Add boot test infrastructure using osbuild/images library (HMS-10336)

[thozza]

Marked as draft until osbuild/images#2335 is merged.

Add end-to-end boot testing for derived bootc container images by reusing the existing test tooling from the osbuild/images repository. Instead of building custom test infrastructure, the pipeline clones the images library at a pinned commit, builds disk images using its cmd/build tool, and validates them with its boot-image script. A Python-based CI generator produces the GitLab CI configuration from a declarative test matrix, keeping job definitions maintainable as new image types and distros are added.

Note that the images library does not yet support boot-testing all image types - notably qcow2 on aarch64 and GCP images. For those, the pipeline still builds the container and disk images (validating the build succeeds), but skips the boot validation step. Once the images library gains boot-test support for these types, it will be automatically picked up when the Schutzfile ref is updated.

Architectural Changes

The test pipeline is split into four composable shell scripts (setup.sh → get-container.sh → build.sh → boot.sh), each handling one stage of the build-and-boot flow. This separation allows swapping the container source (e.g., from a local build to a registry pull) without touching the build or boot logic.

The GitLab CI configuration is generated from test/config.yml by test/generate_ci.py rather than hand-maintained. The generator parses Containerfile COPY directives to produce per-job change detection rules, so CI jobs only run when relevant files change. A GitHub Actions staleness check enforces that the committed .gitlab-ci.yml stays in sync with the generator output.

Key Changes

• Pin the osbuild/images library via Schutzfile and delegate setup, dependency installation, and boot validation to its scripts
• Add shell pipeline: get-container.sh (podman build), build.sh (disk image via cmd/build + info.json for boot-image), boot.sh (delegates to boot-image)
• Add Python CI generator that reads test/config.yml, parses Containerfile COPY sources for change detection rules, and emits .gitlab-ci.yml
• Support per-containerfile runner overrides, RHEL subscription, and Red Hat registry login as config-driven CI variables
• Add GitHub Actions workflows: staleness check for generated CI config, weekly Schutzfile ref update with auto-PR
• Fix stream10-installer and rhel-10-installer to use containers-storage transport for the bootc payload, and add fuse-overlayfs for overlay-on-overlay support

Breaking Changes

This PR is fully backward compatible.

Testing

• 29 unit tests cover the CI generator: COPY directive parsing (single-source, multi-source, heredoc skip, ${TARGETARCH} substitution, error cases), change rule construction, job building, and end-to-end config generation
• GitHub Actions staleness check regenerates .gitlab-ci.yml on every PR to main and fails if the committed file diverges from the generator output
• Boot tests themselves run in GitLab CI on Fedora runners (AWS for cloud image types, OpenStack for image types requiring nested virtualization)

[lzap]

COPY verb supports various arguments, this is not captured here which is fine - we do not use it AFAIK. However, this will silently ignore them which is dangerous.

[thozza]

Thanks. I've added a detection logic to the generator and it produces hard failure.

[lzap]

Why this only cares about directories and not files? Like COPY file1 /file1.

This is very fragile, if there is a bug here or we add something that is not covered, this will be painful to figure out.

[thozza]

The generator now handles files and directories. The original version was handling only the bare minimum currently used by the Containerfiles in this repo.

[lzap]

Tests makes assumptions we can possibly break in the future making tests to pass incorrectly. If we are doing this, let's write some validator/linter that will enforce these, for example:

• No COPY rule can contain arguments.
• All COPY rules only copy directories.