wip

.github/workflows/integration.yml

@@ -58,8 +58,8 @@ jobs:
       repo_url: ${{ fromJson(steps.pr-api.outputs.data).head.repo.html_url }}
 
   integration:
-    # needs: pr-info
-    # if: ${{ needs.pr-info.outputs.allowed_user == 'true' && !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
+    needs: pr-info
+    if: ${{ needs.pr-info.outputs.allowed_user == 'true' && !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
     continue-on-error: true
     strategy:
       matrix:

tests/integration/image-install-upgrade.sh

@@ -82,7 +82,7 @@ esac
 
 sed "s/REPLACE_ME/${QUAY_SECRET}/g" files/auth.template | tee auth.json > /dev/null
 greenprint "Create $TEST_OS installation Containerfile"
-tee "$INSTALL_CONTAINERFILE" > /dev/null << EOF
+tee "$INSTALL_CONTAINERFILE" > /dev/null << REALEOF
 FROM "$TIER1_IMAGE_URL"
 $ADD_REPO
 COPY build/bootc-2*.${ARCH}.rpm .
@@ -91,7 +91,10 @@ RUN dnf -y update ./bootc-2*.${ARCH}.rpm && \
 RUN dnf -y install python3 cloud-init && \
     dnf -y clean all
 COPY auth.json /etc/ostree/auth.json
+RUN cat <<EOF >> /usr/lib/bootc/install/00-nosmt.toml
+kargs = ["mitigations=on"]
 EOF
+REALEOF
 
 greenprint "Check $TEST_OS installation Containerfile"
 cat "$INSTALL_CONTAINERFILE"
@@ -154,7 +157,7 @@ case "$IMAGE_TYPE" in
             -v /dev:/dev \
             -v .:/output \
             "$TEST_IMAGE_URL" \
-            bootc install to-disk --filesystem "$ROOTFS" --generic-image --via-loopback /output/disk.raw
+            bootc install to-disk --filesystem "$ROOTFS" --generic-image --via-loopback --karg=nosmt /output/disk.raw
 
         sudo qemu-img convert -f raw ./disk.raw -O qcow2 "/var/lib/libvirt/images/disk.qcow2"
         rm -f disk.raw
@@ -194,6 +197,7 @@ ansible-playbook -v \
     -e test_os="$TEST_OS" \
     -e bootc_image="$TEST_IMAGE_URL" \
     -e image_label_version_id="$REDHAT_VERSION_ID" \
+    -e kargs="mitigations=on,nosmt" \
     playbooks/check-system.yaml
 
 greenprint "Create upgrade Containerfile"

tests/integration/playbooks/check-system.yaml

@@ -4,6 +4,7 @@
   vars:
     bootc_image: ""
     upgrade: ""
+    kargs: ""
     total_counter: "0"
     failed_counter: "0"
 
@@ -452,6 +453,32 @@
       when: ansible_facts['distribution_version'] != "41"
       # workaround for issue https://gitlab.com/fedora/bootc/base-images/-/issues/10
 
+    # case: check karg
+    - name: grep for kargs
+      when: kargs != ''
+      shell: cat /proc/cmdline | grep $item
+      with_items: "{{ kargs.split(',') }}"
+      register: kargs_check
+      # grep will exit with 1 when no results found.
+      # This causes the task not to halt play.
+      ignore_errors: true
+
+    - name: check if kargs exist
+      block:
+        - assert:
+            that:
+              - kargs_check is succeeded
+            fail_msg: install kargs not found
+            success_msg: install kargs found
+      always:
+        - set_fact:
+            total_counter: "{{ total_counter | int + 1 }}"
+      rescue:
+        - name: failed count + 1
+          set_fact:
+            failed_counter: "{{ failed_counter | int + 1 }}"
+      when: karg != ''
+
     # case: check reboot times
     - name: check reboot times
       command: last reboot