bump 2150

.github/actions/test/integration/build/action.yml

@@ -11,7 +11,7 @@ runs:
     - name: Set ENV
       shell: bash
       env:
-        REPO: ghcr.io/gardenlinux/gardenlinux-ccloud
+        REPO: ghcr.io/gardenlinux/gardenlinux-sci
         TAG: ${{ inputs.image_tag }}
         ESP_SIZE: 2  # GiB
         DISK_SIZE: 8  # GiB
@@ -135,7 +135,7 @@ runs:
     # - name: Upload artifacts
     #   uses: actions/upload-artifact@v4
     #   with:
-    #     name: gardenlinux-ccloud-${{ inputs.image_tag }}
+    #     name: gardenlinux-sci-${{ inputs.image_tag }}
     #     path: /opt/${{ inputs.image_tag }}.*
     #     retention-days: 1
     #     overwrite: true

.github/actions/test/integration/build/dev-user-butane.yaml

@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.3.0
+version: 1.7.0
 passwd:
   users:
     - name: root
@@ -49,7 +49,7 @@ storage:
     contents:
       inline: |
         # pull the image from GHCR instead of keppel
-        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-ccloud
+        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-sci
         # point to a custom tag to download for the persist step
         OCI_TAG=TAG_GOES_HERE
   # Enable unlimited core dumps for all systemd services

.github/actions/test/integration/collect-logs/action.yml

@@ -34,6 +34,44 @@ runs:
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/QEMU.log "serial-VM-QEMU-HV2.log" || true
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/CHV.log "serial-VM-CHV-HV2.log" || true
 
+    - name: Obtain network diagnostics from hypervisors
+      shell: bash
+      run: |
+        KEY=/opt/ssh_host_ed25519_key
+        SSH_OPTS="-i $KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        USER="root"
+
+        for HV_NAME in HV1 HV2; do
+          IP="192.168.122.$([[ $HV_NAME == HV1 ]] && echo 2 || echo 3)"
+
+          ssh $SSH_OPTS $USER@$IP "
+            echo '=== ip addr ==='
+            ip addr
+            echo '=== ip route ==='
+            ip route
+            echo '=== bridge link ==='
+            bridge link 2>/dev/null || true
+            echo '=== arp -n ==='
+            arp -n 2>/dev/null || ip neigh || true
+            echo '=== iptables -L -n ==='
+            iptables -L -n 2>/dev/null || true
+            echo '=== iptables -t nat -L -n ==='
+            iptables -t nat -L -n 2>/dev/null || true
+            echo '=== virsh net-list ==='
+            virsh net-list --all 2>/dev/null || true
+            echo '=== virsh net-dumpxml default ==='
+            virsh net-dumpxml default 2>/dev/null || true
+            echo '=== dnsmasq leases ==='
+            cat /var/lib/libvirt/dnsmasq/*.leases 2>/dev/null || true
+            echo '=== systemctl status systemd-networkd ==='
+            systemctl status systemd-networkd --no-pager 2>/dev/null || true
+            echo '=== networkctl status ==='
+            networkctl status --no-pager 2>/dev/null || true
+            echo '=== ssh -V ==='
+            ssh -V 2>&1 || true
+          " > "network-diag-${HV_NAME}.log" 2>&1 || true
+        done
+
     - name: Set permissions
       shell: bash
       run: |

.github/actions/test/integration/dependencies/action.yml

@@ -34,7 +34,7 @@ runs:
     - name: butane
       shell: bash
       run: |
-        BUTANE_VERSION="0.24.0"
+        BUTANE_VERSION="0.27.0"
         curl -LO "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu"
         chmod +x "butane-x86_64-unknown-linux-gnu"
         sudo mv "butane-x86_64-unknown-linux-gnu" /usr/local/bin/butane

.github/actions/test/integration/setup/hv.xml

@@ -15,7 +15,7 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/HV_NAME_GOES_HERE.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
         <interface type='network'>
             <mac address='MAC_GOES_HERE' />

.github/actions/test/integration/test/cloudhypervisor/action.yml

@@ -52,14 +52,33 @@ runs:
             IP=\$(virsh -c ch:///session domifaddr VM-CHV | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
-            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
+            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
               ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
               break
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh -c ch:///session domifaddr VM-CHV ---"
+              virsh -c ch:///session domifaddr VM-CHV || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -111,7 +130,7 @@ runs:
 
           MAX_ITER=15
           for ((i=1; i<=MAX_ITER; i++)); do
-            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # verify the migration by checking the dummy file
               if ssh \$SSH_OPTS "\$USER@\$IP" 'test -f /opt/hello.txt'; then
@@ -124,6 +143,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"

.github/actions/test/integration/test/qemu/action.yml

@@ -50,6 +50,13 @@ runs:
             IP=\$(virsh domifaddr VM-QEMU | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
             elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
@@ -58,6 +65,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh domifaddr VM-QEMU ---"
+              virsh domifaddr VM-QEMU || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -122,6 +141,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"

.github/actions/test/integration/test/qemu/vm.xml

@@ -15,12 +15,12 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/ubuntu.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
-        <disk type='file' device='cdrom'>
+        <disk type='file' device='disk'>
             <driver name='qemu' type='raw' />
             <source file='/var/lib/libvirt/images/ubuntu-cloud-init-ds.iso' />
-            <target dev='hdb' bus='ide' />
+            <target dev='vdb' bus='virtio' />
             <readonly />
         </disk>
         <interface type='network'>

.github/workflows/dev.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - rel-2150-dev
     paths-ignore:
       - "**/README.md"
       - "docs/**"
@@ -26,23 +27,19 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
       - name: use VERSION file to support dev build on rel-branch
         id: version
         run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "VERSION=today" >> $GITHUB_OUTPUT
-          else
-            echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
-          fi
+          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
 
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -64,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image metadata
         id: meta
         run: |
@@ -112,7 +109,7 @@ jobs:
             response=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions?per_page=$page_size&page=$page")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions?per_page=$page_size&page=$page")
 
             page_ids=$(echo "$response" | jq -r --arg prefix "${UPLOAD_VERSION}" '
               .[] | select(.metadata.container.tags[]? | test("^" + $prefix + "(-.*)?$")) | .id
@@ -141,7 +138,7 @@ jobs:
               -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions/$version_id")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions/$version_id")
             if [ "$http_code" != "204" ]; then
               echo "Failed to delete version $version_id (HTTP $http_code)"
             fi

.github/workflows/nightly.yaml

@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -39,7 +39,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image tag
         id: meta
         run: |
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@36078a576d0767433423289f2fa217b96cd951c9
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}

.github/workflows/test.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install oras
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
         with:
           version: 1.2.2
       - name: Validate image tag
@@ -31,8 +31,8 @@ jobs:
           fi
 
           echo "Verifying image ${{ inputs.image_tag }} exists in GHCR..."
-          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-ccloud:${{ inputs.image_tag }} 2>&1); then
-            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-ccloud"
+          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-sci:${{ inputs.image_tag }} 2>&1); then
+            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-sci"
             echo "Resolve output: $digest"
             exit 1
           fi

.github/workflows/upload_oci.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
@@ -37,14 +37,14 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@v1
+      - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
-        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
+        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@efdffb9a6b279cd7aada23b02baf4ec2534dc6d2
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.9.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: 'v2.4.1'
+          cosign-release: 'v3.1.3'
       - name: Set flavor version reference
         run: |
           git rev-parse HEAD | cut -c1-8 | tee COMMIT

Containerfile

@@ -0,0 +1,3 @@
+FROM ghcr.io/gardenlinux/builder:98ee0d480844b2d041524841bfdbbb4007d32248@sha256:d7063f72c0db3e7cdd618136efb292379794a0c4d4b5ddfc3759795c17d963ab
+
+RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2).0/' -i /builder/bootstrap

VERSION

@@ -0,0 +1 @@
+2150.9.0