Without INFIX_RELEASE, make test resolves INFIX_ARTIFACT to the
unversioned infix-x86_64, but release builds produce versioned
artifacts (infix-x86_64-v26.04.0-rc1.qcow2 etc.), causing the
test environment to fail with "No such file or directory".
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add an x86_64 regression test job to release.yml that runs after the
build and gates publishing — the release job now requires both build
and test to succeed.
Update test.yml's artifact restore step to use a glob so it handles
both the unversioned CI artifact name (infix-x86_64.tar.gz) and the
versioned release artifact name (infix-x86_64-26.04.0.tar.gz).
Fixes#1392
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a regression from 0c11cea where local composite actions
(.github/actions/) were referenced with relative paths. When spins
reuse our reusable workflows, GitHub resolves relative action paths
in the context of the calling repo, not infix — breaking the build.
Replace all uses of ./.github/actions/{cache-restore,podman-cleanup}
with kernelkit/actions/{cache-restore,podman-cleanup}@v1 (new repo).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Allow a workflow caller to run pre-build scripts though a workflow
call variable. This is potentially dangerous as code can be injected
here. If for example a malicious actor wants to run there C2 code in
the context of someone else they could perhaps inject it here. I
assume this is protected by the same mecahism as the workflow files
themself. I.e. github users untrusted to the Infix org won't be able
to trigger workflows before being explicitly allowed to do so.
This patch also adds a checkout secret. This allows upstream callers
to fetch there own spin / fork though the infix workflows, if they
provide a checkout token with the correct permissions to do so.
Signed-off-by: Richard Alpe <richard@bit42.se>
It should be possible to create test reports manually, so logically
the GitHub workflow should call a make rule in test.mk
Untested: branding, or any case where Infix is used as a BR2_EXTERNAL
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There are 2 main reasons for this:
1) It's almost impossible to write complex logical expressions in GH
workflows. I wanted to pass "" as flavor when not building _minimal.
So that the end target string would become TARGET + FLAVOR where
FLAVOR is empty, making it x86_64 for example.
As it turns out "" is false in GH workflow logical expressions, this
in conjunction with the limitations the interpreter has made it hard
to actually write sane expressions in the "with:" variables when
calling downstream jobs via workflow calls.
Here's an example of what I was trying to do and could not:
with:
flavor: ${{ (
github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'ci:main')
) && '' || '_minimal' }}
As '' is false, the first sets of expressions always evaluates to
false making the string "_minimal". I tried bracing this in various
ways and to use "null" or various JSON objects, all in vain.
2) It reduces complexity instead of adding additional.
Signed-off-by: Richard Alpe <richard@bit42.se>
Redesign how GH actions are triggered. This new design uses a
self-trigger to start jobs which are only started via workflow_calls.
The main benefit of this is to be able to start workflows from various
Infix Spins without needing to duplicate the workflow files in them.
Upcoming patches are intended to parameterize to allow Spins to pass
different architectures, brand names and such.
Signed-off-by: Richard Alpe <richard@bit42.se>
Ejub Sabic