uki naming 1877

.github/actions/test/integration/build/action.yml

@@ -11,7 +11,7 @@ runs:
     - name: Set ENV
       shell: bash
       env:
-        REPO: ghcr.io/gardenlinux/gardenlinux-ccloud
+        REPO: ghcr.io/gardenlinux/gardenlinux-sci
         TAG: ${{ inputs.image_tag }}
         ESP_SIZE: 2  # GiB
         DISK_SIZE: 8  # GiB
@@ -99,12 +99,21 @@ runs:
         chmod 600 /opt/ssh_host_ed25519_key
         SSH_KEY=$(cat /opt/ssh_host_ed25519_key.pub)
         echo "SSH_KEY=$SSH_KEY" >> $GITHUB_ENV
-        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
+        cp ./.github/actions/test/integration/build/dev-user-butane.yaml ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        yq '.storage.files += load("./.github/actions/test/integration/build/root-hints.yaml")' ./.github/actions/test/integration/build/dev-user-butane.yaml > ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
+        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
         PASSWORD=$(openssl passwd "password")
         echo "PASSWORD=$PASSWORD" >> $GITHUB_ENV
-        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
-        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
-        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane.yaml > "/opt/${TAG}.ign"
+        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
+        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml > "/opt/${TAG}-hv1.ign"
+        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml > "/opt/${TAG}-hv2.ign"
 
     - name: Download ubuntu cloud image
       shell: bash
@@ -126,7 +135,7 @@ runs:
     # - name: Upload artifacts
     #   uses: actions/upload-artifact@v4
     #   with:
-    #     name: gardenlinux-ccloud-${{ inputs.image_tag }}
+    #     name: gardenlinux-sci-${{ inputs.image_tag }}
     #     path: /opt/${{ inputs.image_tag }}.*
     #     retention-days: 1
     #     overwrite: true

.github/actions/test/integration/build/dev-user-butane.yaml

@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.3.0
+version: 1.7.0
 passwd:
   users:
     - name: root
@@ -37,12 +37,6 @@ storage:
         # custom
         192.168.122.2 hv1
         192.168.122.3 hv2
-  - path: /opt/persist/root-hints.yaml
-    mode: 0644
-    contents:
-      inline: |
-        hints:
-          - size: lt 500G
   # turn off hugepages, not required for this test
   # also SIGNIFICANTLY reduces test runtime
   - path: /opt/persist/hugepages.env
@@ -55,7 +49,7 @@ storage:
     contents:
       inline: |
         # pull the image from GHCR instead of keppel
-        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-ccloud
+        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-sci
         # point to a custom tag to download for the persist step
         OCI_TAG=TAG_GOES_HERE
   # Enable unlimited core dumps for all systemd services
@@ -85,3 +79,10 @@ storage:
         kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h
         kernel.core_pipe_limit=16
         fs.suid_dumpable=2
+# Disable libvirt sockets not required for CI tests
+systemd:
+  units:
+    - name: libvirtd-tls.socket
+      mask: true
+    - name: libvirtd-tcp.socket
+      mask: true

.github/actions/test/integration/build/root-hints.yaml

@@ -0,0 +1,6 @@
+- path: /opt/persist/root-hints.yaml
+  mode: 0644
+  contents:
+    inline: |
+      hints:
+        - size: lt 500G

.github/actions/test/integration/dependencies/action.yml

@@ -34,7 +34,7 @@ runs:
     - name: butane
       shell: bash
       run: |
-        BUTANE_VERSION="0.24.0"
+        BUTANE_VERSION="0.27.0"
         curl -LO "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu"
         chmod +x "butane-x86_64-unknown-linux-gnu"
         sudo mv "butane-x86_64-unknown-linux-gnu" /usr/local/bin/butane

.github/actions/test/integration/setup/action.yml

@@ -15,7 +15,8 @@ runs:
     - name: Copy ignition file
       shell: bash
       run: |
-        sudo cp "/opt/${TAG}.ign" /var/lib/libvirt/images/hv.ign
+        sudo cp "/opt/${TAG}-hv1.ign" /var/lib/libvirt/images/HV1.ign
+        sudo cp "/opt/${TAG}-hv2.ign" /var/lib/libvirt/images/HV2.ign
 
     - name: Create HyperVisor 1
       shell: bash

.github/actions/test/integration/setup/hv.xml

@@ -15,7 +15,7 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/HV_NAME_GOES_HERE.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
         <interface type='network'>
             <mac address='MAC_GOES_HERE' />
@@ -32,6 +32,6 @@
     </devices>
     <qemu:commandline>
         <qemu:arg value='-fw_cfg' />
-        <qemu:arg value='name=opt/com.coreos/config,file=/var/lib/libvirt/images/hv.ign' />
+        <qemu:arg value='name=opt/com.coreos/config,file=/var/lib/libvirt/images/HV_NAME_GOES_HERE.ign' />
     </qemu:commandline>
 </domain>

.github/actions/test/integration/test/qemu/vm.xml

@@ -15,12 +15,12 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/ubuntu.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
-        <disk type='file' device='cdrom'>
+        <disk type='file' device='disk'>
             <driver name='qemu' type='raw' />
             <source file='/var/lib/libvirt/images/ubuntu-cloud-init-ds.iso' />
-            <target dev='hdb' bus='ide' />
+            <target dev='vdb' bus='virtio' />
             <readonly />
         </disk>
         <interface type='network'>

.github/scripts/compute-image-tag.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Computes the OCI image tag for Garden Linux ccloud images
+#
+# This script centralizes the image tag format computation to ensure consistency
+# across all workflows (nightly, dev, upload_oci).
+#
+# Usage:
+#   ./compute-image-tag.sh <version> [flavor]
+#
+# Arguments:
+#   version - The version for the tag (e.g., "1877.10.1", "pr-123")
+#   flavor  - The image flavor (e.g., "metal-sci-usi-amd64"). Defaults to "metal-sci-usi-amd64".
+#
+# Environment:
+#   GITHUB_SHA - Git commit SHA (required, set automatically by GitHub Actions)
+#
+# Output:
+#   Prints the computed image tag to stdout
+#
+# Tag format:
+#   {version}-{flavor}-{dashed_version}-{commit_sha_short}
+#
+# Examples:
+#   ./compute-image-tag.sh "1877.10.1"
+#   # Output: 1877.10.1-metal-sci-usi-amd64-1877-10-1-abcd1234
+#
+#   ./compute-image-tag.sh "pr-123" "metal-capi-amd64"
+#   # Output: pr-123-metal-capi-amd64-pr-123-abcd1234
+
+set -euo pipefail
+
+VERSION="${1:?Error: VERSION argument required}"
+FLAVOR="${2:-metal-sci-usi-amd64}"
+
+if [ -z "${GITHUB_SHA:-}" ]; then
+    echo "Error: GITHUB_SHA environment variable is required" >&2
+    exit 1
+fi
+
+COMMIT_SHA="${GITHUB_SHA::8}"
+DASHED_VERSION="${VERSION//./-}"
+
+IMAGE_TAG="${VERSION}-${FLAVOR}-${DASHED_VERSION}-${COMMIT_SHA}"
+
+echo "$IMAGE_TAG"

.github/workflows/dev.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - rel-1877-dev
     paths-ignore:
       - "**/README.md"
       - "docs/**"
@@ -11,6 +12,13 @@ on:
     paths-ignore:
       - "**/README.md"
       - "docs/**"
+
+# Cancel any in-progress PR workflow runs when PR is closed
+# Used to ensure cleanup runs after any PR build are uploaded (or aborts before the upload)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event.action == 'closed' }}
+
 jobs:
   set_version:
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
@@ -19,30 +27,25 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
       - name: use VERSION file to support dev build on rel-branch
         id: version
         run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "VERSION=today" >> $GITHUB_OUTPUT
-          else
-            echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
-          fi
+          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
 
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@409e9b640087ade203321a8d63bd1651f4677205
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
       # have a look at gardenlinux/.github/workflows/github.mjs
       target: dev
       fail_fast: true
-      platform_test_build: false
     # secrets:
       # aws_region: ${{ secrets.AWS_REGION }}
       # aws_kms_role: ${{ secrets.KMS_SIGNING_IAM_ROLE }}
@@ -55,16 +58,18 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       UPLOAD_VERSION: ${{ steps.meta.outputs.upload_version }}
-      COMMIT_SHA: ${{ steps.meta.outputs.sha }}
+      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
-      - name: Derive image version
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Compute image metadata
         id: meta
         run: |
           PR_NUMBER=${{ github.event.pull_request.number }}
           UPLOAD_VERSION="pr-${PR_NUMBER}"
           echo "upload_version=${UPLOAD_VERSION}" >> $GITHUB_OUTPUT
-          SHA="${GITHUB_SHA::8}"
-          echo "sha=${SHA}" >> $GITHUB_OUTPUT
+          IMAGE_TAG=$(.github/scripts/compute-image-tag.sh "${UPLOAD_VERSION}")
+          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
 
   upload:
     name: Upload PR image to OCI
@@ -83,7 +88,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.action != 'closed' }}
     uses: ./.github/workflows/test.yml
     with:
-      image_tag: "${{ needs.meta.outputs.UPLOAD_VERSION }}-metal-sci-usi-amd64-${{ needs.meta.outputs.UPLOAD_VERSION }}-${{ needs.meta.outputs.COMMIT_SHA }}"
+      image_tag: ${{ needs.meta.outputs.image_tag }}
 
   cleanup_images:
     name: Cleanup PR images
@@ -104,7 +109,7 @@ jobs:
             response=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions?per_page=$page_size&page=$page")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions?per_page=$page_size&page=$page")
 
             page_ids=$(echo "$response" | jq -r --arg prefix "${UPLOAD_VERSION}" '
               .[] | select(.metadata.container.tags[]? | test("^" + $prefix + "(-.*)?$")) | .id
@@ -133,7 +138,7 @@ jobs:
               -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions/$version_id")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions/$version_id")
             if [ "$http_code" != "204" ]; then
               echo "Failed to delete version $version_id (HTTP $http_code)"
             fi

.github/workflows/nightly.yaml

@@ -14,29 +14,49 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@409e9b640087ade203321a8d63bd1651f4677205
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
-      # have a look at gardenlinux/.github/workflows/github.mjs 
+      # have a look at gardenlinux/.github/workflows/github.mjs
       target: dev
       fail_fast: true
-      platform_test_build: false
+      #platform_test_build: false
     # secrets:
       # aws_region: ${{ secrets.AWS_REGION }}
       # aws_kms_role: ${{ secrets.KMS_SIGNING_IAM_ROLE }}
       # aws_oidc_session: ${{ secrets.AWS_OIDC_SESSION }}
       # secureboot_db_kms_arn: ${{ secrets.SECUREBOOT_DB_KMS_ARN }}
+  meta:
+    name: Compute image metadata
+    needs: [build]
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Compute image tag
+        id: meta
+        run: |
+          IMAGE_TAG=$(.github/scripts/compute-image-tag.sh "${{ needs.build.outputs.version }}")
+          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
   upload_oci:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@409e9b640087ade203321a8d63bd1651f4677205
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
+  test:
+    name: Test nightly image
+    needs: [meta, upload_oci]
+    uses: ./.github/workflows/test.yml
+    with:
+      image_tag: ${{ needs.meta.outputs.image_tag }}