ci: run the musl build & test under mkosi with a postmarketOS tools tree

Drop the standalone Unit-tests (musl) workflow that ran on an Alpine sandbox
spun up by jirutka/setup-alpine, and merge it into unit-tests.yml as a new
build-musl job that provisions a postmarketOS tools tree via mkosi and runs
the meson build + test suite through 'mkosi box'. postmarketOS is musl-native,
so the musl-gcc / -idirafter /usr/include wrappers the Fedora tools tree
needed are gone; the linter.yml's own musl build step also goes away since
the unit-tests workflow now covers it (and tests it).

postmarketOS doesn't ship a downstream systemd packaging spec, so the new
tools tree config in mkosi.tools.conf/mkosi.conf.d/postmarketos.conf does not
set PrepareScripts and lists build deps manually. mkosi.sync now early-exits
when PKG_SUBDIR is unset so the missing pkgenv entry doesn't trip set -u.

Co-developed-by: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/linter.yml

@@ -87,14 +87,3 @@ jobs:
 
       - name: Run coccinelle checks
         run: mkosi box -- meson test -C build --suite=coccinelle --print-errorlogs --no-stdsplit
-
-      - name: Build with musl
-        run: |
-          mkosi box -- \
-            env \
-            CC=musl-gcc \
-            CXX=musl-gcc \
-            CFLAGS="-idirafter /usr/include" \
-            CXXFLAGS="-idirafter /usr/include" \
-              meson setup -Dlibc=musl -Ddbus-interfaces-dir=no musl
-          mkosi box -- ninja -C musl

.github/workflows/unit-tests-musl.sh

@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-# shellcheck disable=SC2206
-PHASES=(${@:-SETUP BUILD RUN CLEANUP})
-
-function info() {
-    echo -e "\033[33;1m$1\033[0m"
-}
-
-function run_meson() {
-    if ! meson "$@"; then
-        find . -type f -name meson-log.txt -exec cat '{}' +
-        return 1
-    fi
-}
-
-set -ex
-
-for phase in "${PHASES[@]}"; do
-    case $phase in
-        SETUP)
-            info "Setup phase"
-
-            # Alpine still uses split-usr.
-            for i in /bin/* /sbin/*; do
-                ln -rs "$i" "/usr/$i";
-            done
-            ;;
-        BUILD)
-            info "Build systemd phase"
-
-            run_meson setup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true -Dlibc=musl build
-            ninja -v -C build
-            ;;
-        RUN)
-            info "Run phase"
-
-            # Create dummy machine ID.
-            echo '052e58f661f94bd080e258b96aea3f7b' >/etc/machine-id
-
-            # Start dbus for several unit tests.
-            mkdir -p /var/run/dbus
-            /usr/bin/dbus-daemon --system || :
-
-            # Here, we explicitly set SYSTEMD_IN_CHROOT=yes as unfortunately runnin_in_chroot() does not
-            # correctly detect the environment.
-            env \
-                SYSTEMD_IN_CHROOT=yes \
-                meson test -C build --print-errorlogs --no-stdsplit --quiet
-            ;;
-        CLEANUP)
-            info "Cleanup phase"
-            ;;
-        *)
-            echo >&2 "Unknown phase '$phase'"
-            exit 1
-    esac
-done

.github/workflows/unit-tests-musl.yml

@@ -1,113 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: Unit tests (musl)
-on:
-  pull_request:
-    paths:
-      - '**/meson.build'
-      - '.github/workflows/**'
-      - 'meson_options.txt'
-      - 'src/**'
-      - 'test/fuzz/**'
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Repository checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-
-      - name: Install build dependencies
-        uses: jirutka/setup-alpine@v1
-        with:
-          arch: x86_64
-          branch: edge
-          packages: >
-            acl
-            acl-dev
-            audit-dev
-            bash
-            bash-completion-dev
-            bpftool
-            build-base
-            bzip2-dev
-            coreutils
-            cryptsetup-dev
-            curl-dev
-            dbus
-            dbus-dev
-            elfutils-dev
-            gettext-dev
-            git
-            glib-dev
-            gnutls-dev
-            gperf
-            grep
-            iproute2
-            iptables-dev
-            kbd
-            kmod
-            kmod-dev
-            libapparmor-dev
-            libarchive-dev
-            libbpf-dev
-            libcap-dev
-            libcap-utils
-            libfido2-dev
-            libgcrypt-dev
-            libidn2-dev
-            libmicrohttpd-dev
-            libpwquality-dev
-            libqrencode-dev
-            libseccomp-dev
-            libselinux-dev
-            libxkbcommon-dev
-            linux-pam-dev
-            lz4-dev
-            meson
-            openssl
-            openssl-dev
-            p11-kit-dev
-            pcre2-dev
-            pkgconf
-            polkit-dev
-            py3-elftools
-            py3-jinja2
-            py3-pefile
-            py3-pytest
-            py3-lxml
-            quota-tools
-            rsync
-            sfdisk
-            tpm2-tss-dev
-            tpm2-tss-esys
-            tpm2-tss-rc
-            tpm2-tss-tcti-device
-            tzdata
-            util-linux-dev
-            util-linux-misc
-            utmps-dev
-            valgrind-dev
-            xen-dev
-            zlib-dev
-            zstd-dev
-
-      - name: Setup
-        run: .github/workflows/unit-tests-musl.sh SETUP
-        shell: alpine.sh --root {0}
-      - name: Build
-        run: .github/workflows/unit-tests-musl.sh BUILD
-        shell: alpine.sh {0}
-      - name: Run
-        run: .github/workflows/unit-tests-musl.sh RUN
-        shell: alpine.sh --root {0}
-      - name: Cleanup
-        run: .github/workflows/unit-tests-musl.sh CLEANUP
-        shell: alpine.sh --root {0}

.github/workflows/unit-tests.yml

@@ -53,3 +53,55 @@ jobs:
           sudo --preserve-env=GITHUB_ACTIONS,CI .github/workflows/unit-tests.sh SETUP
       - name: Build & test
         run: sudo --preserve-env=GITHUB_ACTIONS,CI .github/workflows/unit-tests.sh RUN_${{ matrix.run_phase }}
+
+  build-musl:
+    name: Build & test (musl, postmarketOS)
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: ${{ github.workflow }}-musl-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - uses: systemd/mkosi@444d247d1a1328bcfb84a945e84959bd4bd0e02d
+
+      - name: Install apk
+        # ubuntu-24.04 doesn't package apk, so fetch the official statically-linked binary from
+        # upstream so mkosi can use it to populate the postmarketOS tools tree.
+        run: |
+          sudo curl -fsSL -o /usr/local/bin/apk \
+              https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic/v3.0.6/x86_64/apk.static
+          echo 'f1489e05bace7d7dd0a687fcd38d50b585ac660af4231668b123649bef3718c4  /usr/local/bin/apk' | sha256sum --check
+          sudo chmod +x /usr/local/bin/apk
+
+      - name: Build tools tree
+        run: |
+          tee mkosi/mkosi.local.conf <<EOF
+          [Build]
+          ToolsTreeDistribution=postmarketos
+          EOF
+
+          tee mkosi/mkosi.tools.conf/mkosi.local.conf <<EOF
+          [Distribution]
+          RepositoryKeyFetch=yes
+          EOF
+
+          mkosi -f box -- true
+
+      - name: Build
+        run: |
+          mkosi box -- \
+              meson setup \
+                  --werror \
+                  -Dtests=unsafe \
+                  -Dslow-tests=true \
+                  -Dfuzz-tests=true \
+                  -Dlibc=musl \
+                  build
+          mkosi box -- ninja -v -C build
+
+      - name: Test
+        run: mkosi box -- meson test -C build --print-errorlogs --no-stdsplit --quiet

mkosi/mkosi.sync

@@ -7,6 +7,12 @@ if ((${NO_SYNC:-0})) || ((${NO_BUILD:-0})); then
     exit 0
 fi
 
+# Distributions without downstream systemd packaging (e.g. postmarketOS) skip the mkosi.pkgenv entry
+# that sets PKG_SUBDIR (and the matching prepare script), so there's nothing to sync.
+if [[ -z "${PKG_SUBDIR:-}" ]]; then
+    exit 0
+fi
+
 if [[ -d "pkg/$PKG_SUBDIR/.git" ]]; then
     if [[ "$(git -C "pkg/$PKG_SUBDIR" rev-parse HEAD 2>/dev/null)" == "$GIT_COMMIT" ]]; then
         exit 0

mkosi/mkosi.tools.conf/mkosi.conf.d/postmarketos.conf

@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+# postmarketOS is musl-based natively, so it can host the musl build directly without needing
+# the musl-gcc wrapper that the Fedora tools tree uses. We don't run a PrepareScripts to pull
+# systemd build deps from a downstream packaging spec — postmarketOS doesn't ship one — so the
+# Packages= list below is the canonical set of build deps for the musl CI build in
+# .github/workflows/unit-tests.yml (build-musl job).
+[Content]
+Packages=
+        acl
+        acl-dev
+        audit-dev
+        bash
+        bash-completion-dev
+        bpftool
+        build-base
+        bzip2-dev
+        coccinelle
+        coreutils
+        cryptsetup-dev
+        curl-dev
+        dbus
+        dbus-dev
+        elfutils-dev
+        gettext-dev
+        git
+        github-cli
+        glib-dev
+        gnutls-dev
+        gperf
+        grep
+        iproute2
+        iptables-dev
+        kbd
+        kmod
+        kmod-dev
+        lcov
+        libapparmor-dev
+        libarchive-dev
+        libbpf-dev
+        libcap-dev
+        libcap-utils
+        libfido2-dev
+        libgcrypt-dev
+        libgpg-error-dev
+        libidn2-dev
+        libmicrohttpd-dev
+        libpwquality-dev
+        libqrencode-dev
+        libseccomp-dev
+        libselinux-dev
+        libucontext-dev
+        libxkbcommon-dev
+        linux-pam-dev
+        lz4-dev
+        openssl
+        openssl-dev
+        p11-kit-dev
+        pcre2-dev
+        pkgconf
+        polkit-dev
+        py3-elftools
+        py3-jinja2
+        py3-lxml
+        py3-pefile
+        py3-pytest
+        quota-tools
+        ruff
+        rsync
+        sfdisk
+        shellcheck
+        tpm2-tss-dev
+        tpm2-tss-esys
+        tpm2-tss-rc
+        tpm2-tss-tcti-device
+        tzdata
+        util-linux-dev
+        util-linux-misc
+        utmps-dev
+        valgrind-dev
+        xen-dev
+        zlib-dev
+        zstd-dev

tools/fetch-mkosi.py

@@ -15,7 +15,9 @@ from pathlib import Path
 URL = 'https://github.com/systemd/mkosi'
 BRANCH = 'main'  # We only want to ever use commits on upstream 'main' branch
 CONFIG = Path('mkosi/mkosi.conf')
-WORKFLOWS = [Path('.github/workflows') / f for f in ['mkosi.yml', 'coverage.yml', 'linter.yml']]
+WORKFLOWS = [
+    Path('.github/workflows') / f for f in ['mkosi.yml', 'coverage.yml', 'linter.yml', 'unit-tests.yml']
+]
 
 
 def parse_args():