fix(ppg-packer): review fixes for identity, CRB map, and CI template coverage

- Key the identity gate on /etc/os-release ID + VERSION_ID major in
  validate.sh and the smoke template; release-file names cannot tell EL
  distros apart once more are added
- Collapse the per-distro CRB branches into one case mapping with a
  fail-closed default and a single anchored repolist grep
- Validate + fmt-check the reimage and bootstrap templates in the
  workflow check job; the PR trigger already fires on those paths

Author: nogueiraanderson

.github/workflows/ppg-ami-factory.yml

@@ -72,6 +72,8 @@ jobs:
           set -euo pipefail
           packer fmt -check -diff .
           packer fmt -check -diff smoke
+          packer fmt -check -diff reimage
+          packer fmt -check -diff bootstrap
           packer init .
           for os_name in oraclelinux rocky; do
             for major in 8 9 10; do
@@ -94,6 +96,9 @@ jobs:
             && packer validate \
               -var candidate_ami=ami-00000000000000000 \
               -var os=rocky -var os_major=8 -var arch=x86_64 . )
+          ( cd reimage && packer init . && packer validate -var arch=x86_64 . )
+          ( cd bootstrap && packer init . && packer validate \
+              -var raw_ami=ami-00000000000000000 -var arch=x86_64 . )
           # drift guard (mirrors `just check`): justfile root_gib must equal var.volume_size,
           # else a reimaged base would be the wrong root size for the refresh to launch.
           rg=$(awk -F'"' '/^root_gib[[:space:]]*:=/{print $2; exit}' justfile)

ppg/packer/README.md

@@ -109,7 +109,7 @@ ami_ol9_x86_64=$(aws ec2 describe-images --region eu-central-1 --owners self \
 `scripts/validate.sh` runs as the last provisioner; any failure aborts the build
 so a broken/mislabeled image is never registered:
 
-1. `/etc/oracle-release` / `/etc/rocky-release` major matches the target (fidelity).
+1. `/etc/os-release` `ID` + `VERSION_ID` major match the target (fidelity; release-file names cannot tell EL distros apart).
 2. `uname -m` matches the target arch.
 3. The CRB repo is defined: `ol<major>_codeready_builder` (OL), `powertools`
    (Rocky 8) or `crb` (Rocky 9/10). PG -devel deps resolve from it.

ppg/packer/scripts/validate.sh

@@ -19,36 +19,39 @@ fail() { echo "VALIDATE FAIL: $*" >&2; exit 1; }
 . /etc/os-release
 echo "VALIDATE: ${PRETTY_NAME:-?} $(uname -m) (want ${OS} ${OS_MAJOR} / ${UNAME_ARCH})"
 
-# 1. Genuine OS of the expected major (fidelity gate).
+# 1. Genuine OS of the expected major (fidelity gate). Keyed on /etc/os-release
+#    ID + VERSION_ID (sourced above): distro release-file names cannot tell EL
+#    distros apart once more are added (every clone ships /etc/redhat-release).
 case "${OS}" in
-  oraclelinux) release_file=/etc/oracle-release ;;
-  rocky)       release_file=/etc/rocky-release ;;
+  oraclelinux) expected_id=ol ;;
+  rocky)       expected_id=rocky ;;
   *)           fail "unknown OS '${OS}' (want oraclelinux|rocky)" ;;
 esac
-[[ -f "${release_file}" ]] || fail "no ${release_file} (not ${OS})"
-grep -Eq "release[[:space:]]+${OS_MAJOR}\." "${release_file}" \
-  || fail "release major != ${OS_MAJOR}: $(cat "${release_file}")"
+
+[[ "${ID:-}" = "${expected_id}" ]] || fail "os-release ID '${ID:-}' != '${expected_id}'"
+os_major_found="${VERSION_ID:-}"
+os_major_found="${os_major_found%%.*}"
+[[ "${os_major_found}" = "${OS_MAJOR}" ]] \
+  || fail "os-release major '${os_major_found}' != '${OS_MAJOR}' (VERSION_ID='${VERSION_ID:-}')"
 
 # 2. Architecture matches the target.
 [[ "$(uname -m)" = "${UNAME_ARCH}" ]] || fail "arch $(uname -m) != ${UNAME_ARCH}"
 
 # 3. The CRB repo must be DEFINED on the image (it is disabled by default; PG
-#    -devel deps need it). Oracle names it "ol<major>_codeready_builder", Rocky
-#    names it "powertools" (8) / "crb" (9/10). The AUTHORITATIVE resolvability
-#    check is the smoke test, which enables it and actually installs
-#    percona-postgresql17-server; a builder-side repoquery proved fragile
-#    (disabled-repo metadata not fetched), so this gate only asserts the repo
-#    exists.
-if [[ "${OS}" = oraclelinux ]]; then
-  crb="ol${OS_MAJOR}_codeready_builder"
-  dnf repolist --all 2>/dev/null | grep -qiE "codeready" \
-    || fail "CRB repo (${crb}) not defined on image"
-else
-  crb=crb
-  [[ "${OS_MAJOR}" = 8 ]] && crb=powertools
-  dnf repolist --all 2>/dev/null | grep -qiE "^${crb}([[:space:]]|$)" \
-    || fail "CRB repo (${crb}) not defined on image"
-fi
+#    -devel deps need it). One mapping per distro/major, one anchored grep. The
+#    AUTHORITATIVE resolvability check is the smoke test, which enables it and
+#    actually installs percona-postgresql17-server; a builder-side repoquery
+#    proved fragile (disabled-repo metadata not fetched), so this gate only
+#    asserts the repo exists.
+case "${OS}/${OS_MAJOR}" in
+  oraclelinux/*) crb="ol${OS_MAJOR}_codeready_builder" ;;
+  rocky/8)       crb="powertools" ;;
+  rocky/*)       crb="crb" ;;
+  *)             fail "no CRB mapping for ${OS}/${OS_MAJOR}" ;;
+esac
+
+dnf repolist --all 2>/dev/null | grep -qiE "^${crb}([[:space:]]|$)" \
+  || fail "CRB repo (${crb}) not defined on image"
 echo "  CRB ok: repo defined (${crb})"
 
 # 4. cloud-init present (instance bootstrap).

ppg/packer/smoke/smoke.pkr.hcl

@@ -51,7 +51,9 @@ variable "builder_security_group_name" {
 locals {
   instance_type = var.arch == "arm64" ? "t4g.large" : "t3.large"
   uname_arch    = var.arch == "arm64" ? "aarch64" : "x86_64"
-  release_file  = var.os == "rocky" ? "/etc/rocky-release" : "/etc/oracle-release"
+  # Identity via /etc/os-release ID (release-file names cannot tell EL distros
+  # apart once more are added: every clone ships /etc/redhat-release).
+  expected_id = var.os == "rocky" ? "rocky" : "ol"
   # Rocky images use "rocky" as the cloud-init default user; OL uses ec2-user.
   ssh_user = var.os == "rocky" ? "rocky" : "ec2-user"
   # CRB naming differs per distro: OL "ol<major>_codeready_builder", Rocky "powertools" (8) / "crb" (9/10).
@@ -94,7 +96,8 @@ build {
   provisioner "shell" {
     inline = [
       "set -euo pipefail",
-      "grep -Eq 'release[[:space:]]+${var.os_major}\\.' ${local.release_file} || { echo \"wrong ${var.os} major: $(cat ${local.release_file})\"; exit 1; }",
+      ". /etc/os-release; [ \"$$ID\" = '${local.expected_id}' ] || { echo \"wrong distro ID $$ID (want ${local.expected_id})\"; exit 1; }",
+      ". /etc/os-release; [ \"$${VERSION_ID%%.*}\" = '${var.os_major}' ] || { echo \"wrong major $$VERSION_ID (want ${var.os_major})\"; exit 1; }",
       "[ \"$(uname -m)\" = '${local.uname_arch}' ] || { echo \"wrong arch $(uname -m)\"; exit 1; }",
       "sudo cloud-init status --wait 2>/dev/null | grep -qE 'done|disabled' || { echo 'cloud-init not done'; exit 1; }",
       "rpm -q amazon-ssm-agent >/dev/null || { echo 'ssm-agent not baked'; exit 1; }",