e2e.yml

name: E2E Tests

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  e2e-fedora:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Install dependencies
        run: |
          # noble's buildah 1.33 does not support COPY <<heredoc inline-file
          # syntax; plucky has buildah 1.38+ and podman 5.x which do.
          # crun is also pulled from plucky because podman 5.x requires a
          # newer crun than noble provides.
          echo 'deb http://archive.ubuntu.com/ubuntu plucky main universe' \
            | sudo tee /etc/apt/sources.list.d/plucky.list
          sudo apt-get update -q
          sudo apt-get install -y -q \
            just qemu-system-x86 ovmf python3-pexpect python3-virt-firmware
          sudo apt-get install -y -q -t plucky podman buildah skopeo crun

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Build the base image from source (covers PRs that change Containerfile.fedora
      # or the Rust code compiled inside it). Layer cache keeps this fast after
      # the first run.
      - name: Build base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.fedora
          target: grub
          push: false
          load: true
          tags: composefs-os:fedora-44
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Transfer from Docker daemon to podman storage with an explicit name so
      # podman resolves localhost/composefs-os:fedora-44 from local storage.
      - name: Load base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:fedora-44 \
            containers-storage:localhost/composefs-os:fedora-44

      - name: Build test image
        run: sudo just build-example localhost/composefs-os:fedora-44

      - name: Install to disk image
        run: just install-disk composefs-os-test:latest disk.raw 5G

      - name: Run e2e tests
        run: just e2e disk.raw

      - name: Install to disk image (Secure Boot)
        run: just install-disk-secureboot composefs-os-test:latest disk-sb.raw 5G

      - name: Run e2e tests (Secure Boot)
        run: just e2e-secureboot disk-sb.raw

      - name: Build UKI base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.fedora
          target: uki
          push: false
          load: true
          tags: composefs-os:fedora-44-uki
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Load UKI base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:fedora-44-uki \
            containers-storage:localhost/composefs-os:fedora-44-uki

      - name: Build UKI test image
        run: sudo just build-example-uki localhost/composefs-os:fedora-44-uki

      - name: Install to disk image (UKI)
        run: just install-disk-uki composefs-os-uki-test:latest disk-uki.raw 5G

      - name: Run e2e tests (UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki disk-uki.raw "$OVMF_VARS"

      - name: Build UKI+SB base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.fedora
          target: uki-secureboot
          push: false
          load: true
          tags: composefs-os:fedora-44-uki-sb
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Load UKI+SB base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:fedora-44-uki-sb \
            containers-storage:localhost/composefs-os:fedora-44-uki-sb

      - name: Build UKI+SB test image
        run: sudo just build-example-uki-secureboot localhost/composefs-os:fedora-44-uki-sb

      - name: Install to disk image (UKI+SB)
        run: just install-disk-uki-secureboot composefs-os-uki-sb-test:latest disk-uki-sb.raw 5G

      - name: Run e2e tests (UKI+SB)
        run: just e2e-uki-secureboot disk-uki-sb.raw

      - name: Pull registry image for upgrade tests
        run: sudo podman pull docker.io/library/registry:2

      - name: Run upgrade/switch/rollback tests (GRUB)
        run: just e2e-upgrade composefs-os-test:latest disk.raw

      - name: Run upgrade/switch/rollback tests (GRUB + Secure Boot)
        run: just e2e-upgrade-secureboot composefs-os-test:latest disk-sb.raw

      - name: Run upgrade/switch/rollback tests (UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki-upgrade composefs-os-uki-test:latest disk-uki.raw "$OVMF_VARS"

      - name: Run upgrade/switch/rollback tests (UKI + Secure Boot)
        run: just e2e-uki-upgrade-secureboot composefs-os-uki-sb-test:latest disk-uki-sb.raw

      - name: Upload disk images on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: disk-raw
          path: |
            disk.raw
            disk-sb.raw
            disk-uki.raw
            disk-uki-sb.raw
          retention-days: 1

  e2e-arch:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Install dependencies
        run: |
          # noble's buildah 1.33 does not support COPY <<heredoc inline-file
          # syntax; plucky has buildah 1.38+ and podman 5.x which do.
          # crun is also pulled from plucky because podman 5.x requires a
          # newer crun than noble provides.
          echo 'deb http://archive.ubuntu.com/ubuntu plucky main universe' \
            | sudo tee /etc/apt/sources.list.d/plucky.list
          sudo apt-get update -q
          sudo apt-get install -y -q \
            just qemu-system-x86 ovmf python3-pexpect python3-virt-firmware
          sudo apt-get install -y -q -t plucky podman buildah skopeo crun

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Arch base image (GRUB)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.arch
          target: grub
          push: false
          load: true
          tags: composefs-os:arch-latest
          cache-from: type=gha,scope=arch
          cache-to: type=gha,mode=max,scope=arch

      - name: Load Arch base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:arch-latest \
            containers-storage:localhost/composefs-os:arch-latest

      - name: Build Arch test image
        run: sudo just build-example-arch localhost/composefs-os:arch-latest

      - name: Install to disk image (Arch GRUB)
        run: just install-disk composefs-os-arch-test:latest disk-arch.raw 5G

      - name: Run e2e tests (Arch GRUB)
        run: just e2e disk-arch.raw

      - name: Build Arch UKI base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.arch
          target: uki
          push: false
          load: true
          tags: composefs-os:arch-latest-uki
          cache-from: type=gha,scope=arch
          cache-to: type=gha,mode=max,scope=arch

      - name: Load Arch UKI base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:arch-latest-uki \
            containers-storage:localhost/composefs-os:arch-latest-uki

      - name: Build Arch UKI test image
        run: sudo just build-example-arch-uki localhost/composefs-os:arch-latest-uki

      - name: Install to disk image (Arch UKI)
        run: just install-disk-uki composefs-os-arch-uki-test:latest disk-arch-uki.raw 5G

      - name: Run e2e tests (Arch UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki disk-arch-uki.raw "$OVMF_VARS"

      - name: Build Arch UKI+SB base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.arch
          target: uki-secureboot
          push: false
          load: true
          tags: composefs-os:arch-latest-uki-sb
          cache-from: type=gha,scope=arch
          cache-to: type=gha,mode=max,scope=arch

      - name: Load Arch UKI+SB base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:arch-latest-uki-sb \
            containers-storage:localhost/composefs-os:arch-latest-uki-sb

      - name: Build Arch UKI+SB test image
        run: sudo just build-example-arch-uki-secureboot localhost/composefs-os:arch-latest-uki-sb

      - name: Install to disk image (Arch UKI+SB)
        run: just install-disk-uki-secureboot composefs-os-arch-uki-sb-test:latest disk-arch-uki-sb.raw 5G

      - name: Run e2e tests (Arch UKI+SB)
        run: just e2e-uki-secureboot disk-arch-uki-sb.raw

      - name: Pull registry image for upgrade tests
        run: sudo podman pull docker.io/library/registry:2

      - name: Run upgrade/switch/rollback tests (Arch GRUB)
        run: just e2e-upgrade-arch composefs-os-arch-test:latest disk-arch.raw

      - name: Run upgrade/switch/rollback tests (Arch UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki-upgrade-arch composefs-os-arch-uki-test:latest disk-arch-uki.raw "$OVMF_VARS"

      - name: Run upgrade/switch/rollback tests (Arch UKI + Secure Boot)
        run: just e2e-uki-upgrade-secureboot-arch composefs-os-arch-uki-sb-test:latest disk-arch-uki-sb.raw

      - name: Upload Arch disk images on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: disk-arch-raw
          path: |
            disk-arch.raw
            disk-arch-uki.raw
            disk-arch-uki-sb.raw
          retention-days: 1

  e2e-ubuntu:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Install dependencies
        run: |
          # noble's buildah 1.33 does not support COPY <<heredoc inline-file
          # syntax; plucky has buildah 1.38+ and podman 5.x which do.
          # crun is also pulled from plucky because podman 5.x requires a
          # newer crun than noble provides.
          echo 'deb http://archive.ubuntu.com/ubuntu plucky main universe' \
            | sudo tee /etc/apt/sources.list.d/plucky.list
          sudo apt-get update -q
          sudo apt-get install -y -q \
            just qemu-system-x86 ovmf python3-pexpect python3-virt-firmware
          sudo apt-get install -y -q -t plucky podman buildah skopeo crun

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Ubuntu base image (GRUB)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.ubuntu
          target: grub
          push: false
          load: true
          tags: composefs-os:ubuntu-26.04
          cache-from: type=gha,scope=ubuntu
          cache-to: type=gha,mode=max,scope=ubuntu

      - name: Load Ubuntu base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:ubuntu-26.04 \
            containers-storage:localhost/composefs-os:ubuntu-26.04

      - name: Build Ubuntu test image
        run: sudo just build-example-ubuntu localhost/composefs-os:ubuntu-26.04

      - name: Install to disk image (Ubuntu GRUB)
        run: just install-disk composefs-os-ubuntu-test:latest disk-ubuntu.raw 5G

      - name: Run e2e tests (Ubuntu GRUB)
        run: just e2e disk-ubuntu.raw

      - name: Install to disk image (Ubuntu GRUB + Secure Boot)
        run: just install-disk-secureboot composefs-os-ubuntu-test:latest disk-ubuntu-sb.raw 5G

      - name: Run e2e tests (Ubuntu GRUB + Secure Boot)
        run: just e2e-secureboot disk-ubuntu-sb.raw

      - name: Build Ubuntu UKI base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.ubuntu
          target: uki
          push: false
          load: true
          tags: composefs-os:ubuntu-26.04-uki
          cache-from: type=gha,scope=ubuntu
          cache-to: type=gha,mode=max,scope=ubuntu

      - name: Load Ubuntu UKI base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:ubuntu-26.04-uki \
            containers-storage:localhost/composefs-os:ubuntu-26.04-uki

      - name: Build Ubuntu UKI test image
        run: sudo just build-example-ubuntu-uki localhost/composefs-os:ubuntu-26.04-uki

      - name: Install to disk image (Ubuntu UKI)
        run: just install-disk-uki composefs-os-ubuntu-uki-test:latest disk-ubuntu-uki.raw 5G

      - name: Run e2e tests (Ubuntu UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki disk-ubuntu-uki.raw "$OVMF_VARS"

      - name: Build Ubuntu UKI+SB base image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile.ubuntu
          target: uki-secureboot
          push: false
          load: true
          tags: composefs-os:ubuntu-26.04-uki-sb
          cache-from: type=gha,scope=ubuntu
          cache-to: type=gha,mode=max,scope=ubuntu

      - name: Load Ubuntu UKI+SB base image into podman
        run: |
          sudo skopeo copy \
            docker-daemon:composefs-os:ubuntu-26.04-uki-sb \
            containers-storage:localhost/composefs-os:ubuntu-26.04-uki-sb

      - name: Build Ubuntu UKI+SB test image
        run: sudo just build-example-ubuntu-uki-secureboot localhost/composefs-os:ubuntu-26.04-uki-sb

      - name: Install to disk image (Ubuntu UKI+SB)
        run: just install-disk-uki-secureboot composefs-os-ubuntu-uki-sb-test:latest disk-ubuntu-uki-sb.raw 5G

      - name: Run e2e tests (Ubuntu UKI+SB)
        run: just e2e-uki-secureboot disk-ubuntu-uki-sb.raw

      - name: Pull registry image for upgrade tests
        run: sudo podman pull docker.io/library/registry:2

      - name: Run upgrade/switch/rollback tests (Ubuntu GRUB)
        run: just e2e-upgrade-ubuntu composefs-os-ubuntu-test:latest disk-ubuntu.raw

      - name: Run upgrade/switch/rollback tests (Ubuntu GRUB + Secure Boot)
        run: just e2e-upgrade-secureboot-ubuntu composefs-os-ubuntu-test:latest disk-ubuntu-sb.raw

      - name: Run upgrade/switch/rollback tests (Ubuntu UKI)
        run: |
          OVMF_VARS=$(find /usr/share -name 'OVMF_VARS.fd' ! -name '*.secboot*' ! -name '*.ms.*' | head -1)
          just e2e-uki-upgrade-ubuntu composefs-os-ubuntu-uki-test:latest disk-ubuntu-uki.raw "$OVMF_VARS"

      - name: Run upgrade/switch/rollback tests (Ubuntu UKI + Secure Boot)
        run: just e2e-uki-upgrade-secureboot-ubuntu composefs-os-ubuntu-uki-sb-test:latest disk-ubuntu-uki-sb.raw

      - name: Upload Ubuntu disk images on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: disk-ubuntu-raw
          path: |
            disk-ubuntu.raw
            disk-ubuntu-sb.raw
            disk-ubuntu-uki.raw
            disk-ubuntu-uki-sb.raw
          retention-days: 1