ci: smoke-test built images; build on labeled PRs, weekly and on demand #9

Merged

lukas merged 2 commits from ci/pr-label-builds into main 2026-09-23 18:06:38 +00:00

Conversation 0 Commits 2 Files Changed 3

+267 -7

lukas commented 2026-09-23 18:06:05 +00:00

Owner

Copy Link

Copy Source

smoke-test.sh checks an image from build-image.sh in two steps:

• static, read-only: if the image declares SELinux, no kernel command line
  (/etc/kernel/cmdline, ESP and /boot loader entries) may carry selinux=0 and
  files must be labeled. This catches images built on a host with SELinux
  disabled, where anaconda inherits the host's selinux=0 and overrides the
  kickstart's selinux --enforcing (CI run 237);
• boot: KVM with -snapshot, no network, waits for qemu-guest-agent to
  answer, so it does not depend on a serial console in the image.
  Verified on the runner: the run-237 image fails the static check, a fresh
  build passes both (agent answered after 27s).

build-image.yaml now smoke-tests each edition before compressing it, and
besides v*.. tags also runs:

• on PRs into main labeled build-image (the review gate: Gitea does not
  let authors approve their own PRs), re-running on new pushes while the
  label stays, only for image-affecting paths, and not when an unrelated
  label is added;
• weekly (Mondays 03:00), to catch upstream Fedora breakage;
• via workflow_dispatch.
  Non-tag runs keep the images as 7-day artifacts. README updated, including
  the stale "every push to main" sentence.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

smoke-test.sh checks an image from build-image.sh in two steps: - static, read-only: if the image declares SELinux, no kernel command line (/etc/kernel/cmdline, ESP and /boot loader entries) may carry selinux=0 and files must be labeled. This catches images built on a host with SELinux disabled, where anaconda inherits the host's selinux=0 and overrides the kickstart's `selinux --enforcing` (CI run 237); - boot: KVM with -snapshot, no network, waits for qemu-guest-agent to answer, so it does not depend on a serial console in the image. Verified on the runner: the run-237 image fails the static check, a fresh build passes both (agent answered after 27s). build-image.yaml now smoke-tests each edition before compressing it, and besides v*.*.* tags also runs: - on PRs into main labeled `build-image` (the review gate: Gitea does not let authors approve their own PRs), re-running on new pushes while the label stays, only for image-affecting paths, and not when an unrelated label is added; - weekly (Mondays 03:00), to catch upstream Fedora breakage; - via workflow_dispatch. Non-tag runs keep the images as 7-day artifacts. README updated, including the stale "every push to main" sentence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lukas added 1 commit 2026-09-23 18:06:05 +00:00

ci: smoke-test built images; build on labeled PRs, weekly and on demand ... f7b6623b25

smoke-test.sh checks an image from build-image.sh in two steps:
- static, read-only: if the image declares SELinux, no kernel command line
  (/etc/kernel/cmdline, ESP and /boot loader entries) may carry selinux=0 and
  files must be labeled. This catches images built on a host with SELinux
  disabled, where anaconda inherits the host's selinux=0 and overrides the
  kickstart's `selinux --enforcing` (CI run 237);
- boot: KVM with -snapshot, no network, waits for qemu-guest-agent to
  answer, so it does not depend on a serial console in the image.
Verified on the runner: the run-237 image fails the static check, a fresh
build passes both (agent answered after 27s).

build-image.yaml now smoke-tests each edition before compressing it, and
besides v*.*.* tags also runs:
- on PRs into main labeled `build-image` (the review gate: Gitea does not
  let authors approve their own PRs), re-running on new pushes while the
  label stays, only for image-affecting paths, and not when an unrelated
  label is added;
- weekly (Mondays 03:00), to catch upstream Fedora breakage;
- via workflow_dispatch.
Non-tag runs keep the images as 7-day artifacts. README updated, including
the stale "every push to main" sentence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lukas added 1 commit 2026-09-23 18:06:19 +00:00

Merge branch 'main' into ci/pr-label-builds dad1642705

lukas merged commit ccd1450a01 into main 2026-09-23 18:06:38 +00:00

lukas referenced this pull request 2026-09-25 12:25:01 +00:00

WIP: cook: ship the fscrypt stack by default in Phyllome OS #10

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

lukas (Lukas Greve)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: roots/phyllomeos#9