bootc-ubuntu-setup: Exclude AMD-SEV OVMF on Ubuntu 26.04

.github/scripts/ubuntu-2604-ovmf-smoke.mjs

@@ -0,0 +1,46 @@
+import { spawnSync } from 'node:child_process';
+
+const image = 'quay.io/centos-bootc/centos-bootc:stream10';
+const localImage = 'localhost/bcvk-libvirt-smoke:latest';
+const vmName = process.env.VM_NAME;
+
+function run(command, args, timeout = '2m') {
+  const result = spawnSync('timeout', [
+    '--foreground', '--signal=TERM', '--kill-after=30s', timeout, command, ...args,
+  ], { stdio: 'inherit' });
+  if (result.error || result.status !== 0) {
+    const status = result.status ?? 1;
+    throw Object.assign(
+      new Error(`${command} failed (${result.signal ?? `status ${status}`})`),
+      { status },
+    );
+  }
+}
+
+if (!vmName) throw new Error('VM_NAME must be set');
+
+let failure;
+try {
+  run('podman', ['pull', image], '12m');
+  run('podman', ['tag', image, localImage]);
+  run('bcvk', [
+    'libvirt', 'run', '--connect', 'qemu:///session', '--name', vmName,
+    '--firmware=uefi-insecure', '--disable-tpm', '--ssh-wait',
+    '--memory=2048', '--cpus=2', '--disk-size=12G', localImage,
+  ], '12m');
+  run('bcvk', ['libvirt', 'ssh', '--connect', 'qemu:///session', vmName, '--', 'hostname']);
+  console.log('CentOS Stream 10 bootc guest reached SSH through libvirt');
+} catch (error) {
+  failure = error;
+} finally {
+  try {
+    run('bcvk', ['libvirt', 'rm', '--connect', 'qemu:///session', '--force', vmName]);
+  } catch (error) {
+    console.warn(`Warning: VM cleanup failed: ${error.message}`);
+  }
+}
+
+if (failure) {
+  console.error(`Probe failed: ${failure.message}`);
+  process.exitCode = failure.status;
+}

.github/workflows/test-ubuntu-2604-ovmf.yml

@@ -0,0 +1,46 @@
+name: Test Ubuntu 26.04 generic OVMF selection
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  libvirt:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Run bootc-ubuntu-setup
+        uses: ./bootc-ubuntu-setup
+        with:
+          libvirt: true
+
+      - name: Verify generic OVMF package state
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(dpkg-query -W -f='${db:Status-Abbrev}' ovmf-generic)" = 'ii '
+          test "$(dpkg-query -W -f='${db:Status-Abbrev}' ovmf-amdsev 2>/dev/null || true)" != 'ii '
+          test ! -e /usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
+          for package in qemu-block-extra qemu-system-gui; do
+            test "$(dpkg-query -W -f='${db:Status-Abbrev}' "${package}")" = 'ii '
+            dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' "${package}"
+          done
+          dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' ovmf-generic
+          printf '%s\n' 'ovmf-amdsev is absent and its AMD-SEV descriptor is absent'
+
+      - name: Check OVMF smoke script syntax
+        run: node --check .github/scripts/ubuntu-2604-ovmf-smoke.mjs
+
+      - name: Probe CentOS Stream 10 libvirt conversion and SSH
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          RUST_LOG: bcvk=debug
+          VM_NAME: actions-ovmf-${{ github.run_id }}
+        run: node .github/scripts/ubuntu-2604-ovmf-smoke.mjs

bootc-ubuntu-setup/action.yml

@@ -123,10 +123,23 @@ runs:
       shell: bash
       run: |
         set -xeuo pipefail
+        idv=$(. /usr/lib/os-release && printf '%s-%s' "$ID" "$VERSION_ID")
+        firmware_packages=()
+        if [ "$idv" = ubuntu-26.04 ]; then
+          # Unsealed bootc tests request bcvk's uefi-insecure mode:
+          # https://github.com/bootc-dev/bootc/blob/12f03a042b868f40ec850c2496babda1d66775d5/crates/xtask/src/bcvk.rs#L113-L120
+          # This becomes a libvirt secure=no firmware request. Resolute's
+          # stateless AMD-SEV descriptor satisfies that request and may win
+          # auto-selection, but without NVRAM it cannot restore the installed
+          # GRUB boot entry. Keep generic OVMF and the other recommendations
+          # while removing that descriptor by excluding its package.
+          # https://libvirt.org/formatdomain.html#guest-firmware
+          firmware_packages=(ovmf-generic ovmf-amdsev-)
+        fi
         # Let libvirt select its QEMU dependency; qemu-kvm has ambiguous
         # providers on Ubuntu 26.04 when requested explicitly.
         # see https://github.com/bootc-dev/bcvk/issues/176
-        /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils virtiofsd libvirt-daemon-system python3-virt-firmware
+        /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils virtiofsd libvirt-daemon-system python3-virt-firmware "${firmware_packages[@]}"
 
     # bcvk requires KVM and v0.19.0 has no arm64 release asset.
     - name: Install bcvk