Jan Janssen
2de6cc18f9
This gives us some nice test coverage for secure boot enrolling and the stub secure boot workound. The authenticated EFI variables are already created by mkosi, all we need to do is request secure boot to be used.
118 lines
3.1 KiB
YAML
118 lines
3.1 KiB
YAML
---
|
|
# vi: ts=2 sw=2 et:
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.default.d/.
|
|
name: mkosi
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- v[0-9]+-stable
|
|
paths:
|
|
- '**'
|
|
- '!README*'
|
|
- '!LICENSE*'
|
|
- '!LICENSES/**'
|
|
- '!TODO'
|
|
- '!docs/**'
|
|
- '!man/**'
|
|
- '!catalog/**'
|
|
- '!shell-completion/**'
|
|
- '!po/**'
|
|
- '!.**'
|
|
- '.github/**'
|
|
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- v[0-9]+-stable
|
|
paths:
|
|
- '**'
|
|
- '!README*'
|
|
- '!LICENSE*'
|
|
- '!LICENSES/**'
|
|
- '!TODO'
|
|
- '!docs/**'
|
|
- '!man/**'
|
|
- '!catalog/**'
|
|
- '!shell-completion/**'
|
|
- '!po/**'
|
|
- '!.**'
|
|
- '.github/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Enable debug logging in systemd, but keep udev's log level to info,
|
|
# since it's _very_ verbose in the QEMU task
|
|
# Disable the ISC DHCP servers, as they are failing in Ubuntu
|
|
KERNEL_CMDLINE: "systemd.unit=mkosi-check-and-shutdown.service !quiet systemd.log_level=debug systemd.log_target=console udev.log_level=info systemd.default_standard_output=journal+console systemd.mask=isc-dhcp-server6.service systemd.mask=isc-dhcp-server.service"
|
|
|
|
jobs:
|
|
ci:
|
|
runs-on: ubuntu-22.04
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- distro: arch
|
|
release: rolling
|
|
- distro: debian
|
|
release: testing
|
|
- distro: ubuntu
|
|
release: jammy
|
|
- distro: fedora
|
|
release: "37"
|
|
- distro: fedora
|
|
release: rawhide
|
|
- distro: opensuse
|
|
release: tumbleweed
|
|
- distro: centos
|
|
release: "9"
|
|
- distro: centos
|
|
release: "8"
|
|
|
|
steps:
|
|
- uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
|
|
- uses: systemd/mkosi@500f93a36cc3d5bf1d06848a0a8870bf1424625f
|
|
|
|
- name: Configure
|
|
run: |
|
|
tee mkosi.default <<- EOF
|
|
[Distribution]
|
|
Distribution=${{ matrix.distro }}
|
|
Release=${{ matrix.release }}
|
|
|
|
[Content]
|
|
Environment=CI_BUILD=1
|
|
|
|
[Output]
|
|
KernelCommandLine=${{ env.KERNEL_CMDLINE }}
|
|
EOF
|
|
|
|
- name: Generate secure boot key
|
|
run: sudo mkosi genkey
|
|
|
|
- name: Build ${{ matrix.distro }}
|
|
run: sudo mkosi --idmap no --secure-boot
|
|
|
|
- name: Show ${{ matrix.distro }} image summary
|
|
run: sudo mkosi summary
|
|
|
|
- name: Boot ${{ matrix.distro }} systemd-nspawn
|
|
run: sudo mkosi boot ${{ env.KERNEL_CMDLINE }} audit=0
|
|
|
|
- name: Check ${{ matrix.distro }} systemd-nspawn
|
|
run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
|
|
|
|
- name: Boot ${{ matrix.distro }} QEMU
|
|
run: sudo timeout -k 30 10m mkosi qemu
|
|
|
|
- name: Check ${{ matrix.distro }} QEMU
|
|
run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
|