BifrOSt

Latest change 01eb41ed49f23bb7d99cbcef4fc39117ffd35bb1 - Harden release pipeline and rebase to 0.2.2 by Ólafur Búi Ólafsson

name: QEMU release-candidate qualification

on:
  workflow_dispatch:
    inputs:
      iso_path:
        description: Absolute path to the exact, already-built ISO on the self-hosted runner
        required: true
        type: string
      case:
        description: Installation case
        required: true
        default: all
        type: choice
        options:
          - all
          - standard
          - luks2
      work_dir:
        description: Optional new evidence directory (must not already exist)
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: qemu-release-candidate-${{ github.ref }}
  cancel-in-progress: false

jobs:
  qualify:
    # These labels deliberately exclude GitHub-hosted runners. The runner must be
    # Arch Linux with KVM access and qemu-desktop/edk2-ovmf already installed.
    runs-on: [self-hosted, Linux, X64, arch, kvm]
    # Timeout arithmetic (harness defaults: --install-timeout 10800s, --boot-timeout 900s, 2 cases):
    #   install phase per case: 30 (serial socket) + 30 (boot menu) + 1 + 120 (live login)
    #     + 60 (root shell) + 10800 (install) + 180 (shutdown) = 11,221 s
    #   cold-boot phase per case: 30 (serial socket) + 300 (LUKS prompt) + 120 (wrong-passphrase
    #     rejection) + 120 (retry prompt) + 900 (assertions) + 180 (shutdown) = 1,650 s
    #   both cases: 2 x (11,221 + 1,650) = 25,742 s; + ISO sha256/manifest setup ~300 s = 26,042 s (~434 min)
    #   --overall-deadline 26700 s (445 min) > 434 min, so a hung harness still writes a failed
    #     result.json + drained serial evidence itself instead of being killed by the runner.
    #   job cap: 445 min (deadline) + ~5 min expiry cleanup (VM teardown, result write)
    #     + ~20 min checkout/evidence-upload headroom = 470 min.
    timeout-minutes: 470
    env:
      INPUT_ISO: ${{ inputs.iso_path }}
      INPUT_CASE: ${{ inputs.case }}
      INPUT_WORK_DIR: ${{ inputs.work_dir }}
      DEFAULT_WORK_DIR: ${{ runner.temp }}/bifrost-qemu-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Qualify exact ISO in standard and LUKS2 virtual machines
        shell: bash
        run: |
          set -Eeuo pipefail
          work_dir=${INPUT_WORK_DIR:-$DEFAULT_WORK_DIR}
          printf 'Evidence directory: `%s`\n' "$work_dir" >> "$GITHUB_STEP_SUMMARY"
          python3 vm/qemu-release-candidate.py \
            --iso "$INPUT_ISO" \
            --case "$INPUT_CASE" \
            --overall-deadline 26700 \
            --work-dir "$work_dir"
      - name: Upload compact QEMU evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: qemu-release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ inputs.work_dir || env.DEFAULT_WORK_DIR }}/manifest.json
            ${{ inputs.work_dir || env.DEFAULT_WORK_DIR }}/result.json
            ${{ inputs.work_dir || env.DEFAULT_WORK_DIR }}/iso.sha256
            ${{ inputs.work_dir || env.DEFAULT_WORK_DIR }}/*/*.json
            ${{ inputs.work_dir || env.DEFAULT_WORK_DIR }}/*/*.log
          if-no-files-found: error
          retention-days: 30