ci.yml

# CI Workflow for bootc
#
# Core principles:
# - Everything done here should be easy to replicate locally. Most tasks
#   should invoke `just <something>`. Read the Justfile for more explanation
#   of this.
# - Most additions to this should be extending existing tasks; e.g.
#   there's places for unit and integration tests already.
name: CI

permissions:
  actions: read
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, labeled]
  merge_group:
  workflow_dispatch: {}

env:
  CARGO_TERM_COLOR: always
  # Disable incremental compilation in CI; it wastes disk in the container
  # build cache (--mount=type=cache,target=/src/target) and doesn't help
  # one-shot builds. Wired into container builds via Justfile --build-arg.
  CARGO_INCREMENTAL: "0"
  # Something seems to be setting this in the default GHA runners, which breaks bcvk
  # as the default runner user doesn't have access
  LIBVIRT_DEFAULT_URI: "qemu:///session"
  DEV_IMAGE: ghcr.io/bootc-dev/dev-bootc
  # Retry parameters for `just build-fetch` (transient Koji/Copr/quay.io failures)
  BOOTC_CI_RETRIES: "10"
  BOOTC_CI_DELAY: "60"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # Determine the OS matrix for CI jobs based on context:
  #   - merge_group / workflow_dispatch / ci/merge label: all OSes
  #   - ci/tier-1 label: centos-10 only (fast feedback on the primary target)
  #   - PR with no merge queue configured: all OSes (the PR is the only gate,
  #     so it must run the full suite; see the merge-queue check below)
  #   - plain PR (merge queue active): no heavy jobs
  #   - push to main: no heavy jobs (already verified pre-merge; a push here
  #     is a record of what merged, not something new to gate)
  compute-ci-level:
    # Cheap metadata check (gh api + jq) — no need for a full VM.
    runs-on: ubuntu-slim
    outputs:
      package_os_matrix: ${{ steps.matrix.outputs.package_os_matrix }}
      integration_os_matrix: ${{ steps.matrix.outputs.integration_os_matrix }}
      upgrade_os_matrix: ${{ steps.matrix.outputs.upgrade_os_matrix }}
      run_heavy: ${{ steps.matrix.outputs.run_heavy }}
      merge_queue_enabled: ${{ steps.merge-queue.outputs.enabled }}
      docs_only: ${{ steps.docs-check.outputs.docs_only }}
    steps:
      - uses: actions/checkout@v7
        if: github.event_name == 'pull_request'
        with:
          sparse-checkout: .
          fetch-depth: 1
      - name: Detect docs-only PR
        id: docs-check
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          FILES=$(gh pr diff "${{ github.event.pull_request.number }}" --name-only)
          if [[ -z "$FILES" ]]; then
            echo "docs_only=false" >> "$GITHUB_OUTPUT"
          elif grep -qvE '\.md$' <<< "$FILES"; then
            echo "docs_only=false" >> "$GITHUB_OUTPUT"
          else
            echo "docs_only=true" >> "$GITHUB_OUTPUT"
          fi

      # Detect at runtime whether `main` is currently protected by a GitHub
      # merge queue (see https://github.com/bootc-dev/bootc/issues/2177).
      # The tiered CI below only makes sense with a queue: it lets heavy jobs
      # run for feedback on PRs without gating merges, because the queue
      # re-verifies everything before landing. Without a queue, a PR is the
      # *only* gate, so the heavy suite must be required directly on PRs
      # again. Checking this dynamically means re-enabling the queue later
      # doesn't require another manual flip of this workflow to go back to
      # the tiered behavior.
      #
      # A branch's effective rules (aggregated across org- and repo-level
      # rulesets) are public, unauthenticated info; a `merge_queue` rule is
      # present only while a queue is actually configured for the branch.
      - name: Check for a merge_queue rule on main
        id: merge-queue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Let this fail outright if the API call fails, rather than
          # guessing: required-checks-heavy (below) needs this job, so we
          # never silently skip testing on a transient API hiccup.
          rules=$(gh api "repos/${{ github.repository }}/rules/branches/main")
          if echo "$rules" | jq -e 'any(.[]; .type == "merge_queue")' > /dev/null; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Compute OS matrices
        id: matrix
        run: |
          LABELS='${{ toJson(github.event.pull_request.labels.*.name) }}'
          EVENT='${{ github.event_name }}'
          MERGE_QUEUE_ENABLED='${{ steps.merge-queue.outputs.enabled }}'
          DOCS_ONLY='${{ steps.docs-check.outputs.docs_only }}'

          if [[ "$DOCS_ONLY" != "true" ]] && { [[ "$EVENT" == "merge_group" || "$EVENT" == "workflow_dispatch" ]] \
              || [[ "$EVENT" == "pull_request" && "$MERGE_QUEUE_ENABLED" != "true" ]] \
              || echo "$LABELS" | jq -e 'index("ci/merge")' > /dev/null; }; then
            # Full suite: all OSes
            echo 'package_os_matrix=["fedora-43","fedora-44","fedora-45","fedora-46","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'integration_os_matrix=["fedora-43","fedora-44","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'upgrade_os_matrix=["fedora-44","centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'run_heavy=true' >> "$GITHUB_OUTPUT"
          elif [[ "$DOCS_ONLY" != "true" ]] && echo "$LABELS" | jq -e 'index("ci/tier-1")' > /dev/null; then
            # Tier-1 only: centos-10
            echo 'package_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'integration_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'upgrade_os_matrix=["centos-10"]' >> "$GITHUB_OUTPUT"
            echo 'run_heavy=true' >> "$GITHUB_OUTPUT"
          else
            # Plain PR or docs-only: skip heavy jobs entirely
            echo 'package_os_matrix=[]' >> "$GITHUB_OUTPUT"
            echo 'integration_os_matrix=[]' >> "$GITHUB_OUTPUT"
            echo 'upgrade_os_matrix=[]' >> "$GITHUB_OUTPUT"
            echo 'run_heavy=false' >> "$GITHUB_OUTPUT"
          fi

  # Run basic validation checks (linting, formatting, etc)
  validate:
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
      - name: Validate (default)
        run: just validate
  # Check for security vulnerabilities and license compliance
  cargo-deny:
    runs-on: ubuntu-26.04
    steps:
    - uses: actions/checkout@v7
    - uses: EmbarkStudios/cargo-deny-action@v2
      with:
        log-level: warn
        command: check -A duplicate bans sources licenses
  # Test bootc installation scenarios and fsverity support
  # TODO convert to be an integration test: this would also
  # ensure we inherit the `package` job (and in theory
  # this could be a proper matrix)
  install-tests:
    name: "Test install"
    # Disabled: this job is hanging in the chunkah/podman step even after
    # switching to native overlay (see "test-install: Fix chunkah hang").
    # Re-enable once the underlying hang is root-caused.
    if: false && needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: compute-ci-level
    runs-on: ubuntu-26.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
      - name: Use native overlay instead of fuse-overlayfs
        run: |
          sudo sed -i 's|mount_program.*|mount_program = ""|' /etc/containers/storage.conf
      - name: Enable fsverity for /
        run: sudo tune2fs -O verity $(findmnt -vno SOURCE /)
      - name: Install utils
        run: sudo apt -y install fsverity just
      - name: Fetch external dependencies (with retry)
        run: just build-fetch

      - name: Integration tests
        run: |
          set -xeu
          # Build images as regular user, then copy to root's podman storage
          # This avoids cargo cache permission issues when running cargo as root
          just build
          just build-install-test-image
          just copy-to-rootful localhost/bootc
          just copy-to-rootful localhost/bootc-install
          # Copy bound images (LBI) to root's storage for tests that need them
          just copy-lbi-to-rootful

          # Build test binaries before any sudo commands to avoid cargo permission issues
          cargo build --release -p tests-integration

          sudo podman build -t localhost/bootc-fsverity -f ci/Containerfile.install-fsverity

          df -h /
          sudo install -m 0755 target/release/tests-integration /usr/bin/bootc-integration-tests
          sudo rm target -rf
          df -h /
          # The ostree-container tests
          sudo podman run --privileged --pid=host -v /:/run/host -v $(pwd):/src:ro -v /var/tmp:/var/tmp \
            --tmpfs /var/lib/containers \
            -v /run/systemd:/run/systemd localhost/bootc /src/crates/ostree-ext/ci/priv-integration.sh
          # Nondestructive but privileged tests
          sudo bootc-integration-tests host-privileged localhost/bootc-install
          # Install tests
          sudo bootc-integration-tests install-alongside localhost/bootc-install

          # inspect system state after the install tests.
          sudo lsblk
          sudo mount
          
          # system-reinstall-bootc tests
          cargo build --release -p system-reinstall-bootc

          # not sure why this is missing in the ubuntu image but just creating this directory allows the tests to pass
          sudo mkdir -p /run/sshd

          sudo install -m 0755 target/release/system-reinstall-bootc /usr/bin/system-reinstall-bootc
          # These tests may mutate the system live so we can't run in parallel
          sudo bootc-integration-tests system-reinstall localhost/bootc --test-threads=1

          # And the fsverity case
          sudo podman run --privileged --pid=host localhost/bootc-fsverity bootc install to-existing-root --stateroot=other \
            --acknowledge-destructive --skip-fetch-check
          # Crude cross check
          sudo find /ostree/repo/objects -name '*.file' -type f | while read f; do
            sudo fsverity measure $f >/dev/null
          done
  # Test that we can build documentation
  docs:
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
      - name: Build mdbook
        run: just build-mdbook
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  # Build packages for each test OS
  package:
    if: needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: compute-ci-level
    strategy:
      fail-fast: false
      matrix:
        test_os: ${{ fromJson(needs.compute-ci-level.outputs.package_os_matrix) }}

    runs-on: ubuntu-26.04
    # Rawhide is best-effort; don't let it block merges
    continue-on-error: ${{ matrix.test_os == 'fedora-46' }}

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main

      - name: Setup env
        run: |
          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV

      - name: Build packages (and verify build system)
        run: just check-buildsys

      - name: Upload package artifacts
        uses: actions/upload-artifact@v7
        with:
          name: packages-${{ matrix.test_os }}
          path: target/packages/*.rpm
          retention-days: 1

      # Unit tests don't depend on the variant/filesystem/bootloader/boot_type/seal_state
      # axes used by the test-integration matrix below, so we run them once per OS here
      # (reusing the BuildKit cache already warmed by `just check-buildsys` above) instead
      # of once per matrix leg.
      - name: Unit tests
        run: just unit-tests

  # Build bootc from source into a container image FROM each specified base `test_os`
  # running unit and integration tests (using TMT, leveraging the support for nested virtualization
  # in the GHA runners)
  test-integration:
    if: needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: [compute-ci-level, package]
    strategy:
      fail-fast: false
      matrix:
        test_os: ${{ fromJson(needs.compute-ci-level.outputs.integration_os_matrix) }}
        variant: [ostree, composefs]
        filesystem: ["ext4", "xfs"]
        bootloader: ["grub", "grub-cc", "systemd"]
        boot_type: ["bls", "uki"]
        seal_state: ["sealed", "unsealed"]

        exclude:
          - seal_state: "sealed"
            boot_type: bls
          - seal_state: "sealed"
            bootloader: grub
          - seal_state: "sealed"
            filesystem: xfs
          - seal_state: "unsealed"
            filesystem: ext4
            boot_type: uki # we still want to test ext4 unsealed bls
          - bootloader: grub
            boot_type: "uki"

          # We only test filesystems for composefs to test if composefs backend will work on fs
          # without fsverity
          - variant: ostree
            filesystem: ext4
          - variant: ostree
            boot_type: uki
          - variant: ostree
            bootloader: systemd

          # For now only have grub-cc tests in F44
          - test_os: fedora-45
            bootloader: grub-cc
          - test_os: fedora-43
            bootloader: grub-cc
          - test_os: centos-9
            bootloader: grub-cc
          - test_os: centos-10
            bootloader: grub-cc
          # Not in ostree
          - variant: ostree
            bootloader: grub-cc
          # Not yet "sealed"
          - bootloader: grub-cc
            seal_state: sealed

    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
        with:
          libvirt: true
      - name: Install tmt
        uses: ./.github/actions/install-tmt

      - name: Setup env
        run: |
          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
          echo "RUST_BACKTRACE=full" >> $GITHUB_ENV
          echo "RUST_LOG=debug" >> $GITHUB_ENV

          echo "BOOTC_variant=${{ matrix.variant }}" >> $GITHUB_ENV
          echo "BOOTC_filesystem=${{ matrix.filesystem }}" >> $GITHUB_ENV
          echo "BOOTC_bootloader=${{ matrix.bootloader }}" >> $GITHUB_ENV
          echo "BOOTC_boot_type=${{ matrix.boot_type }}" >> $GITHUB_ENV
          echo "BOOTC_seal_state=${{ matrix.seal_state }}" >> $GITHUB_ENV

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: packages-${{ matrix.test_os }}
          path: target/packages/

      - name: Fetch external dependencies (with retry)
        run: BOOTC_SKIP_PACKAGE=1 just build-fetch

      - name: Build container
        run: |
          BOOTC_SKIP_PACKAGE=1 just bootloader=$BOOTC_bootloader build

          # Extra cross-check (duplicating the integration test) that we're using the right base
          used_vid=$(podman run --rm localhost/bootc bash -c '. /usr/lib/os-release && echo ${ID}-${VERSION_ID}')
          test ${{ matrix.test_os }} = "${used_vid}"

      - name: Container integration tests
        run: BOOTC_SKIP_PACKAGE=1 just test-container-integration

      - name: Validate composefs digest (UKI only)
        if: matrix.boot_type == 'uki'
        run: just validate-composefs-digest

      - name: Reclaim disk space before TMT
        run: podman builder prune -af

      - name: Run TMT integration tests
        run: |
          if [[ "${{ matrix.variant }}" = composefs ]]; then
            just test-composefs "${{ matrix.bootloader }}"  "${{ matrix.filesystem }}" "${{ matrix.boot_type }}" "${{ matrix.seal_state }}"
          else
            just test-tmt integration
          fi

          just clean-local-images

      - name: Disk usage summary
        if: always()
        run: |
          echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          df -h >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

      - name: Archive TMT logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: "tmt-log-\
            ${{ matrix.test_os }}-\
            ${{ matrix.variant }}-\
            ${{ matrix.bootloader }}-\
            ${{ matrix.boot_type }}-\
            ${{ matrix.filesystem }}-\
            ${{ matrix.seal_state }}-\
            ${{ env.ARCH }}"
          path: /var/tmp/tmt

  # Test the upgrade path: boot from published base image, upgrade to locally-built image,
  # then run readonly tests to verify the upgrade worked.
  # Excluded: centos-9 (lacks systemd.extra-unit.* support needed for --bind-storage-ro)
  test-upgrade:
    if: needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: [compute-ci-level, package]
    strategy:
      fail-fast: false
      matrix:
        test_os: ${{ fromJson(needs.compute-ci-level.outputs.upgrade_os_matrix) }}
        variant: [ostree, composefs]
        # TODO: Re-enable this after 1.16.8 is released
        exclude:
          - test_os: fedora-44
            variant: composefs

    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
        with:
          libvirt: true
      - name: Install tmt
        uses: ./.github/actions/install-tmt

      - name: Setup env
        run: |
          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
          echo "BOOTC_variant=${{ matrix.variant }}" >> $GITHUB_ENV
          echo "BOOTC_SKIP_PACKAGE=1" >> $GITHUB_ENV
          echo "RUST_BACKTRACE=full" >> $GITHUB_ENV

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: packages-${{ matrix.test_os }}
          path: target/packages/

      - name: Fetch external dependencies (with retry)
        run: just build-fetch

      - name: Run upgrade test
        run: just test-upgrade

      - name: Disk usage summary
        if: always()
        run: |
          echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          df -h >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

      - name: Archive TMT logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: "tmt-log-${{ matrix.test_os }}-${{ matrix.variant }}-upgrade-${{ env.ARCH }}"
          path: /var/tmp/tmt

  # Test readonly behaviour with baseconfigs (transient mounts) baked into the image.
  # Composefs-only: setup-root-conf.toml is a composefs concept; ostree uses a
  # different config format (prepare-root.conf) and is not covered here.
  # Runs once per distro × baseconfig — no bootloader/filesystem/boot_type matrix.
  test-baseconfigs:
    if: needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: [compute-ci-level, package]
    strategy:
      fail-fast: false
      matrix:
        test_os: ${{ fromJson(needs.compute-ci-level.outputs.integration_os_matrix) }}
        baseconfigs: ["etc-transient", "root-transient", "var-volatile"]
        exclude:
          # centos-9 ships an older dracut that lacks the auto-install of setup-root-conf.toml
          - test_os: centos-9

    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
        with:
          libvirt: true
      - name: Install tmt
        uses: ./.github/actions/install-tmt

      - name: Setup env
        run: |
          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
          echo "BOOTC_variant=composefs" >> $GITHUB_ENV
          echo "BOOTC_baseconfigs=${{ matrix.baseconfigs }}" >> $GITHUB_ENV
          echo "RUST_BACKTRACE=full" >> $GITHUB_ENV

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: packages-${{ matrix.test_os }}
          path: target/packages/

      - name: Build container with baseconfig
        run: BOOTC_SKIP_PACKAGE=1 just build

      - name: Build upgrade image
        run: just _build-upgrade-image

      - name: Run TMT readonly tests
        run: |
          cargo xtask run-tmt \
            --env=BOOTC_variant=composefs \
            --env=BOOTC_baseconfigs=${{ matrix.baseconfigs }} \
            --composefs-backend --bootloader=grub --filesystem=ext4 \
            --seal-state=unsealed --boot-type=bls \
            --upgrade-image=localhost/bootc-upgrade \
            localhost/bootc readonly
          just clean-local-images

      - name: Disk usage summary
        if: always()
        run: |
          echo "### Disk usage" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          df -h >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

      - name: Archive TMT logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: "tmt-log-${{ matrix.test_os }}-composefs-baseconfigs-${{ matrix.baseconfigs }}-${{ env.ARCH }}"
          path: /var/tmp/tmt

  # Test bootc install on Fedora CoreOS (separate job to avoid disk space issues
  # when run in the same job as test-integration).
  # Uses fedora-43 as it's the current stable Fedora release matching CoreOS.
  test-coreos:
    # https://github.com/ostreedev/ostree/pull/3571 broke this because /boot
    # without a separate /boot partition isn't mounted in the initramfs anymore.
    # We need to change to use coreos-assembler.
    if: false
    needs: [compute-ci-level, package]
    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
        with:
          libvirt: true
      - name: Install tmt
        uses: ./.github/actions/install-tmt

      - name: Setup env
        run: |
          BASE=$(just pullspec-for-os base fedora-43)
          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
          echo "BOOTC_variant=ostree" >> $GITHUB_ENV

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: packages-fedora-43
          path: target/packages/

      - name: Build container and test on CoreOS
        run: |
          BOOTC_SKIP_PACKAGE=1 just build
          just build-testimage-coreos target/packages
          just test-tmt-on-coreos plan-bootc-install-on-coreos
          just clean-local-images

      - name: Archive TMT logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: tmt-log-fedora-43-coreos-${{ env.ARCH }}
          path: /var/tmp/tmt

  # Test the container export -> Anaconda liveimg install path.
  # Builds localhost/bootc, exports as tarball, installs via Anaconda in QEMU,
  # and verifies the resulting disk boots.
  test-container-export:
    if: needs.compute-ci-level.outputs.run_heavy == 'true'
    needs: [compute-ci-level, package]
    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
      - name: Bootc Ubuntu Setup
        uses: bootc-dev/actions/bootc-ubuntu-setup@main
        with:
          libvirt: true

      - name: Setup env
        run: |
          echo "BOOTC_base=quay.io/centos-bootc/centos-bootc:stream10" >> $GITHUB_ENV

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: packages-centos-10
          path: target/packages/

      - name: Build and run container export test
        run: |
          BOOTC_SKIP_PACKAGE=1 just test-container-export

      - name: Archive test logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: container-export-test-${{ env.ARCH }}
          path: target/anaconda-test/*.log

  # Gates the full heavy suite. Runs in merge_group / workflow_dispatch, and
  # also directly on PRs whenever compute-ci-level found no merge queue
  # active (see the merge-queue check in that job) — in that case a PR is
  # the only gate, so this must actually require the heavy jobs rather than
  # being skipped.
  # (Deliberately not extended to plain `push`: a push to main is a record of
  # what already merged, not something new to gate.)
  # Uses always() so it still reports a failure when an upstream heavy job failed,
  # rather than being skipped along with it.
  required-checks-heavy:
    if: ${{ always() && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && needs.compute-ci-level.outputs.merge_queue_enabled != 'true')) }}
    needs: [compute-ci-level, cargo-deny, validate, install-tests, docs, package, test-integration, test-upgrade, test-baseconfigs, test-container-export]
    # Cheap aggregation (jq only) — no need for a full VM.
    runs-on: ubuntu-slim
    steps:
      - name: Check all jobs
        env:
          NEEDS: ${{ toJson(needs) }}
        run: |
          FAILED=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result | IN("success","skipped") | not) | .key')
          if [ -n "$FAILED" ]; then
            echo "The following jobs did not succeed: $FAILED"
            exit 1
          fi

  # Sentinel job — configure this single name in repo required-status-checks settings.
  # With a merge queue active: gates only the light always-run jobs on PRs;
  # required-checks-heavy is skipped there (treated as success) so ci/merge
  # heavy jobs run for feedback but don't block merge-queue entry — those jobs
  # run again in the queue anyway with fresh artifacts. In merge_group,
  # required-checks-heavy has already verified the full suite above.
  # Without a merge queue: required-checks-heavy runs and gates directly on
  # PRs too, since there's no queue left to re-verify anything afterwards.
  required-checks:
    if: always()
    needs: [compute-ci-level, validate, cargo-deny, docs, required-checks-heavy]
    # Cheap aggregation (jq only) — no need for a full VM.
    runs-on: ubuntu-slim
    steps:
      - name: Check required jobs
        env:
          NEEDS: ${{ toJson(needs) }}
        run: |
          FAILED=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result | IN("success","skipped") | not) | .key')
          if [ -n "$FAILED" ]; then
            echo "The following jobs did not succeed: $FAILED"
            exit 1
          fi