systemd/.github/workflows/mkosi.yml

---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.conf.d/.
name: mkosi

on:
  push:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

  pull_request:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

permissions:
  contents: read

jobs:
  ci:
    runs-on: ${{ matrix.runner }}
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}-${{ matrix.runner }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        include:
          - distro: arch
            release: rolling
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-O2 -D_FORTIFY_SOURCE=3"
            relabel: no
            vm: 1
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: debian
            release: stable
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: debian
            release: testing
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 1
          - distro: debian
            release: testing
            runner: ubuntu-24.04-arm
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            no_qemu: 1
            no_kvm: 1
            shim: 0
          - distro: ubuntu
            release: noble
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: fedora
            release: "43"
            runner: ubuntu-24.04
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
            relabel: yes
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: fedora
            release: rawhide
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: opensuse
            release: tumbleweed
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: centos
            release: "9"
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0
          - distro: centos
            release: "10"
            runner: ubuntu-24.04
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            no_qemu: 0
            no_kvm: 0
            shim: 0

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: systemd/mkosi@10544812b35a668d4aac9834c78ee8166e99bc78

      # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
      # immediately, we remove the files in the background. However, we first move them to a different location
      # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
      - name: Free disk space
        run: |
          sudo mv /usr/local /usr/local.trash
          sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
          sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash

      - name: Btrfs
        run: |
          truncate --size=100G btrfs.raw
          mkfs.btrfs btrfs.raw
          sudo mkdir -p /mnt/mkosi
          LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
          rm -f btrfs.raw
          sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
          sudo chown "$(id -u):$(id -g)" /mnt/mkosi
          mkdir -p /mnt/mkosi/tmp
          echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
          ln -sf /mnt/mkosi/build build

      - name: Configure
        run: |
          tee mkosi/mkosi.local.conf <<EOF
          [Distribution]
          Distribution=${{ matrix.distro }}
          Release=${{ matrix.release }}

          [Output]
          # Build a disk image in CI as this logic is much more prone to breakage.
          Format=disk

          [Build]
          UseSubvolumes=yes
          ToolsTreeDistribution=${{ matrix.distro }}
          ToolsTreeRelease=${{ matrix.release }}
          WithTests=yes

          WorkspaceDirectory=$TMPDIR
          PackageCacheDirectory=$TMPDIR/cache

          Environment=
                  # Build debuginfo packages since we'll be publishing the packages as artifacts.
                  WITH_DEBUG=1
                  CFLAGS="${{ matrix.cflags }}"
                  SANITIZERS=${{ matrix.sanitizers }}
                  MESON_OPTIONS=--werror
                  LLVM=${{ matrix.llvm }}
                  SYSEXT=1

          [Content]
          SELinuxRelabel=${{ matrix.relabel }}

          [Runtime]
          RAM=4G
          EOF

      - name: Generate secure boot key
        run: mkosi --debug genkey

      - name: Show image summary
        run: mkosi summary

      - name: Build tools tree
        run: sudo mkosi -f box -- true

      - name: Configure meson
        run: |
          # /usr/sbin/bpftool is completely broken inside containers on Ubuntu which makes meson blow up so
          # disable the bpf-framework stuff to avoid the issue.
          # TODO: Drop when we move off Ubuntu Noble as this will be fixed in the next Ubuntu LTS release.
          sudo mkosi box -- \
            meson setup \
            --buildtype=debugoptimized \
            -Dbpf-framework=disabled \
            build

      - name: Prepare shim integration
        run: |
          if [ ${{ matrix.shim }} = 1 ]; then
            { printf '[Content]\nPackages=shim-signed\nShimBootloader=signed\n'; \
              printf '[Runtime]\nFirmware=uefi-secure-boot\nFirmwareVariables=%%O/ovmf_vars_shim.fd\n'; } \
              >>mkosi/mkosi.local.conf

            sudo mkdir -p build/mkosi.output/
            sudo mkosi -f box -- \
              virt-fw-vars \
              --secure-boot \
              --enroll-cert mkosi/mkosi.crt \
              --add-mok 605dab50-e046-4300-abb6-3dd810dd8b23 mkosi/mkosi.crt \
              --input /usr/share/OVMF/OVMF_VARS_4M.fd \
              --output build/mkosi.output/ovmf_vars_shim.fd
          fi

      - name: Build image
        run: sudo mkosi box -- meson compile -C build mkosi

      - name: Make sure sources weren't polluted by package build scripts
        run: |
          git status
          git diff
          test -z "$(git status --porcelain)"
          # There will only be one subdirectory, so we don't have to know exactly which one. Also, the
          # subdirectory will be owned by root since we used sudo to build the image, so use sudo here as well.
          sudo git -C pkg/* status
          sudo git -C pkg/* diff
          test -z "$(sudo git -C pkg/* status --porcelain)"

      - name: Run integration tests
        run: |
          if [[ "$(sudo mkosi box -- meson test --help)" == *"--max-lines"* ]]; then
              MAX_LINES=(--max-lines 300)
          else
              MAX_LINES=()
          fi

          if [ "${{ matrix.no_kvm }}" = 1 ] && [ "${{ matrix.no_qemu }}" = 0 ]; then
              timeout_multiplier=4
          fi

          # --preserve-env makes sure all the github actions environment variables are propagated which are
          # used in integration-test-wrapper.py to construct the `gh` command line to download the journals
          # of failed tests.
          sudo --preserve-env mkosi box -- \
            env \
            TEST_PREFER_QEMU=${{ matrix.vm }} \
            TEST_NO_QEMU=${{ matrix.no_qemu }} \
            TEST_NO_KVM=${{ matrix.no_kvm }} \
            TEST_RUNNER=${{ matrix.runner }} \
            meson test \
            -C build \
            --timeout-multiplier="${timeout_multiplier:-1}" \
            --no-rebuild \
            --setup=integration \
            --suite=integration-tests \
            --print-errorlogs \
            --no-stdsplit \
            --num-processes "$(($(nproc) - 1))" \
            "${MAX_LINES[@]}"

      - name: Archive failed test journals
        uses: actions/upload-artifact@v4
        if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
        with:
          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-${{ matrix.runner }}-failed-test-journals
          path: |
            build/test/journal/*.journal
            build/meson-logs/*
          retention-days: 7