bootc-host-setup: Add RHEL 10 support

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - rhel10-x86_64-16c-64g
+    - ubuntu-26.04

.github/workflows/test-actions-pr.yml

@@ -8,15 +8,15 @@ permissions:
   contents: read
 
 jobs:
-  test-bootc-ubuntu-setup:
-    name: Test bootc-ubuntu-setup
+  test-bootc-host-setup:
+    name: Test bootc-host-setup
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Run bootc-ubuntu-setup
-        uses: ./bootc-ubuntu-setup
+      - name: Run bootc-host-setup
+        uses: ./bootc-host-setup
 
       - name: Verify setup
         run: |
@@ -26,15 +26,15 @@ jobs:
       - name: Verify basic requirements
         uses: ./.github/actions/verify-basic-requirements
 
-  test-bootc-ubuntu-setup-2604:
-    name: Test bootc-ubuntu-setup (26.04)
+  test-bootc-host-setup-2604:
+    name: Test bootc-host-setup (26.04)
     runs-on: ubuntu-26.04
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Run bootc-ubuntu-setup
-        uses: ./bootc-ubuntu-setup
+      - name: Run bootc-host-setup
+        uses: ./bootc-host-setup
 
       - name: Verify setup
         run: |
@@ -78,6 +78,34 @@ jobs:
             test "$(stat -c %u:%g /bwrap-tmp/child)" = 1:1
           '
           CONTAINER
+
+  test-bootc-ubuntu-setup-compatibility:
+    name: Test bootc-ubuntu-setup compatibility entry point
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./bootc-ubuntu-setup
+      - run: test -n "$ARCH"
+
+  test-bootc-host-setup-rhel10:
+    name: Test bootc-host-setup (RHEL 10)
+    runs-on: rhel10-x86_64-16c-64g
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./bootc-host-setup
+        with:
+          libvirt: 'true'
+      - run: |
+          rustc --version
+          cargo --version
+          test "$(getenforce)" = Enforcing
+
+  test-bootc-host-setup-scripts:
+    name: Test bootc-host-setup scripts
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - run: bash test/bootc-host-setup.sh
   test-setup-rust:
     name: Test setup-rust
     runs-on: ubuntu-latest
@@ -117,7 +145,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup host
-        uses: ./bootc-ubuntu-setup
+        uses: ./bootc-host-setup
 
       - name: Create test Containerfile
         shell: bash
@@ -156,7 +184,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup host
-        uses: ./bootc-ubuntu-setup
+        uses: ./bootc-host-setup
 
       - name: Build image manually
         shell: bash

.github/workflows/test-actions-published.yml

@@ -8,12 +8,12 @@ permissions:
   contents: read
 
 jobs:
-  test-bootc-ubuntu-setup:
-    name: Test bootc-ubuntu-setup@main
+  test-bootc-host-setup:
+    name: Test bootc-host-setup@main
     runs-on: ubuntu-24.04
     steps:
-      - name: Run bootc-ubuntu-setup
-        uses: bootc-dev/actions/bootc-ubuntu-setup@main
+      - name: Run bootc-host-setup
+        uses: bootc-dev/actions/bootc-host-setup@main
 
       - name: Verify setup
         run: |
@@ -23,12 +23,12 @@ jobs:
       - name: Verify basic requirements
         uses: bootc-dev/actions/.github/actions/verify-basic-requirements@main
 
-  test-bootc-ubuntu-setup-2604:
-    name: Test bootc-ubuntu-setup@main (26.04)
+  test-bootc-host-setup-2604:
+    name: Test bootc-host-setup@main (26.04)
     runs-on: ubuntu-26.04
     steps:
-      - name: Run bootc-ubuntu-setup
-        uses: bootc-dev/actions/bootc-ubuntu-setup@main
+      - name: Run bootc-host-setup
+        uses: bootc-dev/actions/bootc-host-setup@main
 
       - name: Verify setup
         run: |

.github/workflows/test-container-integration.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup host
-        uses: ./bootc-ubuntu-setup
+        uses: ./bootc-host-setup
 
       - name: Create test Containerfile
         shell: bash
@@ -74,7 +74,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup host
-        uses: ./bootc-ubuntu-setup
+        uses: ./bootc-host-setup
 
       - name: Extract metadata
         id: meta

.github/workflows/test-ubuntu-2604-ovmf.yml

@@ -16,8 +16,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Run bootc-ubuntu-setup
-        uses: ./bootc-ubuntu-setup
+      - name: Run bootc-host-setup
+        uses: ./bootc-host-setup
         with:
           libvirt: true
 

.github/workflows/test-virtualization.yml

@@ -3,7 +3,7 @@ name: Test virtualization setup
 on:
   pull_request:
     paths:
-      - bootc-ubuntu-setup/action.yml
+      - bootc-host-setup/**
       - .github/workflows/test-virtualization.yml
   workflow_dispatch:
 
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ubuntu host
-        uses: ./bootc-ubuntu-setup
+        uses: ./bootc-host-setup
         with:
           libvirt: true
 

bootc-host-setup/AGENTS.md

@@ -0,0 +1,5 @@
+# Dependencies
+
+Downloaded or versioned dependencies in this action must be managed by
+Renovate.  Do not leave a dependency forever-pinned: add a Renovate annotation
+and update any paired checksum in the same change.

bootc-host-setup/action.yml

@@ -0,0 +1,25 @@
+name: 'Bootc Host Setup'
+description: 'Set up a supported GitHub-hosted bootc build host'
+inputs:
+  libvirt:
+    description: 'Install libvirt and virtualization stack'
+    required: false
+    default: 'false'
+runs:
+  using: 'composite'
+  steps:
+    - name: Install host dependencies
+      shell: bash
+      env:
+        BOOTC_HOST_LIBVIRT: ${{ inputs.libvirt }}
+      run: bash "${GITHUB_ACTION_PATH}/ci/install-deps.sh"
+    - name: Apply host workarounds
+      shell: bash
+      env:
+        BOOTC_HOST_LIBVIRT: ${{ inputs.libvirt }}
+      run: bash "${GITHUB_ACTION_PATH}/ci/workarounds.sh"
+    - name: Test host environment
+      shell: bash
+      env:
+        BOOTC_HOST_LIBVIRT: ${{ inputs.libvirt }}
+      run: bash "${GITHUB_ACTION_PATH}/ci/test-environment.sh"

bootc-host-setup/ci/install-deps.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+set -euo pipefail
+
+action_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+packages_dir="${action_dir}/packages"
+libvirt=${BOOTC_HOST_LIBVIRT:-false}
+
+read_packages() {
+  local file=$1 line
+  while IFS= read -r line || [ -n "$line" ]; do
+    line=${line%%#*}
+    [ -n "$line" ] && packages+=("$line")
+  done < "$file"
+}
+
+load_os_release() {
+  # shellcheck disable=SC1091
+  . /etc/os-release
+  case "${ID}:${VERSION_ID}" in
+    ubuntu:24.04|ubuntu:26.04|rhel:10|rhel:10.*) ;;
+    *) printf 'Unsupported host: ID=%s VERSION_ID=%s\n' "$ID" "$VERSION_ID" >&2; exit 1 ;;
+  esac
+}
+
+free_ubuntu_disk() {
+  local package dir n=0
+  local -a unwanted_packages=(aspnetcore-* dotnet-* llvm-* php* mongodb-* mysql-* azure-cli google-chrome-stable firefox mono-devel)
+  local -a unwanted_dirs=(/usr/share/dotnet /opt/ghc /usr/local/lib/android /opt/hostedtoolcache/CodeQL)
+  sudo df -h
+  run_cleanup() { sudo systemd-run -r -u "action-cleanup-${n}" -- "$@"; n=$((n + 1)); }
+  run_cleanup docker image prune --all --force
+  for dir in "${unwanted_dirs[@]}"; do run_cleanup rm -rf "$dir"; done
+  for package in "${unwanted_packages[@]}"; do
+    if dpkg -l "$package" >/dev/null 2>&1; then
+      /bin/time -f '%E %C' sudo apt-get remove -y "$package"
+    fi
+  done
+}
+
+ubuntu_mirror() {
+  if [ "$(dpkg --print-architecture)" = amd64 ]; then
+    [ -f /etc/apt/apt-mirrors.txt ] && printf '%s' 'mirror+file:/etc/apt/apt-mirrors.txt' || printf '%s' 'http://archive.ubuntu.com/ubuntu'
+  else
+    printf '%s' 'http://ports.ubuntu.com/ubuntu-ports'
+  fi
+}
+
+install_bcvk() {
+  [ "$libvirt" = true ] && [ "$(uname -m)" = x86_64 ] || return 0
+  # renovate: datasource=github-releases depName=bootc-dev/bcvk
+  local bcvk_version=0.19.0 target tmpdir
+  target="bcvk-$(uname -m)-unknown-linux-gnu"
+  tmpdir=$(mktemp -d)
+  curl --fail --show-error --location --retry 5 --retry-delay 10 --retry-max-time 300 --output "${tmpdir}/${target}.tar.gz" "https://github.com/bootc-dev/bcvk/releases/download/v${bcvk_version}/${target}.tar.gz"
+  tar -xzf "${tmpdir}/${target}.tar.gz" -C "$tmpdir"
+  sudo install -m 0755 "${tmpdir}/${target}" /usr/local/bin/bcvk
+  rm -rf "$tmpdir"
+  if [ "$ID" = ubuntu ]; then
+    sudo sed -i -e 's,^\* hard nofile 65536,* hard nofile 524288,' /etc/security/limits.conf
+  fi
+  printf 'LIBVIRT_DEFAULT_URI=qemu:///session\n' >> "$GITHUB_ENV"
+}
+
+install_ubuntu() {
+  local -a packages=()
+  free_ubuntu_disk
+  if [ "$VERSION_ID" = 24.04 ]; then
+    printf 'deb %s plucky universe main\n' "$(ubuntu_mirror)" | sudo tee /etc/apt/sources.list.d/plucky.list >/dev/null
+    printf '%s\n' 'Acquire::Retries "5";' | sudo tee /etc/apt/apt.conf.d/80-retries >/dev/null
+  fi
+  read_packages "${packages_dir}/ubuntu-base"
+  /bin/time -f '%E %C' sudo apt-get update
+  /bin/time -f '%E %C' sudo apt-get install -y "${packages[@]}"
+  if [ "$VERSION_ID" = 24.04 ]; then
+    packages=()
+    read_packages "${packages_dir}/ubuntu-24.04-base"
+    /bin/time -f '%E %C' sudo apt-get install -y --allow-downgrades "${packages[@]/%//plucky}"
+  fi
+  if [ "$libvirt" = true ]; then
+    packages=()
+    read_packages "${packages_dir}/ubuntu-libvirt"
+    if [ "$VERSION_ID" = 26.04 ]; then
+      read_packages "${packages_dir}/ubuntu-26.04-libvirt"
+      packages+=(ovmf-amdsev-)
+    fi
+    /bin/time -f '%E %C' sudo apt-get install -y "${packages[@]}"
+  fi
+}
+
+install_rhel_just() {
+  if sudo dnf install -y just; then return; fi
+  # TODO: Remove this fallback once the stock partner image reliably exposes a current EPEL just package.
+  # renovate: datasource=github-releases depName=casey/just
+  local just_version=1.58.0 just_sha256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d tmpdir
+  tmpdir=$(mktemp -d)
+  curl --fail --show-error --location --retry 5 --output "${tmpdir}/just.tar.gz" "https://github.com/casey/just/releases/download/${just_version}/just-${just_version}-x86_64-unknown-linux-musl.tar.gz"
+  printf '%s  %s\n' "$just_sha256" "${tmpdir}/just.tar.gz" | sha256sum --check
+  tar -xzf "${tmpdir}/just.tar.gz" -C "$tmpdir" just
+  sudo install -m 0755 "${tmpdir}/just" /usr/local/bin/just
+  rm -rf "$tmpdir"
+}
+
+install_rhel() {
+  local -a packages=()
+  read_packages "${packages_dir}/rhel-base"
+  [ "$libvirt" = true ] && read_packages "${packages_dir}/rhel-libvirt"
+  sudo dnf install -y "${packages[@]}"
+  install_rhel_just
+}
+
+main() {
+  load_os_release
+  case "$ID" in
+    ubuntu) install_ubuntu ;;
+    rhel) install_rhel ;;
+  esac
+  install_bcvk
+  printf 'ARCH=%s\n' "$(arch)" >> "$GITHUB_ENV"
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then main "$@"; fi

bootc-host-setup/ci/test-environment.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+libvirt=${BOOTC_HOST_LIBVIRT:-false}
+# shellcheck disable=SC1091
+. /etc/os-release
+case "$ID" in ubuntu|rhel) ;; *) exit 1 ;; esac
+podman --version
+just --version
+test -n "${GITHUB_ENV:-}"
+
+if [ "$libvirt" = true ]; then
+  test -x "$(command -v virsh)"
+  test -x "$(command -v virt-fw-vars)"
+  virtiofsd=$(command -v virtiofsd || true)
+  test -x "${virtiofsd:-/usr/lib/qemu/virtiofsd}"
+  if [ "$ID" = rhel ]; then
+    test "$(getenforce)" = Enforcing
+    test -r /dev/kvm && test -w /dev/kvm
+    test -x /usr/sbin/virtstoraged
+    qemu_config="${XDG_CONFIG_HOME:-$HOME/.config}/libvirt/qemu.conf"
+    printf '%s\n' 'security_driver = "none"' | cmp --silent - "$qemu_config"
+    dbus-run-session -- virsh -c qemu:///session list --all
+    dbus-run-session -- virsh -c qemu:///session pool-list --all
+  fi
+fi