo as root | |
| just build | |
| just build-install-test-image | |
| just copy-to-rootful localhost/bootc | |
| just copy-to-rootful localhost/bootc-install | |
| # Copy bound images (LBI) to root's storage for tests that need them | |
| just copy-lbi-to-rootful | |
| # Build test binaries before any sudo commands to avoid cargo permission issues | |
| cargo build --release -p tests-integration | |
| sudo podman build -t localhost/bootc-fsverity -f ci/Containerfile.install-fsverity | |
| df -h / | |
| sudo install -m 0755 target/release/tests-integration /usr/bin/bootc-integration-tests | |
| sudo rm target -rf | |
| df -h / | |
| # The ostree-container tests | |
| sudo podman run --privileged --pid=host -v /:/run/host -v $(pwd):/src:ro -v /var/tmp:/var/tmp \ | |
| --tmpfs /var/lib/containers \ | |
| -v /run/dbus:/run/dbus -v /run/systemd:/run/systemd localhost/bootc /src/crates/ostree-ext/ci/priv-integration.sh | |
| # Nondestructive but privileged tests | |
| sudo bootc-integration-tests host-privileged localhost/bootc-install | |
| # Install tests | |
| sudo bootc-integration-tests install-alongside localhost/bootc-install | |
| # inspect system state after the install tests. | |
| sudo lsblk | |
| sudo mount | |
| # system-reinstall-bootc tests | |
| cargo build --release -p system-reinstall-bootc | |
| # not sure why this is missing in the ubuntu image but just creating this directory allows the tests to pass | |
| sudo mkdir -p /run/sshd | |
| sudo install -m 0755 target/release/system-reinstall-bootc /usr/bin/system-reinstall-bootc | |
| # These tests may mutate the system live so we can't run in parallel | |
| sudo bootc-integration-tests system-reinstall localhost/bootc --test-threads=1 | |
| # And the fsverity case | |
| sudo podman run --privileged --pid=host localhost/bootc-fsverity bootc install to-existing-root --stateroot=other \ | |
| --acknowledge-destructive --skip-fetch-check | |
| # Crude cross check | |
| sudo find /ostree/repo/objects -name '*.file' -type f | while read f; do | |
| sudo fsverity measure $f >/dev/null | |
| done | |
| # Test that we can build documentation | |
| docs: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| - name: Build mdbook | |
| run: just build-mdbook | |
| # Build packages for each test OS | |
| package: | |
| if: needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: compute-ci-level | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test_os: ${{ fromJson(needs.compute-ci-level.outputs.package_os_matrix) }} | |
| runs-on: ubuntu-24.04 | |
| # Rawhide is best-effort; don't let it block merges | |
| continue-on-error: ${{ matrix.test_os == 'fedora-46' }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| - name: Setup env | |
| run: | | |
| BASE=$(just pullspec-for-os base ${{ matrix.test_os }}) | |
| echo "BOOTC_base=${BASE}" >> $GITHUB_ENV | |
| - name: Build packages (and verify build system) | |
| run: just check-buildsys | |
| - name: Upload package artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: packages-${{ matrix.test_os }} | |
| path: target/packages/*.rpm | |
| retention-days: 1 | |
| # Unit tests don't depend on the variant/filesystem/bootloader/boot_type/seal_state | |
| # axes used by the test-integration matrix below, so we run them once per OS here | |
| # (reusing the BuildKit cache already warmed by `just check-buildsys` above) instead | |
| # of once per matrix leg. | |
| - name: Unit tests | |
| run: just unit-tests | |
| # Build bootc from source into a container image FROM each specified base `test_os` | |
| # running unit and integration tests (using TMT, leveraging the support for nested virtualization | |
| # in the GHA runners) | |
| test-integration: | |
| if: needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: [compute-ci-level, package] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test_os: ${{ fromJson(needs.compute-ci-level.outputs.integration_os_matrix) }} | |
| variant: [ostree, composefs] | |
| filesystem: ["ext4", "xfs"] | |
| # TODO: Remove "grub" once "grub-cc" is stable | |
| # bootloader: ["grub", "grub-cc", "systemd"] | |
| bootloader: ["grub", "systemd"] | |
| boot_type: ["bls", "uki"] | |
| seal_state: ["sealed", "unsealed"] | |
| exclude: | |
| # https://github.com/bootc-dev/bootc/issues/1812 | |
| - test_os: centos-9 | |
| variant: composefs | |
| - seal_state: "sealed" | |
| boot_type: bls | |
| - seal_state: "sealed" | |
| bootloader: grub | |
| - seal_state: "sealed" | |
| filesystem: xfs | |
| - seal_state: "unsealed" | |
| filesystem: ext4 | |
| boot_type: uki # we still want to test ext4 unsealed bls | |
| - bootloader: grub | |
| boot_type: "uki" | |
| # We only test filesystems for composefs to test if composefs backend will work on fs | |
| # without fsverity | |
| - variant: ostree | |
| filesystem: ext4 | |
| - variant: ostree | |
| boot_type: uki | |
| - variant: ostree | |
| bootloader: systemd | |
| # For now only have grub-cc tests in F44 | |
| # - test_os: fedora-45 | |
| # bootloader: grub-cc | |
| # - test_os: fedora-43 | |
| # bootloader: grub-cc | |
| # - test_os: centos-9 | |
| # bootloader: grub-cc | |
| # - test_os: centos-10 | |
| # bootloader: grub-cc | |
| # # Not in ostree | |
| # - variant: ostree | |
| # bootloader: grub-cc | |
| # # Not yet "sealed" | |
| # - bootloader: grub-cc | |
| # seal_state: sealed | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| with: | |
| libvirt: true | |
| - name: Install tmt | |
| uses: ./.github/actions/install-tmt | |
| - name: Setup env | |
| run: | | |
| BASE=$(just pullspec-for-os base ${{ matrix.test_os }}) | |
| echo "BOOTC_base=${BASE}" >> $GITHUB_ENV | |
| echo "RUST_BACKTRACE=full" >> $GITHUB_ENV | |
| echo "RUST_LOG=debug" >> $GITHUB_ENV | |
| echo "BOOTC_variant=${{ matrix.variant }}" >> $GITHUB_ENV | |
| echo "BOOTC_filesystem=${{ matrix.filesystem }}" >> $GITHUB_ENV | |
| echo "BOOTC_bootloader=${{ matrix.bootloader }}" >> $GITHUB_ENV | |
| echo "BOOTC_boot_type=${{ matrix.boot_type }}" >> $GITHUB_ENV | |
| echo "BOOTC_seal_state=${{ matrix.seal_state }}" >> $GITHUB_ENV | |
| - name: Download package artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: packages-${{ matrix.test_os }} | |
| path: target/packages/ | |
| - name: Fetch external dependencies (with retry) | |
| run: BOOTC_SKIP_PACKAGE=1 just build-fetch | |
| - name: Build container | |
| run: | | |
| BOOTC_SKIP_PACKAGE=1 just bootloader=$BOOTC_bootloader build | |
| # Extra cross-check (duplicating the integration test) that we're using the right base | |
| used_vid=$(podman run --rm localhost/bootc bash -c '. /usr/lib/os-release && echo ${ID}-${VERSION_ID}') | |
| test ${{ matrix.test_os }} = "${used_vid}" | |
| - name: Container integration tests | |
| run: BOOTC_SKIP_PACKAGE=1 just test-container-integration | |
| - name: Validate composefs digest (UKI only) | |
| if: matrix.boot_type == 'uki' | |
| run: just validate-composefs-digest | |
| - name: Reclaim disk space before TMT | |
| run: podman builder prune -af | |
| - name: Run TMT integration tests | |
| run: | | |
| if [[ "${{ matrix.variant }}" = composefs ]]; then | |
| just test-composefs "${{ matrix.bootloader }}" "${{ matrix.filesystem }}" "${{ matrix.boot_type }}" "${{ matrix.seal_state }}" | |
| else | |
| just test-tmt integration | |
| fi | |
| just clean-local-images | |
| - name: Disk usage summary | |
| if: always() | |
| run: | | |
| echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| df -h >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| - name: Archive TMT logs | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: "tmt-log-\ | |
| ${{ matrix.test_os }}-\ | |
| ${{ matrix.variant }}-\ | |
| ${{ matrix.bootloader }}-\ | |
| ${{ matrix.boot_type }}-\ | |
| ${{ matrix.filesystem }}-\ | |
| ${{ matrix.seal_state }}-\ | |
| ${{ env.ARCH }}" | |
| path: /var/tmp/tmt | |
| # Test the upgrade path: boot from published base image, upgrade to locally-built image, | |
| # then run readonly tests to verify the upgrade worked. | |
| # Excluded: centos-9 (lacks systemd.extra-unit.* support needed for --bind-storage-ro) | |
| test-upgrade: | |
| if: needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: [compute-ci-level, package] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test_os: ${{ fromJson(needs.compute-ci-level.outputs.upgrade_os_matrix) }} | |
| variant: [ostree, composefs] | |
| # TODO: Re-enable this after 1.16.8 is released | |
| exclude: | |
| - test_os: fedora-44 | |
| variant: composefs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| with: | |
| libvirt: true | |
| - name: Install tmt | |
| uses: ./.github/actions/install-tmt | |
| - name: Setup env | |
| run: | | |
| BASE=$(just pullspec-for-os base ${{ matrix.test_os }}) | |
| echo "BOOTC_base=${BASE}" >> $GITHUB_ENV | |
| echo "BOOTC_variant=${{ matrix.variant }}" >> $GITHUB_ENV | |
| echo "BOOTC_SKIP_PACKAGE=1" >> $GITHUB_ENV | |
| echo "RUST_BACKTRACE=full" >> $GITHUB_ENV | |
| - name: Download package artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: packages-${{ matrix.test_os }} | |
| path: target/packages/ | |
| - name: Fetch external dependencies (with retry) | |
| run: just build-fetch | |
| - name: Run upgrade test | |
| run: just test-upgrade | |
| - name: Disk usage summary | |
| if: always() | |
| run: | | |
| echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| df -h >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| - name: Archive TMT logs | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: "tmt-log-${{ matrix.test_os }}-${{ matrix.variant }}-upgrade-${{ env.ARCH }}" | |
| path: /var/tmp/tmt | |
| # Test readonly behaviour with baseconfigs (transient mounts) baked into the image. | |
| # Composefs-only: setup-root-conf.toml is a composefs concept; ostree uses a | |
| # different config format (prepare-root.conf) and is not covered here. | |
| # Runs once per distro × baseconfig — no bootloader/filesystem/boot_type matrix. | |
| test-baseconfigs: | |
| if: needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: [compute-ci-level, package] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test_os: ${{ fromJson(needs.compute-ci-level.outputs.integration_os_matrix) }} | |
| baseconfigs: ["etc-transient", "root-transient", "var-volatile"] | |
| exclude: | |
| # centos-9 ships an older dracut that lacks the auto-install of setup-root-conf.toml | |
| - test_os: centos-9 | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| with: | |
| libvirt: true | |
| - name: Install tmt | |
| uses: ./.github/actions/install-tmt | |
| - name: Setup env | |
| run: | | |
| BASE=$(just pullspec-for-os base ${{ matrix.test_os }}) | |
| echo "BOOTC_base=${BASE}" >> $GITHUB_ENV | |
| echo "BOOTC_variant=composefs" >> $GITHUB_ENV | |
| echo "BOOTC_baseconfigs=${{ matrix.baseconfigs }}" >> $GITHUB_ENV | |
| echo "RUST_BACKTRACE=full" >> $GITHUB_ENV | |
| - name: Download package artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: packages-${{ matrix.test_os }} | |
| path: target/packages/ | |
| - name: Build container with baseconfig | |
| run: BOOTC_SKIP_PACKAGE=1 just build | |
| - name: Build upgrade image | |
| run: just _build-upgrade-image | |
| - name: Run TMT readonly tests | |
| run: | | |
| cargo xtask run-tmt \ | |
| --env=BOOTC_variant=composefs \ | |
| --env=BOOTC_baseconfigs=${{ matrix.baseconfigs }} \ | |
| --composefs-backend --bootloader=grub --filesystem=ext4 \ | |
| --seal-state=unsealed --boot-type=bls \ | |
| --upgrade-image=localhost/bootc-upgrade \ | |
| localhost/bootc readonly | |
| just clean-local-images | |
| - name: Disk usage summary | |
| if: always() | |
| run: | | |
| echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| df -h >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| - name: Archive TMT logs | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: "tmt-log-${{ matrix.test_os }}-composefs-baseconfigs-${{ matrix.baseconfigs }}-${{ env.ARCH }}" | |
| path: /var/tmp/tmt | |
| # Test bootc install on Fedora CoreOS (separate job to avoid disk space issues | |
| # when run in the same job as test-integration). | |
| # Uses fedora-43 as it's the current stable Fedora release matching CoreOS. | |
| test-coreos: | |
| # https://github.com/ostreedev/ostree/pull/3571 broke this because /boot | |
| # without a separate /boot partition isn't mounted in the initramfs anymore. | |
| # We need to change to use coreos-assembler. | |
| if: false | |
| needs: [compute-ci-level, package] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| with: | |
| libvirt: true | |
| - name: Install tmt | |
| uses: ./.github/actions/install-tmt | |
| - name: Setup env | |
| run: | | |
| BASE=$(just pullspec-for-os base fedora-43) | |
| echo "BOOTC_base=${BASE}" >> $GITHUB_ENV | |
| echo "BOOTC_variant=ostree" >> $GITHUB_ENV | |
| - name: Download package artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: packages-fedora-43 | |
| path: target/packages/ | |
| - name: Build container and test on CoreOS | |
| run: | | |
| BOOTC_SKIP_PACKAGE=1 just build | |
| just build-testimage-coreos target/packages | |
| just test-tmt-on-coreos plan-bootc-install-on-coreos | |
| just clean-local-images | |
| - name: Archive TMT logs | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: tmt-log-fedora-43-coreos-${{ env.ARCH }} | |
| path: /var/tmp/tmt | |
| # Test the container export -> Anaconda liveimg install path. | |
| # Builds localhost/bootc, exports as tarball, installs via Anaconda in QEMU, | |
| # and verifies the resulting disk boots. | |
| test-container-export: | |
| if: needs.compute-ci-level.outputs.run_heavy == 'true' | |
| needs: [compute-ci-level, package] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Bootc Ubuntu Setup | |
| uses: bootc-dev/actions/bootc-ubuntu-setup@main | |
| with: | |
| libvirt: true | |
| - name: Setup env | |
| run: | | |
| echo "BOOTC_base=quay.io/centos-bootc/centos-bootc:stream10" >> $GITHUB_ENV | |
| - name: Download package artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: packages-centos-10 | |
| path: target/packages/ | |
| - name: Build and run container export test | |
| run: | | |
| BOOTC_SKIP_PACKAGE=1 just test-container-export | |
| - name: Archive test logs | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: container-export-test-${{ env.ARCH }} | |
| path: target/anaconda-test/*.log | |
| # Gates the full heavy suite. Runs in merge_group / workflow_dispatch, and | |
| # also directly on PRs whenever compute-ci-level found no merge queue | |
| # active (see the merge-queue check in that job) — in that case a PR is | |
| # the only gate, so this must actually require the heavy jobs rather than | |
| # being skipped. | |
| # (Deliberately not extended to plain `push`: a push to main is a record of | |
| # what already merged, not something new to gate.) | |
| # Uses always() so it still reports a failure when an upstream heavy job failed, | |
| # rather than being skipped along with it. | |
| required-checks-heavy: | |
| if: ${{ always() && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && needs.compute-ci-level.outputs.merge_queue_enabled != 'true')) }} | |
| needs: [compute-ci-level, cargo-deny, validate, install-tests, docs, package, test-integration, test-upgrade, test-baseconfigs, test-container-export] | |
| # Cheap aggregation (jq only) — no need for a full VM. | |
| runs-on: ubuntu-slim | |
| steps: | |
| - name: Check all jobs | |
| env: | |
| NEEDS: ${{ toJson(needs) }} | |
| run: | | |
| FAILED=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result | IN("success","skipped") | not) | .key') | |
| if [ -n "$FAILED" ]; then | |
| echo "The following jobs did not succeed: $FAILED" | |
| exit 1 | |
| fi | |
| # Sentinel job — configure this single name in repo required-status-checks settings. | |
| # With a merge queue active: gates only the light always-run jobs on PRs; | |
| # required-checks-heavy is skipped there (treated as success) so ci/merge | |
| # heavy jobs run for feedback but don't block merge-queue entry — those jobs | |
| # run again in the queue anyway with fresh artifacts. In merge_group, | |
| # required-checks-heavy has already verified the full suite above. | |
| # Without a merge queue: required-checks-heavy runs and gates directly on | |
| # PRs too, since there's no queue left to re-verify anything afterwards. | |
| required-checks: | |
| if: always() | |
| needs: [compute-ci-level, validate, cargo-deny, docs, required-checks-heavy] | |
| # Cheap aggregation (jq only) — no need for a full VM. | |
| runs-on: ubuntu-slim | |
| steps: | |
| - name: Check required jobs | |
| env: | |
| NEEDS: ${{ toJson(needs) }} | |
| run: | | |
| FAILED=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result | IN("success","skipped") | not) | .key') | |
| if [ -n "$FAILED" ]; then | |
| echo "The following jobs did not succeed: $FAILED" | |
| exit 1 | |
| fi |