[pull] main from osbuild:main

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence.
+*               @osbuild/osbuild-reviewers
+

.github/dependabot.yml

@@ -11,16 +11,3 @@ updates:
       time: "04:00"
     open-pull-requests-limit: 5
     rebase-strategy: "disabled"
-
-  # Maintain dependencies for Go
-  - package-ecosystem: "gomod"
-    directory: "/bib"
-    schedule:
-      interval: "daily"
-      time: "04:00"
-    groups:
-      go-deps:
-        patterns:
-          - "*"  # group all dependency updates into one PR
-    open-pull-requests-limit: 1
-    rebase-strategy: "auto"

.github/workflows/auto-merge-dependabot.yml

@@ -8,7 +8,7 @@ permissions: write-all
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Approve a PR
         run: gh pr review --approve "$PR_URL"

.github/workflows/build.yaml

@@ -2,26 +2,49 @@ name: Build containers
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      - main
+      - rhel-*
+  workflow_dispatch:
   # for merge queue
   merge_group:
+  push:
+    branches: [main]
 
 env:
+  REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 permissions:
   contents: read
+  packages: write
 
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build image
         uses: redhat-actions/buildah-build@v2
         with:
           image: ${{ env.IMAGE_NAME }}
           tags: "latest"
           containerfiles: Containerfile
+
+      - name: Log in to the Container registry
+        if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'push') && github.ref == 'refs/heads/main' }}
+        uses: redhat-actions/podman-login@v1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push to GitHub Container Repository
+        if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'push') && github.ref == 'refs/heads/main' }}
+        uses: redhat-actions/push-to-registry@v2
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          tags: "latest"
+          registry: ${{ env.REGISTRY }}

.github/workflows/gobump.yml

@@ -0,0 +1,57 @@
+name: "Updates Go dependencies"
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  schedule:
+    - cron: "0 15 * * 2"
+
+jobs:
+  update-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Extract Go version from go.mod
+        id: go-version
+        run: |
+          VERSION=$(grep '^go ' bib/go.mod | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go-version.outputs.version }}
+          cache-dependency-path: bib/go.sum
+
+      - name: Update go.mod and open a PR
+        env:
+          GH_TOKEN: ${{ secrets.SCHUTZBOT_GITHUB_ACCESS_TOKEN }}
+        run: |
+          pushd bib/
+          echo '```' > /tmp/go.log
+          go get -u ./... 2>&1 | tee -a /tmp/go.log
+          go mod tidy 2>&1 | tee -a /tmp/go.log
+          echo '```' >> /tmp/go.log
+          popd
+
+          if git diff --exit-code; then
+            echo "No changes"
+            exit 0
+          fi
+
+          git config user.name "schutzbot"
+          git config user.email "schutzbot@gmail.com"
+
+          branch="schutz-gobump-$(date +%Y-%m-%d)"
+          git checkout -b "${branch}"
+          git add -A
+          git commit -m "build(deps): Update dependencies"
+          git push -f https://x-access-token:${GH_TOKEN}@github.com/osbuild/bootc-image-builder.git HEAD:"${branch}"
+
+          gh pr create \
+            --title "Update dependencies $(date +%Y-%m-%d)" \
+            --body-file /tmp/go.log \
+            --repo "osbuild/bootc-image-builder" \
+            --base "main" \
+            --head "${branch}"

.github/workflows/stale-cleanup.yml

@@ -8,6 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     permissions:
+      actions: write  # needed to clean up the saved action state
       issues: write
       pull-requests: write
     steps:

.github/workflows/testingfarm-unit.yml

@@ -27,13 +27,13 @@ jobs:
         echo "Job originally triggered by ${{ github.actor }}"
         exit 1
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Run the tests
-      uses: sclorg/testing-farm-as-github-action@v3
+      uses: sclorg/testing-farm-as-github-action@v4
       with:
-        compose: Fedora-40
+        compose: Fedora-42
         tmt_plan_regex: "/plans/unit-go"
         api_key: ${{ secrets.TF_API_KEY }}
         git_url: ${{ github.event.pull_request.head.repo.clone_url }}

.github/workflows/testingfarm.yml

@@ -44,13 +44,13 @@ jobs:
         echo "Job originally triggered by ${{ github.actor }}"
         exit 1
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Run the tests
-      uses: sclorg/testing-farm-as-github-action@v3
+      uses: sclorg/testing-farm-as-github-action@v4
       with:
-        compose: Fedora-40
+        compose: Fedora-42
         tmt_plan_regex: "/plans/integration"
         api_key: ${{ secrets.TF_API_KEY }}
         git_url: ${{ github.event.pull_request.head.repo.clone_url }}

.github/workflows/tests.yml

@@ -13,9 +13,6 @@ on:
 
 env:
   GO_VERSION: 1.22
-  # see https://golangci-lint.run/product/changelog
-  # to select a version that supports the GO_VERSION given above
-  GOLANGCI_LINT_VERSION: v1.59.1
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -33,7 +30,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -44,10 +41,14 @@ jobs:
       - name: Install libgpgme devel package
         run: sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev
 
+      - name: Extract golangci-lint version from Makefile
+        id: golangci_lint_version
+        run: echo "GOLANGCI_LINT_VERSION=$(awk -F '=' '/^GOLANGCI_LINT_VERSION *=/{print $2}' Makefile)" >> "$GITHUB_OUTPUT"
+
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          version: ${{ steps.golangci_lint_version.outputs.GOLANGCI_LINT_VERSION }}
           args: --timeout 5m0s
           working-directory: bib
 
@@ -56,9 +57,9 @@ jobs:
 
   shellcheck:
     name: "🐚 Shellcheck"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Run ShellCheck
@@ -70,22 +71,42 @@ jobs:
         # allow seemingly unreachable commands
         SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317
 
+  collect_tests:
+    runs-on: ubuntu-latest
+    outputs:
+      test_files: ${{ steps.collect.outputs.test_files }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Collect test files
+        id: collect
+        run: |
+          TEST_FILES=$(ls test/test_*.py | sort)
+          JSON_FILES=$(echo "${TEST_FILES}" | jq -R | jq -cs )
+          echo "test_files=${JSON_FILES}" >> $GITHUB_OUTPUT
+
   integration:
     # TODO: run this also via tmt/testing-farm
     name: "Integration"
     runs-on: ubuntu-24.04
+    needs: collect_tests
+    strategy:
+      matrix:
+        test_file: ${{ fromJson(needs.collect_tests.outputs.test_files) }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Setup up python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
     - name: Apt update
       run: sudo apt update
     - name: Install test dependencies
       run: |
         sudo apt update
-        sudo apt install -y python3-pytest python3-paramiko python3-boto3 flake8 pylint libosinfo-bin squashfs-tools
+        sudo apt install -y python3-pytest python3-boto3 flake8 pylint libosinfo-bin squashfs-tools sshpass
     - name: Diskspace (before)
       run: |
         df -h
@@ -124,7 +145,7 @@ jobs:
     - run: |
         mkdir -p /var/tmp/osbuild-test-store
     - name: Cache osbuild env
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: /var/tmp/osbuild-test-store
         key: no-key-needed-here
@@ -136,7 +157,7 @@ jobs:
         # podman needs (parts of) the environment but will break when
         # XDG_RUNTIME_DIR is set.
         # TODO: figure out what exactly podman needs
-        sudo -E XDG_RUNTIME_DIR= pytest-3 --basetemp=/mnt/var/tmp/bib-tests
+        sudo -E XDG_RUNTIME_DIR= PYTHONPATH=. pytest-3 --basetemp=/mnt/var/tmp/bib-tests ${{ matrix.test_file }}
     - name: Diskspace (after)
       if: ${{ always() }}
       run: |