Lukas GreveandClaude Opus 5.5
f7b6623b25
smoke-test.sh checks an image from build-image.sh in two steps: - static, read-only: if the image declares SELinux, no kernel command line (/etc/kernel/cmdline, ESP and /boot loader entries) may carry selinux=0 and files must be labeled. This catches images built on a host with SELinux disabled, where anaconda inherits the host's selinux=0 and overrides the kickstart's `selinux --enforcing` (CI run 237); - boot: KVM with -snapshot, no network, waits for qemu-guest-agent to answer, so it does not depend on a serial console in the image. Verified on the runner: the run-237 image fails the static check, a fresh build passes both (agent answered after 27s). build-image.yaml now smoke-tests each edition before compressing it, and besides v*.*.* tags also runs: - on PRs into main labeled `build-image` (the review gate: Gitea does not let authors approve their own PRs), re-running on new pushes while the label stays, only for image-affecting paths, and not when an unrelated label is added; - weekly (Mondays 03:00), to catch upstream Fedora breakage; - via workflow_dispatch. Non-tag runs keep the images as 7-day artifacts. README updated, including the stale "every push to main" sentence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>