systemd/.github/workflows/mkosi.yml

---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.conf.d/.
name: mkosi

on:
  push:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

  pull_request:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - "**"
      - "!README*"
      - "!LICENSE*"
      - "!LICENSES/**"
      - "!TODO"
      - "!docs/**"
      - "!man/**"
      - "!catalog/**"
      - "!shell-completion/**"
      - "!po/**"
      - "!.**"
      - ".github/**"

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-24.04
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        include:
          - distro: arch
            release: rolling
            sanitizers: ""
            llvm: 0
            cflags: "-O2 -D_FORTIFY_SOURCE=3"
            relabel: no
          - distro: debian
            release: testing
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: ubuntu
            release: noble
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: fedora
            release: "41"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
          - distro: fedora
            release: rawhide
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
            relabel: yes
          - distro: opensuse
            release: tumbleweed
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: centos
            release: "9"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
          - distro: centos
            release: "10"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: systemd/mkosi@8976a0abb19221e65300222f2d33067970cca0f1

      # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
      # immediately, we remove the files in the background. However, we first move them to a different location
      # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
      - name: Free disk space
        run: |
          sudo mv /usr/local /usr/local.trash
          sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
          sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash

      - name: Btrfs
        run: |
          truncate --size=100G btrfs.raw
          mkfs.btrfs btrfs.raw
          sudo mkdir /mnt/mkosi
          LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
          sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
          sudo chown "$(id -u):$(id -g)" /mnt/mkosi
          mkdir /mnt/mkosi/tmp
          echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
          ln -s /mnt/mkosi/build build

      - name: Configure
        run: |
          # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
          sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build
          tee mkosi.local.conf <<EOF
          [Distribution]
          Distribution=${{ matrix.distro }}
          Release=${{ matrix.release }}

          [Output]
          # Build a disk image in CI as this logic is much more prone to breakage.
          Format=disk

          [Build]
          UseSubvolumes=yes

          WorkspaceDirectory=$TMPDIR
          PackageCacheDirectory=$TMPDIR/cache

          Environment=
                  # Build debuginfo packages since we'll be publishing the packages as artifacts.
                  WITH_DEBUG=1
                  CFLAGS="${{ matrix.cflags }}"
                  SANITIZERS=${{ matrix.sanitizers }}
                  MESON_OPTIONS=--werror
                  LLVM=${{ matrix.llvm }}
                  SYSEXT=1

          [Content]
          SELinuxRelabel=${{ matrix.relabel }}

          [Host]
          QemuMem=4G
          EOF

      - name: Generate secure boot key
        run: mkosi --debug genkey

      - name: Show image summary
        run: mkosi summary

      - name: Install dependencies
        run: |
          mkosi dependencies |
          xargs -d '\n' sudo apt-get install \
              gperf \
              libblkid-dev \
              libcap-dev \
              libcryptsetup-dev \
              libcurl4-openssl-dev \
              libfdisk-dev \
              libmicrohttpd-dev \
              libmount-dev \
              libtss2-dev \
              meson

      - name: Configure meson
        run: |
          meson setup build \
              --buildtype=debugoptimized \
              -Dintegration-tests=true \
              -Dremote=enabled \
              -Dopenssl=enabled \
              -Dblkid=enabled \
              -Dtpm2=enabled \
              -Dlibcryptsetup=enabled \
              -Dlibcurl=enabled \
              -Drepart=enabled \
              -Dfirstboot=true \
              -Dsysusers=true \
              -Dtmpfiles=true \
              -Dhwdb=true \
              -Dvmspawn=enabled

      - name: Build image
        run: sudo meson compile -C build mkosi

      - name: Run integration tests
        run: sudo --preserve-env meson test -C build --no-rebuild --suite integration-tests --print-errorlogs --no-stdsplit --num-processes "$(($(nproc) - 1))"

      - name: Archive failed test journals
        uses: actions/upload-artifact@v4
        if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
        with:
          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-failed-test-journals
          path: |
            build/test/journal/*.journal
            build/meson-logs/*
          retention-days: 7

      - name: Archive packages
        uses: actions/upload-artifact@v4
        if: (success() || failure()) && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
        with:
          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-packages
          path: |
            build/mkosi.output/*.rpm
            build/mkosi.output/*.deb
            build/mkosi.output/*.ddeb
            build/mkosi.output/*.pkg.tar
          retention-days: 4