ci: Add support for bootc end-to-end validation tests #790
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideThis PR adds end-to-end bootc validation test support by upgrading tox-lsr, injecting a Podman compatibility hack, extending the qemu-kvm CI workflow to prepare and validate qcow2 images, and updating user documentation and badges. Sequence Diagram: Bootc End-to-End Test ExecutionsequenceDiagram
participant CIWorkflow as CI Workflow
participant Buildah
participant QEMU_VM as QEMU VM
participant TestRole as Ansible Role
CIWorkflow->>Buildah: Start Image Preparation (using bootc)
activate Buildah
Buildah->>TestRole: Run role during image build
activate TestRole
TestRole-->>Buildah: Role execution complete
deactivate TestRole
Buildah-->>CIWorkflow: Output qcow2 image
deactivate Buildah
CIWorkflow->>QEMU_VM: Deploy qcow2 image and boot
activate QEMU_VM
QEMU_VM-->>CIWorkflow: VM Booted
CIWorkflow->>QEMU_VM: Start Validation
QEMU_VM->>TestRole: Validate configuration (skip setup/cleanup if __bootc_validation is true)
activate TestRole
TestRole-->>QEMU_VM: Validation complete
deactivate TestRole
QEMU_VM-->>CIWorkflow: Validation Result
deactivate QEMU_VM
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @richm - I've reviewed your changes - here's some feedback:
- Consider refactoring the repeated tox-lsr version bump across multiple workflows into a shared variable or template to reduce maintenance overhead.
- The APT "plucky" hack for upgrading Podman adds substantial complexity—please reference a tracking issue and mark it clearly for removal once Ubuntu 26.04 support lands.
- The new podman integration instructions in contributing.md are quite detailed—consider moving them to a separate file or dedicated section to keep the main guide focused.
Here's what I looked at during the review
- 🟡 General issues: 3 issues found
- 🟢 Security: all looks good
- 🟢 Review instructions: all looks good
- 🟢 Testing: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+90
to
+93
| 3. Change directory into the `tests` subdirectory. | ||
|
|
||
| ```bash | ||
| cd ~/network/tests |
There was a problem hiding this comment.
issue: Clarify path context for ~/network/tests
Specify that ~/network/tests is the tests directory within the cloned repository, and note that users should adjust the path if their clone location differs.
Comment on lines
+105
to
+113
| 5. Use `podman unshare` first to run "podman mount" in root mode, use `-vi` to | ||
| run ansible as inventory in verbose mode, use `-c podman` to use the podman | ||
| connection plugin. NOTE: Some of the tests do not work with podman - see | ||
| `.github/run_test.sh` for the list of tests that do not work. | ||
|
|
||
| ```bash | ||
| podman unshare | ||
| ansible-playbook -vi lsr-ci-c7, -c podman tests_provider_nm.yml | ||
| ``` |
There was a problem hiding this comment.
suggestion: Clarify the purpose of podman unshare
Clarify that podman unshare is required so Ansible, through the podman connector, can perform privileged operations such as mounting filesystems.
Suggested change
| 5. Use `podman unshare` first to run "podman mount" in root mode, use `-vi` to | |
| run ansible as inventory in verbose mode, use `-c podman` to use the podman | |
| connection plugin. NOTE: Some of the tests do not work with podman - see | |
| `.github/run_test.sh` for the list of tests that do not work. | |
| ```bash | |
| podman unshare | |
| ansible-playbook -vi lsr-ci-c7, -c podman tests_provider_nm.yml | |
| ``` | |
| 5. Use `podman unshare` first to ensure Ansible, when using the podman connection plugin, can perform privileged operations such as mounting filesystems inside the container. This is required because some operations (like "podman mount") need to be run in a user namespace with elevated privileges. Then, use `-vi` to run ansible as inventory in verbose mode, and `-c podman` to use the podman connection plugin. NOTE: Some of the tests do not work with podman - see | |
| `.github/run_test.sh` for the list of tests that do not work. | |
| ```bash | |
| podman unshare | |
| ansible-playbook -vi lsr-ci-c7, -c podman tests_provider_nm.yml | |
| ``` |
| ansible-playbook -vi lsr-ci-c7, -c podman tests_provider_nm.yml | ||
| ``` | ||
|
|
||
| 6. NOTE that this leaves the container running in the background, to kill it: |
There was a problem hiding this comment.
nitpick: Use more precise term than 'kill it'
Replace 'to kill it:' with 'to stop and remove it:' to better reflect the use of podman stop and podman rm.
NOTE: This also requires upgrading to tox-lsr 3.10.0, and some hacks to workaround a podman issue in ubuntu. These tests run the role during a bootc container image build, deploy the container into a QEMU VM, boot that, and validate the expected configuration there. They run in two different tox environments, and thus have to be run in two steps (preparation in buildah, validation in QEMU). The preparation is expected to output a qcow2 image in `tests/tmp/TESTNAME/qcow2/disk.qcow2`, i.e. the output structure of <https://github.com/osbuild/bootc-image-builder>. There are two possibilities: * Have separate bootc end-to-end tests. These are tagged with `tests::bootc-e2` and are skipped in the normal qemu-* scenarios. They run as part of the container-* ones. * Modify an existing test: These need to build a qcow2 image exactly *once* (via calling `bootc-buildah-qcow.sh`) and skip setup/cleanup and role invocations in validation mode, i.e. when `__bootc_validation` is true. In the container scenario, run the QEMU validation as a separate step in the workflow. See https://issues.redhat.com/browse/RHEL-88396 Signed-off-by: Rich Megginson <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
NOTE: This also requires upgrading to tox-lsr 3.10.0, and some
hacks to workaround a podman issue in ubuntu.
These tests run the role during a bootc container image build, deploy
the container into a QEMU VM, boot that, and validate the expected
configuration there. They run in two different tox environments, and
thus have to be run in two steps (preparation in buildah, validation in
QEMU). The preparation is expected to output a qcow2 image in
tests/tmp/TESTNAME/qcow2/disk.qcow2, i.e. the output structure ofhttps://github.com/osbuild/bootc-image-builder.
There are two possibilities:
Have separate bootc end-to-end tests. These are tagged with
tests::bootc-e2and are skipped in the normal qemu-* scenarios.They run as part of the container-* ones.
Modify an existing test: These need to build a qcow2 image exactly
once (via calling
bootc-buildah-qcow.sh) and skip setup/cleanupand role invocations in validation mode, i.e. when
__bootc_validationis true.In the container scenario, run the QEMU validation as a separate step in
the workflow.
See https://issues.redhat.com/browse/RHEL-88396