roots/phyllomeos
1
0
Fork 1
Code Pull Requests 1 Actions Packages Releases 1 Activity

ci: smoke-test built images; build on labeled PRs, weekly and on demand
ci / cook (push) Successful in 12s
Details
ci / cook (pull_request) Successful in 11s
Details

Browse Source 
smoke-test.sh checks an image from build-image.sh in two steps:
- static, read-only: if the image declares SELinux, no kernel command line
  (/etc/kernel/cmdline, ESP and /boot loader entries) may carry selinux=0 and
  files must be labeled. This catches images built on a host with SELinux
  disabled, where anaconda inherits the host's selinux=0 and overrides the
  kickstart's `selinux --enforcing` (CI run 237);
- boot: KVM with -snapshot, no network, waits for qemu-guest-agent to
  answer, so it does not depend on a serial console in the image.
Verified on the runner: the run-237 image fails the static check, a fresh
build passes both (agent answered after 27s).

build-image.yaml now smoke-tests each edition before compressing it, and
besides v*.*.* tags also runs:
- on PRs into main labeled `build-image` (the review gate: Gitea does not
  let authors approve their own PRs), re-running on new pushes while the
  label stays, only for image-affecting paths, and not when an unrelated
  label is added;
- weekly (Mondays 03:00), to catch upstream Fedora breakage;
- via workflow_dispatch.
Non-tag runs keep the images as 7-day artifacts. README updated, including
the stale "every push to main" sentence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Lukas Greve
2026-09-23 20:04:32 +02:00
co-authored by Claude Opus 5.5
parent c611bbf2c2
commit f7b6623b25
3 changed files with 267 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -1
View File
@@ -71,7 +71,16 @@ bootable ISO:
```
It picks a dish the same way `deploy.sh` does (or takes `--dish NAME`) and writes the result under
`./build/`. The `build-image` CI workflow runs it for both default editions on every push to `main`, and on `v*.*.*` tags it attaches the compressed raw images (`.img.xz`) and the flattened kickstart files to the release. Requires `lorax-lmc-novirt` (heavier than `deploy.sh`'s plain
`./build/`. `smoke-test.sh IMAGE` then checks the result: read-only static checks (no `selinux=0` on any kernel command line and labeled files when the image declares SELinux; builds on a host with SELinux disabled fail this), then a KVM boot with `-snapshot` that waits for qemu-guest-agent to answer.
The `build-image` CI workflow builds, smoke-tests and compresses both default editions. It does not run on plain pushes (a build takes ~25 min and runs as root on the runner); `ci.yml` lints and validates every push instead. It runs on:
* `v*.*.*` tags: attaches the compressed raw images (`.img.xz`) and the flattened kickstart files to the release;
* PRs into `main` labeled `build-image` (set it once the PR is reviewed; it re-runs on every new push while the label stays), for changes under `cook/`, to `build-image.sh`, `smoke-test.sh` or the workflow itself;
* a weekly schedule (Mondays 03:00), to catch breakage from upstream Fedora packages;
* manual dispatch from the Actions tab, on any branch.
Non-tag runs keep the images as 7-day workflow artifacts. Requires `lorax-lmc-novirt` (heavier than `deploy.sh`'s plain
QEMU/libvirt prerequisites, not installed by
`deploy/install-prerequisites-on-linux.sh`) and root — the `--no-virt` disk
install needs real loop-device access (`/dev/loop-control`), which a