Skip to content

ci: run installer checks in qlean - #38

Merged
genedna merged 12 commits into
mainfrom
codex/qlean-ci
Aug 24, 2026
Merged

ci: run installer checks in qlean#38
genedna merged 12 commits into
mainfrom
codex/qlean-ci

Conversation

@Ivanbeethoven

Copy link
Copy Markdown
Collaborator

Summary

  • Add an opt-in qlean-ci integration test using qlean = 0.3.1.
  • Run installer validation and systemd/permission checks inside a disposable Debian QEMU VM.
  • Add a dedicated GitHub Actions workflow that provisions QEMU, libvirt, vhost-vsock, and the bridge helper.
  • Document local usage and the required Linux host capabilities.

The existing fast fmt, clippy, build, and host-side installer checks remain unchanged. The qlean dependency is Linux-only and the VM test is ignored unless explicitly selected.

One-command usage

On a Linux host configured for Qlean:

cargo build --release --locked --bin scorpio --bin antares
QLEAN_QEMU_TIMEOUT_SECS=1200 \
  cargo test --locked --features qlean-ci --test qlean_installer \
    -- --ignored --nocapture

The same command runs in .github/workflows/qlean.yml after the runner installs QEMU/libvirt and configures /dev/vhost-vsock and qemu-bridge-helper.

Verification

  • cargo fmt --all -- --check
  • WSL Ubuntu 22.04: bash script/test_installer.sh passed.
  • WSL Ubuntu 22.04: Linux qlean test target compiled successfully.
  • WSL Ubuntu 22.04: clippy passed with --all-targets --all-features -- -D warnings.
  • The actual ignored VM run was attempted in WSL, but the host has no running libvirt daemon/socket (/var/run/libvirt/libvirt-sock); GitHub Actions provisions that prerequisite.

Signed-off-by: Luxian <lux1an@qq.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d2ec81bd9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread tests/qlean_installer.rs
use tempfile::tempdir;

const VERSION: &str = "v0.0.0-qlean";
const TARGET: &str = "x86_64-unknown-linux-gnu";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restrict the fixture to x86_64 hosts

When the documented command is run on an aarch64 Linux host, cargo build produces native aarch64 binaries, but this fixture always publishes them under the x86_64-unknown-linux-gnu asset name. The installer selects its asset from the VM architecture, so an ARM VM requests an asset that was never created, while an x86_64 VM downloads binaries it cannot execute. Gate this test on target_arch = "x86_64" or explicitly build and stage binaries matching the guest target.

Useful? React with 👍 / 👎.

Comment thread tests/qlean_installer.rs Outdated
}

for binary in ["scorpio", "antares"] {
let source = repo_root.join("target/release").join(binary);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Resolve binaries from Cargo's configured target directory

When CARGO_TARGET_DIR or Cargo configuration redirects build artifacts, the documented release build succeeds outside target/, but this test still reports the binaries missing; if an old default artifact exists, it can instead validate stale code. Resolve Cargo's active target directory or pass the built fixture paths explicitly so the VM always tests the binaries produced by the preceding build.

Useful? React with 👍 / 👎.

Signed-off-by: Luxian <lux1an@qq.com>
Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Addressed the automated review feedback in dc5cfc0: the Qlean fixture test is now gated to Linux x86_64, and it resolves Cargo's active arget_directory via cargo metadata before staging release binaries, so custom CARGO_TARGET_DIR/Cargo target-dir configurations are honored. The one-command installer validation instructions are documented above and in README.md. Local WSL rerun is currently blocked by the environment's unavailable crates.io network/proxy; the previous WSL validation and GitHub Actions run remain recorded in this PR.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc5cfc0544

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread tests/qlean_installer.rs Outdated
run_checked(
vm,
&format!(
"bash {root}/script/test_installer_systemd.sh {VERSION} http://127.0.0.1:18080 /tmp/scorpiofs-qlean-systemd"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Run the guest installer checks as a non-root service user

In the Qlean workflow, guest commands run as root, as demonstrated by the preceding direct apt-get invocation, but this call neither switches to an unprivileged user nor supplies SUDO_USER. Consequently test_installer_systemd.sh assigns service_user=root and skips its service_user != root permission branch, while all remaining ownership checks use root as the service account; the isolated job can therefore pass without exercising the non-root permission behavior it is intended to validate.

Useful? React with 👍 / 👎.

Signed-off-by: Luxian <lux1an@qq.com>
Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Also addressed the latest automated review in 99a952: the Qlean guest keeps root for VM/system operations but invokes est_installer_systemd.sh with SUDO_USER=nobody, so the non-root service-user, ownership, and permission branches are exercised.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f99a952027

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread tests/qlean_installer.rs Outdated
run_checked(
vm,
&format!(
"python3 -m http.server 18080 --bind 127.0.0.1 --directory {root}/release >/tmp/scorpiofs-qlean-http.log 2>&1 & server_pid=$!; trap 'kill $server_pid 2>/dev/null || true' EXIT; curl --fail --retry 20 --retry-delay 1 http://127.0.0.1:18080/{VERSION}/scorpiofs-{VERSION}-{TARGET}.tar.gz.sha256 >/dev/null; SUDO_USER=nobody bash {root}/script/test_installer_systemd.sh {VERSION} http://127.0.0.1:18080 /tmp/scorpiofs-qlean-systemd"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Retry connection refusals while waiting for the fixture server

On a loaded VM, curl can start before the background Python server has bound port 18080, causing this entire command and CI test to fail immediately with exit code 7. The checked curl 8.5.0 --help all distinguishes ordinary --retry from “--retry-connrefused Retry on connection refused (use with --retry),” so add that option or use an explicit readiness loop like the one in .github/workflows/build.yml.

Useful? React with 👍 / 👎.

Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Follow-up in 75226d4: the guest now installs fuse3 and enables user_allow_other before systemd checks. The fixture HTTP server is started with an explicit liveness check and set -euo pipefail, so the VM test cannot mask server or curl failures.

Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Final fixture fix in 10d9aca: Qlean upload does not preserve executable mode bits, so the VM now applies chmod 0755 to scorpio and antares before creating the local release archive. The prior run confirmed checksum download and guest permission setup succeeded; this fixes the archive layout validation failure.

Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Mega server URL example for the interactive installer:

curl -fsSL https://raw.githubusercontent.com/gitmono-dev/scorpiofs/main/install.sh | sudo bash

When prompted, enter:

base_url: https://git.rk8s.xuanwu.openatom.cn
lfs_url:  https://git.rk8s.xuanwu.openatom.cn/lfs

For non-interactive use:

curl -fsSL https://raw.githubusercontent.com/gitmono-dev/scorpiofs/main/install.sh | sudo bash -s -- --non-interactive --overwrite-config --base-url https://git.rk8s.xuanwu.openatom.cn --lfs-url https://git.rk8s.xuanwu.openatom.cn/lfs

Signed-off-by: Luxian <lux1an@qq.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 47e494cdf1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
required-features = ["qlean-ci"]

[target.'cfg(target_os = "linux")'.dev-dependencies]
qlean = "0.3.1"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Gate Qlean itself behind the opt-in feature

On Linux, a normal cargo test builds every dev-dependency, including qlean and its large transitive dependency graph, even when qlean-ci is disabled; required-features only excludes the integration-test target. This makes the supposedly opt-in VM test impose its compilation time and toolchain/platform requirements on the default test suite. Declare Qlean as an optional dependency and activate it from qlean-ci (for example, qlean-ci = ["dep:qlean"]) so ordinary test runs remain unchanged.

Useful? React with 👍 / 👎.

Signed-off-by: Luxian <lux1an@qq.com>
Signed-off-by: Luxian <lux1an@qq.com>
Signed-off-by: Luxian <lux1an@qq.com>
@Ivanbeethoven

Copy link
Copy Markdown
Collaborator Author

Qlean FUSE verification completed on fc910fd. The Debian guest installs fuse3, kmod, and util-linux, then loads its own fuse kernel module. The test starts the release scorpio serve daemon and waits for the real mount. findmnt reports fuse/fuse.*, stat succeeds on the mountpoint, and cleanup verifies that the mount is detached. Qlean isolated CI passed: https://github.com/gitmono-dev/scorpiofs/actions/runs/32646734369/job/97212028855. Installer usage is documented in the PR body and README. Interactive install: curl -fsSL https://raw.githubusercontent.com/gitmono-dev/scorpiofs/main/install.sh | sudo bash. The installer prompts for the base and LFS URLs; for the Mega server use https://git.rk8s.xuanwu.openatom.cn and https://git.rk8s.xuanwu.openatom.cn/lfs.

@genedna
genedna merged commit 5637915 into main Aug 24, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants