On fedora-rawhide, write containers.conf.d so engine.conmon_path is
/usr/bin/conmon-v3 and export CONMON_BINARY to that same binary, which
is already installed in the CI image. Preserve CONMON_BINARY across
sudo, and abort setup unless the binary reports conmon version 3.
Also collect the conmon-v3 package when CI gathers logs.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
pull_request_target is considered insecure as it is easy to misuse. We
do not checkout code from a PR here and we need it for the secret access
so we kinda of to use it if we want the automatic machine-os PRs.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The github app we use for locking already only has rights for this so
this is not really gaining us anything. However zizmore points this out
in case the app would have more permissions to only keep it to a
minimum. It also protects us in case someone gives the app more
permissions in the future as the workflow does not need more.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a workflow running actionlint on GHA workflows, which helps a lot
when debugging broken workflows, and also runs shellcheck on all
embedded shell scripts. A separate workflow so it still runs when
another yaml is broken.
The config file is needed solely to let actionlint know about our custom
runners (otherwise it complains).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The variable is $VERSION not $version, so the check never worked
(IOW needsUpdate=true was always set).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The big-tests matrix has no timeout key -- remove it.
This fixes actionlint warnings about
- the undefined property;
- the assignment of a string to a numeric input.
No change in behavior.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Fix the rest of shellcheck warnings in GHA workflows:
- $(...) instead of backticks;
- "read -a" instead of word-splitting;
- bash arrays instead of space-separated options;
- "grep -q" instead of testing grep output for being empty;
- single redirect for a group of echo commands;
- etc.
Suppress the linter where it does not make sense (single-quoted
backticks in printf are markdown).
Found by actionlint (which runs shellcheck on run: scripts).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Quote variable expansions in run: scripts, as recommended by
shellcheck (SC2086). No change in behavior is expected.
Found by actionlint (which runs shellcheck on run: scripts).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add [Quadlet] SetMountsDependency to select RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths.
Keep Requires as the default to preserve existing behavior and retain the required dependency on Podman's container storage directory.
Document the available values and the systemd version requirement for WantsMountsFor.
Add Quadlet integration fixtures covering Wants, Requires, None, and invalid values.
Fixes: #29946
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
OCI runtime initialization errors are only logged at debug level, so
podman fails with a misleading `default OCI runtime "crun" not found`
even if crun exists but, for example, the exits directory below a
non-writable tmp dir could not be created. Keep the error of the default
runtime and return it when its initialization failed.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
The deferred cleanup in makeRuntime checked a local store variable that
was never assigned, so the store was not shut down on errors, which
leaked the overlay mount as root. Use runtime.store instead.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
Jan Kaluza