ci: run installer smoke through shared QEMU workflow

.github/workflows/build.yml

@@ -118,6 +118,19 @@ jobs:
           just build-kernel
           just build-zfs
           just export-kernel
+
+      - name: Upload installer test artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: server-installer-test
+          path: |
+            dist/bluefin-server-installer-*.raw.zst
+            dist/bluefin-server-pxe-vmlinuz-*
+            dist/bluefin-server-pxe-initrd-*.cpio.gz
+            dist/sysext/k0s-*.raw.zst
+          if-no-files-found: error
+          retention-days: 1
+
       - name: Sign release SHA256SUMS manifest
         if: github.ref == 'refs/heads/main'
         env:
@@ -158,12 +171,22 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  installer-test:
+    needs: build
+    if: ${{ !failure() && !cancelled() }}
+    permissions:
+      actions: read
+      contents: read
+    uses: projectbluefin/actions/.github/workflows/server-installer-test.yml@7b1567226212b5304f4870c7cdbb7c4a0eefae71 # v1
+    with:
+      artifact-name: server-installer-test
+
   # Publishes the signed assets to the GitHub Release. Only runs on
   # pushes/dispatches to main, where the code is already reviewed, and is the
   # only job besides track-refs that holds contents: write.
   release:
     if: ${{ !failure() && !cancelled() && github.ref == 'refs/heads/main' }}
-    needs: build
+    needs: [build, installer-test]
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:

Justfile

@@ -214,9 +214,17 @@ flash-installer DEVICE="":
     sudo sh -c "zstd -dc ${IMG} | dd of={{DEVICE}} bs=4M iflag=fullblock oflag=direct status=progress conv=fsync"
     echo "Successfully flashed the Bluefin Server installer to {{DEVICE}}!"
 
-# Build, install, and reboot the server in QEMU using the raw installer disk.
+# Build the installer artifacts, then run the reusable artifact smoke path.
 [group('test')]
 show-me-the-future:
+    just build-installer
+    just export-installer
+    just export-sysext
+    just test-installer-artifact
+
+# Install and reboot already-exported server artifacts in QEMU.
+[group('test')]
+test-installer-artifact:
     #!/usr/bin/env bash
     set -euo pipefail
 
@@ -225,9 +233,6 @@ show-me-the-future:
     WORKDIR="$(mktemp -d "${CACHE_DIR}/bluefin-show-future.XXXXXX")"
     trap 'rm -rf "$WORKDIR"' EXIT
 
-    just build-installer
-    just export-installer
-
     cp dist/bluefin-server-installer-*.raw.zst "$WORKDIR/installer.raw.zst"
     cp dist/bluefin-server-pxe-vmlinuz-* "$WORKDIR/installer.vmlinuz"
     cp dist/bluefin-server-pxe-initrd-*.cpio.gz "$WORKDIR/installer.initrd"
@@ -297,14 +302,7 @@ show-me-the-future:
         -no-reboot < /dev/null
 
     echo "==> Preparing target /var refresh with offline k0s sysext and smoke secret..."
-    K0S_RAW_ZST=""
-    if [ -d dist/sysext ]; then
-      K0S_RAW_ZST=$(find dist/sysext/ -maxdepth 1 -type f -name 'k0s-*.raw.zst' 2>/dev/null | head -n 1 || true)
-    fi
-    if [ -z "$K0S_RAW_ZST" ]; then
-      just export-sysext
-      K0S_RAW_ZST=$(find dist/sysext/ -maxdepth 1 -type f -name 'k0s-*.raw.zst' | head -n 1)
-    fi
+    K0S_RAW_ZST=$(find dist/sysext/ -maxdepth 1 -type f -name 'k0s-*.raw.zst' -print -quit 2>/dev/null || true)
     [ -n "$K0S_RAW_ZST" ] || { echo "ERROR: k0s sysext not found in dist/sysext" >&2; exit 1; }
 
     VAR_STAGING="$WORKDIR/var-staging"

docs/skills/ci-tooling.md

@@ -96,6 +96,7 @@ sudo_cmd := if `podman info >/dev/null 2>&1 && echo 1 || echo 0` == "1" { "" } e
 |-----|----------|---------|---------|
 | `track-refs` | `build.yml` | `pull_request` (`renovate/*` only) | Resolves BuildStream junction refs and pushes them back to the PR branch. Sole `contents: write` grant on `pull_request`. |
 | `build` | `build.yml` | `pull_request`, `push/main`, `workflow_dispatch` | Resolves the element graph, runs the full BuildStream compile (including Flatcar LTS Kernel & ZFS), and signs the release manifest on pushes to `main`. Read-only token. |
+| `installer-test` | `build.yml` | `pull_request`, `push/main`, `workflow_dispatch` | Downloads the build job's exported installer/PXE/sysext artifact and calls the shared `projectbluefin/actions` QEMU workflow. No Lima or second BuildStream build. |
 | `release` | `build.yml` | `push/main`, `workflow_dispatch` | Downloads the signed assets handed off by `build` and publishes them to the GitHub Release (`if: ${{ !failure() && !cancelled() && github.ref == 'refs/heads/main' }}`). `contents: write`. |
 | `build-kernel` | `kernel.yml` | `pull_request` (paths: `elements/flatcar/**`, `include/flatcar.yml`, `patches/flatcar-kernel/**`), `push/main`, `workflow_dispatch` | Standalone kernel & OpenZFS sysext BuildStream build and export. Emits `dist/kernel/` artifacts. Read-only token. |
 | `docs` | `docs-checks.yml` | `pull_request`, `push/main` | Runs markdown and skill metadata checks via `docs-checks.py`. Read-only token. |
@@ -115,9 +116,10 @@ uploaded to a GitHub Release tagged `installer-v<FSDK-RELEASE>`.
    commits them back to the PR branch.
 3. **Full Compilation:** Builds the standalone DDI OS image, live installer, and
    k0s systemd-sysext on every pull request and push to `main`.
-4. **Version Derivation:** The release tag is derived with `just version`, which
+4. **Installer boot test:** Uploads the already-built installer, PXE, and k0s sysext artifacts and calls `projectbluefin/actions/.github/workflows/server-installer-test.yml`. The shared workflow prepares QEMU/KVM and runs this repository's `just test-installer-artifact`; Lima remains local-only.
+5. **Version Derivation:** The release tag is derived with `just version`, which
    parses the pinned FSDK point release from `elements/freedesktop-sdk.bst`.
-5. **Automated Publishing:** For pushes to `main` (including Renovate PR merges),
+6. **Automated Publishing:** For pushes to `main` (including Renovate PR merges),
    GitHub Actions creates a GitHub Release, uploads all compiled assets, and
    produces a combined `dist/release/SHA256SUMS` plus detached
    `SHA256SUMS.gpg` for `systemd-sysupdate` verification.

docs/skills/ddi-installer-build.md

@@ -30,6 +30,7 @@ just build-sysext          # build the k0s sysext
 just export-sysext         # export sysext artifacts to dist/sysext/
 just flash-installer       # write the installer image to a USB device
 just show-me-the-future    # end-to-end QEMU installer smoke test
+just test-installer-artifact # test already-exported artifacts in QEMU without rebuilding
 just tags                  # show FSDK-derived version tags
 ```