From 844445a198c5eb33c6e86a2951ea8e0a6be7536b Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Wed, 19 Aug 2026 17:58:59 +0000 Subject: [PATCH 1/3] bootc-ubuntu-setup: Add support for ubuntu-26.04 runners Ubuntu 26.04 ships a sufficiently modern podman (with heredoc support and no manifest handling bugs), so unlike 24.04 we can skip the plucky PPA and package upgrade path entirely. This simplifies the setup on 26.04 to just installing `just`. The version gate is refactored from a hard `test` assertion into a `case` statement that dispatches per-version setup logic and rejects unsupported runners with a clear error. CI test jobs are added for ubuntu-26.04 in both PR and published-action workflows. The PR test includes a heredoc Containerfile build to verify the native podman meets the minimum capability bar per the acceptance criteria. Closes: https://github.com/bootc-dev/actions/issues/49 Assisted-by: Claude Code (Claude Opus 4) Signed-off-by: Colin Walters --- .github/workflows/test-actions-pr.yml | 31 +++++++ .github/workflows/test-actions-published.yml | 13 +++ bootc-ubuntu-setup/action.yml | 94 +++++++++++--------- 3 files changed, 98 insertions(+), 40 deletions(-) diff --git a/.github/workflows/test-actions-pr.yml b/.github/workflows/test-actions-pr.yml index e05ce2d..a3f7188 100644 --- a/.github/workflows/test-actions-pr.yml +++ b/.github/workflows/test-actions-pr.yml @@ -24,6 +24,37 @@ jobs: just --version test -n "$ARCH" + test-bootc-ubuntu-setup-2604: + name: Test bootc-ubuntu-setup (26.04) + runs-on: ubuntu-26.04 + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Run bootc-ubuntu-setup + uses: ./bootc-ubuntu-setup + + - name: Verify setup + run: | + podman --version + just --version + test -n "$ARCH" + + - name: Verify podman heredoc support + shell: bash + run: | + set -euo pipefail + dir=$(mktemp -d) + cat > "${dir}/Containerfile" <<'CEOF' + FROM docker.io/library/alpine:latest + RUN < /heredoc-test.txt + EOF + CEOF + podman build -t localhost/heredoc-test:latest -f "${dir}/Containerfile" "${dir}" + result="$(podman run --rm localhost/heredoc-test:latest cat /heredoc-test.txt)" + test "${result}" = "heredoc works" + test-setup-rust: name: Test setup-rust runs-on: ubuntu-latest diff --git a/.github/workflows/test-actions-published.yml b/.github/workflows/test-actions-published.yml index a5e5705..a83569e 100644 --- a/.github/workflows/test-actions-published.yml +++ b/.github/workflows/test-actions-published.yml @@ -21,6 +21,19 @@ jobs: just --version test -n "$ARCH" + test-bootc-ubuntu-setup-2604: + name: Test bootc-ubuntu-setup@main (26.04) + runs-on: ubuntu-26.04 + steps: + - name: Run bootc-ubuntu-setup + uses: bootc-dev/actions/bootc-ubuntu-setup@main + + - name: Verify setup + run: | + podman --version + just --version + test -n "$ARCH" + test-setup-rust: name: Test setup-rust@main runs-on: ubuntu-latest diff --git a/bootc-ubuntu-setup/action.yml b/bootc-ubuntu-setup/action.yml index ef1d72e..7c0c4d2 100644 --- a/bootc-ubuntu-setup/action.yml +++ b/bootc-ubuntu-setup/action.yml @@ -39,50 +39,64 @@ runs: fi done # We really want support for heredocs - - name: Update podman and install just + - name: Install required packages shell: bash run: | set -eux - # Require the runner is ubuntu-24.04 IDV=$(. /usr/lib/os-release && echo ${ID}-${VERSION_ID}) - test "${IDV}" = "ubuntu-24.04" - # plucky is the next release. Historically we pointed straight at - # azure.archive.ubuntu.com, but that single Azure-regional mirror suffers - # chronic connection timeouts on GitHub Actions runners. This is a - # widespread, long-standing issue, not specific to us: - # https://github.com/actions/runner-images/issues/7048 - # https://github.com/actions/runner-images/issues/12949 - # https://github.com/orgs/community/discussions/205332 - # A plain http(s) URL is a single endpoint as far as apt is concerned: if - # it's unreachable, apt just retries the *same* host rather than trying an - # alternative (only the mirror:/mirror+file: URI scheme gives apt genuine - # client-side fallback across multiple mirrors, per sources.list(5)). So - # reuse the mirrorlist-with-fallback that Ubuntu's own cloud-init already - # sets up for the base OS sources on these runners (Azure mirror first, - # falling back to the global archive), instead of hardcoding one host with - # no fallback at all. Fall back to the plain global archive if that - # mirrorlist isn't present, e.g. on a non-standard runner. - # Non-amd64 architectures (e.g. arm64) use ports.ubuntu.com/ubuntu-ports, - # which isn't affected by this since it has no azure-specific variant. - if [ "$(dpkg --print-architecture)" = "amd64" ]; then - if [ -f /etc/apt/apt-mirrors.txt ]; then - mirror="mirror+file:/etc/apt/apt-mirrors.txt" - else - mirror="http://archive.ubuntu.com/ubuntu" - fi - else - mirror="http://ports.ubuntu.com/ubuntu-ports" - fi - echo "deb ${mirror} plucky universe main" | sudo tee /etc/apt/sources.list.d/plucky.list - # Raise apt retries slightly above the compiled-in default of 3 to tolerate - # transient network blips (covers ~2-3 min of cumulative retry delay with - # apt's exponential backoff, capped at 30s/attempt). This used to be set to - # 35 (~15 min) specifically to ride out azure.archive.ubuntu.com outages; - # now that we no longer use that mirror, a much smaller value suffices. - echo 'Acquire::Retries "5";' | sudo tee /etc/apt/apt.conf.d/80-retries - /bin/time -f '%E %C' sudo apt update - # skopeo is currently older in plucky for some reason hence --allow-downgrades - /bin/time -f '%E %C' sudo apt install -y --allow-downgrades crun/plucky buildah/plucky podman/plucky skopeo/plucky just + case "${IDV}" in + ubuntu-24.04) + # 24.04's podman is too old (no heredoc support, manifest bugs); + # pull newer packages from plucky (25.04). + # plucky is the next release. Historically we pointed straight at + # azure.archive.ubuntu.com, but that single Azure-regional mirror suffers + # chronic connection timeouts on GitHub Actions runners. This is a + # widespread, long-standing issue, not specific to us: + # https://github.com/actions/runner-images/issues/7048 + # https://github.com/actions/runner-images/issues/12949 + # https://github.com/orgs/community/discussions/205332 + # A plain http(s) URL is a single endpoint as far as apt is concerned: if + # it's unreachable, apt just retries the *same* host rather than trying an + # alternative (only the mirror:/mirror+file: URI scheme gives apt genuine + # client-side fallback across multiple mirrors, per sources.list(5)). So + # reuse the mirrorlist-with-fallback that Ubuntu's own cloud-init already + # sets up for the base OS sources on these runners (Azure mirror first, + # falling back to the global archive), instead of hardcoding one host with + # no fallback at all. Fall back to the plain global archive if that + # mirrorlist isn't present, e.g. on a non-standard runner. + # Non-amd64 architectures (e.g. arm64) use ports.ubuntu.com/ubuntu-ports, + # which isn't affected by this since it has no azure-specific variant. + if [ "$(dpkg --print-architecture)" = "amd64" ]; then + if [ -f /etc/apt/apt-mirrors.txt ]; then + mirror="mirror+file:/etc/apt/apt-mirrors.txt" + else + mirror="http://archive.ubuntu.com/ubuntu" + fi + else + mirror="http://ports.ubuntu.com/ubuntu-ports" + fi + echo "deb ${mirror} plucky universe main" | sudo tee /etc/apt/sources.list.d/plucky.list + # Raise apt retries slightly above the compiled-in default of 3 to tolerate + # transient network blips (covers ~2-3 min of cumulative retry delay with + # apt's exponential backoff, capped at 30s/attempt). This used to be set to + # 35 (~15 min) specifically to ride out azure.archive.ubuntu.com outages; + # now that we no longer use that mirror, a much smaller value suffices. + echo 'Acquire::Retries "5";' | sudo tee /etc/apt/apt.conf.d/80-retries + /bin/time -f '%E %C' sudo apt update + # skopeo is currently older in plucky for some reason hence --allow-downgrades + /bin/time -f '%E %C' sudo apt install -y --allow-downgrades crun/plucky buildah/plucky podman/plucky skopeo/plucky just + ;; + ubuntu-26.04) + # 26.04 ships a sufficiently modern podman with heredoc support; + # no PPA or package upgrades needed — just install extras. + /bin/time -f '%E %C' sudo apt update + /bin/time -f '%E %C' sudo apt install -y just + ;; + *) + echo "Unsupported runner: ${IDV}" >&2 + exit 1 + ;; + esac # This is the default on e.g. Fedora derivatives, but not Debian. # Only needed when libvirt/virtualization is requested. - name: Enable unprivileged /dev/kvm access From 52c2071fbba536ffac7f4d3afa6d5ae08e8486ea Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Wed, 19 Aug 2026 15:18:54 -0400 Subject: [PATCH 2/3] ci: Add shared verify-basic-requirements composite action The ubuntu-24.04 and ubuntu-26.04 bootc-ubuntu-setup test jobs in test-actions-pr.yml and test-actions-published.yml each check the same basic host functionality after setup runs: podman actually runs a container, and the runner's preinstalled (not the pinned setup-rust) Rust and Go toolchains still work. This duplicates the same checks across two jobs and two workflow files. Factor these into a composite action under .github/actions/ rather than the repo's top-level action directories, since this is an internal test helper rather than a published, supported action like bootc-ubuntu-setup or setup-rust. This commit only adds the action; it is not yet wired into any workflow. Assisted-by: AI --- .../verify-basic-requirements/action.yml | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/actions/verify-basic-requirements/action.yml diff --git a/.github/actions/verify-basic-requirements/action.yml b/.github/actions/verify-basic-requirements/action.yml new file mode 100644 index 0000000..dbc957f --- /dev/null +++ b/.github/actions/verify-basic-requirements/action.yml @@ -0,0 +1,25 @@ +name: 'Verify basic requirements' +description: 'Internal test helper: verify podman and the runner default Rust/Go toolchains still work' +runs: + using: 'composite' + steps: + - name: Verify podman works + shell: bash + run: | + set -euo pipefail + podman --version + result="$(podman run --rm docker.io/library/alpine:latest echo podman-ok)" + test "${result}" = "podman-ok" + + - name: Verify default Rust toolchain works + shell: bash + run: | + set -euo pipefail + rustc --version + cargo --version + + - name: Verify default Go toolchain works + shell: bash + run: | + set -euo pipefail + go version From 783b8d493b34fe6f4aba44f5d5ae51edadec6d9a Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Wed, 19 Aug 2026 15:19:30 -0400 Subject: [PATCH 3/3] ci: Use shared verify-basic-requirements action in setup test jobs Both bootc-ubuntu-setup test jobs (ubuntu-24.04 and ubuntu-26.04) in test-actions-pr.yml, plus their equivalents in test-actions-published.yml, duplicated the same podman/Rust/Go sanity checks inline. Replace that duplication with the composite action added in the prior commit. The local-checkout workflow references the action by relative path (./.github/actions/verify-basic-requirements), while the published workflow references it remotely the same way it already does for bootc-ubuntu-setup and setup-rust (bootc-dev/actions/.github/actions/verify-basic-requirements@main), since GitHub Actions supports uses: for any subdirectory of a repo. The remaining 'Verify setup' step keeps just --version and test -n "$ARCH", which are outputs specific to bootc-ubuntu-setup rather than generic host checks, dropping only the now-redundant podman --version line. Assisted-by: AI --- .github/workflows/test-actions-pr.yml | 8 ++++++-- .github/workflows/test-actions-published.yml | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test-actions-pr.yml b/.github/workflows/test-actions-pr.yml index a3f7188..a76b442 100644 --- a/.github/workflows/test-actions-pr.yml +++ b/.github/workflows/test-actions-pr.yml @@ -20,10 +20,12 @@ jobs: - name: Verify setup run: | - podman --version just --version test -n "$ARCH" + - name: Verify basic requirements + uses: ./.github/actions/verify-basic-requirements + test-bootc-ubuntu-setup-2604: name: Test bootc-ubuntu-setup (26.04) runs-on: ubuntu-26.04 @@ -36,10 +38,12 @@ jobs: - name: Verify setup run: | - podman --version just --version test -n "$ARCH" + - name: Verify basic requirements + uses: ./.github/actions/verify-basic-requirements + - name: Verify podman heredoc support shell: bash run: | diff --git a/.github/workflows/test-actions-published.yml b/.github/workflows/test-actions-published.yml index a83569e..517e83b 100644 --- a/.github/workflows/test-actions-published.yml +++ b/.github/workflows/test-actions-published.yml @@ -17,10 +17,12 @@ jobs: - name: Verify setup run: | - podman --version just --version test -n "$ARCH" + - name: Verify basic requirements + uses: bootc-dev/actions/.github/actions/verify-basic-requirements@main + test-bootc-ubuntu-setup-2604: name: Test bootc-ubuntu-setup@main (26.04) runs-on: ubuntu-26.04 @@ -30,10 +32,12 @@ jobs: - name: Verify setup run: | - podman --version just --version test -n "$ARCH" + - name: Verify basic requirements + uses: bootc-dev/actions/.github/actions/verify-basic-requirements@main + test-setup-rust: name: Test setup-rust@main runs-on: ubuntu-latest