[skip-ci] TMT: system tests

This commit introduces TMT test jobs triggered via packit to run system
tests on testing-farm infrastructure. Tests are run for all active
Fedora and CentOS Stream environments for aarch64 and x86_64. The same
test plan will be reused by Fedora for bodhi, zuul and fedora-ci gating
tests. Packit will handle syncing of test plan and sources from upstream
to downstream.

Jobs will be selectively triggered for `main` v/s release branches based
on the `release` PR label. The GHA for labeling PRs has also been
updated in this commit.

Test jobs on the main branch will include builds from the
`rhcontainerbot/podman-next` copr while tests on release branches will
only include official distro packages.

Signed-off-by: Lokesh Mandvekar <[email protected]>

.github/labeler.yml

@@ -6,3 +6,5 @@ kind/api-change:
 machine:
   - changed-files:
     - any-glob-to-any-file: pkg/machine/**
+release:
+  - base-branch: [^v?(0|[1-9]\d*).(0|[1-9]\d*)$]

.packit.yaml

@@ -5,6 +5,23 @@
 downstream_package_name: podman
 upstream_tag_template: v{version}
 
+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: rpm/gating.yaml
+    dest: gating.yaml
+    delete: true
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
 packages:
   podman-fedora:
     pkg_tool: fedpkg
@@ -31,7 +48,7 @@ jobs:
       failure_comment:
         message: "Ephemeral COPR build failed. @containers/packit-build please check."
     enable_net: true
-    targets:
+    targets: &fedora_copr_targets
       - fedora-all-x86_64
       - fedora-all-aarch64
 
@@ -53,7 +70,7 @@ jobs:
     packages: [podman-centos]
     notifications: *packit_build_failure_notification
     enable_net: true
-    targets:
+    targets: &centos_copr_targets
       - centos-stream-9-x86_64
       - centos-stream-9-aarch64
       - centos-stream-10-x86_64
@@ -71,6 +88,55 @@ jobs:
     project: podman-next
     enable_net: true
 
+  - job: tests
+    trigger: pull_request
+    packages: [podman-fedora]
+    targets: *fedora_copr_targets
+    require: &dev_tests
+      label:
+        absent:
+          - release
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
+    identifier: "dev"
+
+  - job: tests
+    trigger: pull_request
+    packages: [podman-fedora]
+    targets: *fedora_copr_targets
+    require: &release_tests
+      label:
+        present:
+          - release
+    preserve_project: true
+    identifier: "release"
+
+  # FIXME: Enable centos stream tests after containers-common is fixed
+  # FIXME: centos stream 10 currently also lacks bats
+  # https://bugzilla.redhat.com/show_bug.cgi?id=2329315
+  - job: tests
+    trigger: ignore
+    packages: [podman-centos]
+    targets: *centos_copr_targets
+    require: *dev_tests
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
+    identifier: "dev"
+
+  - job: tests
+    trigger: ignore
+    packages: [podman-centos]
+    targets: *centos_copr_targets
+    require: *release_tests
+    preserve_project: true
+    identifier: "release"
+
   - job: tests
     identifier: cockpit-revdeps
     trigger: pull_request

plans/podman.fmf

@@ -0,0 +1,31 @@
+discover:
+    how: fmf
+execute:
+    how: tmt
+environment:
+    PODMAN: /usr/bin/podman
+    PODMAN_REMOTE: /usr/bin/podman-remote
+    PODMAN_TESTING: /usr/bin/podman-testing
+    QUADLET: /usr/libexec/podman/quadlet
+adjust:
+    when: "initiator == packit"
+    because: "We need to test with updated packages from rhcontainerbot/podman-net copr"
+    prepare+:
+        how: shell
+        script: sed -i -n '/^priority=/!p;$apriority=5' /etc/yum.repos.d/*:rhcontainerbot:podman-next.repo
+
+/upstream:
+    summary: Run tests on upstream PRs
+    discover+:
+        filter: tag:upstream
+    adjust+:
+        enabled: false
+        when: revdeps == yes or initiator is not defined or initiator != packit
+
+/downstream:
+    summary: Run tests on bodhi / errata and dist-git PRs
+    discover+:
+        filter: tag:downstream
+    adjust+:
+        enabled: false
+        when: initiator == packit

rpm/gating.yaml

@@ -0,0 +1,17 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts:
+  - bodhi_update_push_stable
+  - bodhi_update_push_testing
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
+# recipients: jnovy, lsm5, santiago
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

rpm/podman.spec

@@ -11,6 +11,8 @@
 
 %if %{defined fedora}
 %define build_with_btrfs 1
+# No machine stuff for rhel
+%define machine 1
 %endif
 
 %if %{defined copr_username}

test/tmt/setup.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+uname -r
+
+if [[ $(rpm --eval '%{?fedora}') != '' ]]; then
+    export ROOTLESS_USER="fedora"
+else
+    export ROOTLESS_USER="ec2-user"
+fi
+
+loginctl enable-linger "$ROOTLESS_USER"
+
+rm -rf /home/$ROOTLESS_USER/.local/share/containers
+
+rpm -q \
+    aardvark-dns \
+    buildah \
+    conmon \
+    container-selinux \
+    containers-common \
+    crun \
+    netavark \
+    passt \
+    podman \
+    podman-tests \
+    skopeo \
+    slirp4netns \
+    systemd

test/tmt/system-test.fmf

@@ -0,0 +1,43 @@
+require:
+    - bats
+    - golang
+    - make
+    - podman
+    - podman-remote
+    - podman-tests
+    - slirp4netns
+
+environment:
+    PODMAN: /usr/bin/podman
+    PODMAN_TESTING: /usr/bin/podman-testing
+    QUADLET: /usr/libexec/podman/quadlet
+
+/local-root:
+    tag: [ downstream, upstream ]
+    summary: local rootful test
+    test: bash ./system-test.sh
+    duration: 60m
+
+/local-rootless:
+    tag: [ downstream, upstream ]
+    summary: rootless test
+    test: bash ./system-test.sh rootless
+    duration: 60m
+
+/remote-root:
+    tag: [ downstream, upstream ]
+    summary: remote rootful test
+    test: bash ./system-test.sh
+    duration: 60m
+    adjust+:
+        environment+:
+            PODMAN: /usr/bin/podman-remote
+
+/remote-rootless:
+    tag: [ downstream, upstream ]
+    summary: remote rootless test
+    test: bash ./system-test.sh rootless
+    duration: 60m
+    adjust+:
+        environment+:
+            PODMAN: /usr/bin/podman-remote

test/tmt/system-test.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+. setup.sh
+
+export test_cmd="whoami && cd /usr/share/podman/test/system && bats ."
+
+if [[ $1 == "rootless" ]]; then
+    su --whitelist-environment=$(cat ./tmt-envvars | tr '\n' ',') - "$ROOTLESS_USER" -c "eval $test_cmd"
+else
+    eval $test_cmd
+fi

test/tmt/tmt-envvars

@@ -0,0 +1,19 @@
+TMT_TREE
+TMT_PLAN_DATA
+TMT_VERSION
+TMT_TEST_NAME
+TMT_TEST_DATA
+TMT_TEST_SERIAL_NUMBER
+TMT_TEST_ITERATION_ID
+TMT_TEST_METADATA
+TMT_SOURCE_DIR
+TMT_REBOOT_COUNT
+TMT_TEST_RESTART_COUNT
+TMT_TOPOLOGY_BASH
+TMT_TOPOLOGY_YAML
+TMT_TEST_PIDFILE
+TMT_TEST_PIDFILE_LOCK
+TMT_TEST_PIDFILE_ROOT
+PODMAN_TESTING
+QUADLET
+ROOTLESS_USER

test/tmt/toolbox-test.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+. setup.sh
+
+rpm -q containers-common-extra podman toolbox
+
+su --whitelist-environment=$(cat ./tmt-envvars | tr '\n' ',') - "$ROOTLESS_USER" -c "whoami && cd /usr/share/toolbox/test/system && bats ."

test/tmt/toolbox.fmf

@@ -0,0 +1,8 @@
+require:
+    - toolbox-tests
+
+/rootless:
+    tag: [ downstream ]
+    summary: rootless test
+    test: bash ./toolbox-test.sh'
+    duration: 60m