systemd/.github/workflows/mkosi.yml

---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.conf.d/.
name: mkosi

on:
  push:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

  pull_request:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-24.04
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        include:
          - distro: arch
            release: rolling
            sanitizers: ""
            llvm: 0
            cflags: "-O2 -D_FORTIFY_SOURCE=3"
            relabel: no
            vm: 1
            skip: TEST-21-DFUZZER
          - distro: debian
            release: testing
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            skip: TEST-21-DFUZZER
          - distro: ubuntu
            release: noble
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            skip: TEST-21-DFUZZER
          - distro: fedora
            release: "41"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            skip: TEST-21-DFUZZER
          - distro: fedora
            release: rawhide
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
            relabel: yes
            vm: 0
          - distro: opensuse
            release: tumbleweed
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
            vm: 0
            skip: TEST-21-DFUZZER
          - distro: centos
            release: "9"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            skip: TEST-21-DFUZZER
          - distro: centos
            release: "10"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
            vm: 0
            skip: TEST-21-DFUZZER

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: systemd/mkosi@c1ae257e270e768088eadf7b44fbbbb48c575709

      # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
      # immediately, we remove the files in the background. However, we first move them to a different location
      # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
      - name: Free disk space
        run: |
          sudo mv /usr/local /usr/local.trash
          sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
          sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash

      - name: Btrfs
        run: |
          truncate --size=100G btrfs.raw
          mkfs.btrfs btrfs.raw
          sudo mkdir /mnt/mkosi
          LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
          sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
          sudo chown "$(id -u):$(id -g)" /mnt/mkosi
          mkdir /mnt/mkosi/tmp
          echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
          ln -s /mnt/mkosi/build build

      - name: Configure
        run: |
          # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
          sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build

          tee mkosi.local.conf <<EOF
          [Distribution]
          Distribution=${{ matrix.distro }}
          Release=${{ matrix.release }}

          [Output]
          # Build a disk image in CI as this logic is much more prone to breakage.
          Format=disk

          [Build]
          UseSubvolumes=yes
          ToolsTreeDistribution=fedora
          ToolsTreeRelease=rawhide

          WorkspaceDirectory=$TMPDIR
          PackageCacheDirectory=$TMPDIR/cache

          Environment=
                  # Build debuginfo packages since we'll be publishing the packages as artifacts.
                  WITH_DEBUG=1
                  CFLAGS="${{ matrix.cflags }}"
                  SANITIZERS=${{ matrix.sanitizers }}
                  MESON_OPTIONS=--werror
                  LLVM=${{ matrix.llvm }}
                  SYSEXT=1

          [Content]
          SELinuxRelabel=${{ matrix.relabel }}

          [Runtime]
          RAM=4G
          EOF

      - name: Generate secure boot key
        run: mkosi --debug genkey

      - name: Show image summary
        run: mkosi summary

      - name: Build tools tree
        run: mkosi -f sandbox true

      - name: Configure meson
        run: mkosi sandbox meson setup --buildtype=debugoptimized -Dintegration-tests=true build

      - name: Build image
        run: sudo --preserve-env mkosi sandbox meson compile -C build mkosi

      - name: Run integration tests
        run: |
          sudo --preserve-env \
            mkosi sandbox \
            env \
            TEST_PREFER_QEMU=${{ matrix.vm }} \
            TEST_SKIP=${{ matrix.skip }} \
            meson test \
            -C build \
            --no-rebuild \
            --suite integration-tests \
            --print-errorlogs \
            --no-stdsplit \
            --num-processes "$(($(nproc) - 1))" \
            --max-lines 300

      - name: Archive failed test journals
        uses: actions/upload-artifact@v4
        if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
        with:
          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-failed-test-journals
          path: |
            build/test/journal/*.journal
            build/meson-logs/*
          retention-days: 7