---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.conf.d/.
name: mkosi

on:
  push:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - '**'
      - '!README*'
      - '!LICENSE*'
      - '!LICENSES/**'
      - '!TODO'
      - '!docs/**'
      - '!man/**'
      - '!catalog/**'
      - '!shell-completion/**'
      - '!po/**'
      - '!.**'
      - '.github/**'

  pull_request:
    branches:
      - main
      - v[0-9]+-stable
    paths:
      - '**'
      - '!README*'
      - '!LICENSE*'
      - '!LICENSES/**'
      - '!TODO'
      - '!docs/**'
      - '!man/**'
      - '!catalog/**'
      - '!shell-completion/**'
      - '!po/**'
      - '!.**'
      - '.github/**'

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-24.04
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        include:
          - distro: arch
            release: rolling
            sanitizers: ""
            llvm: 0
            cflags: "-O2 -D_FORTIFY_SOURCE=3"
            relabel: no
          - distro: debian
            release: testing
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: ubuntu
            release: noble
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: fedora
            release: "40"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
          - distro: fedora
            release: rawhide
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
            relabel: yes
          - distro: opensuse
            release: tumbleweed
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: no
          - distro: centos
            release: "9"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes
          - distro: centos
            release: "10"
            sanitizers: ""
            llvm: 0
            cflags: "-Og"
            relabel: yes

    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
    - uses: systemd/mkosi@4eba736412c702bbbe2c6d4a58a92fa977219249

    # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
    # immediately, we remove the files in the background. However, we first move them to a different location
    # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
    - name: Free disk space
      run: |
        sudo mv /usr/local /usr/local.trash
        sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
        sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash

    - name: Btrfs
      run: |
        truncate --size=100G btrfs.raw
        mkfs.btrfs btrfs.raw
        sudo mkdir /mnt/mkosi
        LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
        sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
        sudo chown "$(id -u):$(id -g)" /mnt/mkosi
        mkdir /mnt/mkosi/tmp
        echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
        ln -s /mnt/mkosi/build build

    - name: Configure
      run: |
        # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
        sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build
        tee mkosi.local.conf <<EOF
        [Distribution]
        Distribution=${{ matrix.distro }}
        Release=${{ matrix.release }}

        [Output]
        # Build a disk image in CI as this logic is much more prone to breakage.
        Format=disk
        UseSubvolumes=yes

        WorkspaceDirectory=$TMPDIR
        PackageCacheDirectory=$TMPDIR/cache

        [Content]
        Environment=
                # Build debuginfo packages since we'll be publishing the packages as artifacts.
                WITH_DEBUG=1
                CFLAGS="${{ matrix.cflags }}"
                SANITIZERS=${{ matrix.sanitizers }}
                MESON_OPTIONS=--werror
                LLVM=${{ matrix.llvm }}
                SYSEXT=1

        SELinuxRelabel=${{ matrix.relabel }}

        [Host]
        QemuMem=4G
        EOF

    - name: Generate secure boot key
      run: mkosi --debug genkey

    - name: Show image summary
      run: mkosi summary

    - name: Install dependencies
      run: |
        mkosi dependencies |
        xargs -d '\n' sudo apt-get install \
            gperf \
            libblkid-dev \
            libcap-dev \
            libcryptsetup-dev \
            libcurl4-openssl-dev \
            libfdisk-dev \
            libmicrohttpd-dev \
            libmount-dev \
            libtss2-dev \
            meson

    - name: Configure meson
      run: |
        meson setup build \
            --buildtype=debugoptimized \
            -Dintegration-tests=true \
            -Dremote=enabled \
            -Dopenssl=enabled \
            -Dblkid=enabled \
            -Dtpm2=enabled \
            -Dlibcryptsetup=enabled \
            -Dlibcurl=enabled \
            -Drepart=enabled \
            -Dfirstboot=true \
            -Dsysusers=true \
            -Dtmpfiles=true \
            -Dhwdb=true \
            -Dvmspawn=enabled

    - name: Build image
      run: sudo meson compile -C build mkosi

    - name: Run integration tests
      run: sudo --preserve-env meson test -C build --no-rebuild --suite integration-tests --print-errorlogs --no-stdsplit --num-processes "$(($(nproc) - 1))"

    - name: Archive failed test journals
      uses: actions/upload-artifact@v4
      if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
      with:
        name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-failed-test-journals
        path: |
          build/test/journal/*.journal
          build/meson-logs/*
        retention-days: 7

    - name: Archive packages
      uses: actions/upload-artifact@v4
      if: (success() || failure()) && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
      with:
        name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-packages
        path: |
          build/mkosi.output/*.rpm
          build/mkosi.output/*.deb
          build/mkosi.output/*.ddeb
          build/mkosi.output/*.pkg.tar
        retention-days: 4