Merge pull request #15 from nova-rey/codex/add-rootfs-ci-harness-workflow

Author: nova-rey

.github/workflows/rootfs-ci.yml

@@ -0,0 +1,74 @@
+name: Screaming Penguin Rootfs CI
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 0"  # Weekly on Sunday at 03:00 UTC
+
+jobs:
+  rootfs:
+    name: Build and Validate Debian Rootfs (Bookworm)
+    runs-on: ubuntu-latest
+
+    env:
+      DEBIAN_FRONTEND: noninteractive
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Show environment info
+        run: |
+          uname -a
+          lsb_release -a || true
+          echo "Shell: $SHELL"
+
+      - name: Install rootfs build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            debootstrap \
+            xz-utils \
+            tar
+
+      - name: Build Debian rootfs (make rootfs)
+        run: |
+          echo "[ROOTFS-CI] Running 'make rootfs' to build Debian Bookworm rootfs…"
+          make rootfs
+          echo "[ROOTFS-CI] Listing dist/ contents:"
+          ls -lh dist || true
+
+      - name: Verify rootfs tarball exists
+        run: |
+          TARBALL="dist/debian-rootfs-bookworm-amd64.tar.gz"
+          echo "[ROOTFS-CI] Checking for tarball: $TARBALL"
+          if [ ! -f "$TARBALL" ]; then
+            echo "[ROOTFS-CI] ERROR: Rootfs tarball not found."
+            exit 1
+          fi
+          if [ ! -s "$TARBALL" ]; then
+            echo "[ROOTFS-CI] ERROR: Rootfs tarball is empty."
+            exit 1
+          fi
+          echo "[ROOTFS-CI] Rootfs tarball found and non-empty."
+
+      - name: Inspect rootfs tarball contents
+        run: |
+          TARBALL="dist/debian-rootfs-bookworm-amd64.tar.gz"
+          echo "[ROOTFS-CI] Inspecting tarball for key files…"
+          tar -tzf "$TARBALL" | head -n 40 || true
+
+          check_path() {
+            local path="$1"
+            if tar -tzf "$TARBALL" | grep -q "^$path"; then
+              echo "[ROOTFS-CI] OK: Found $path"
+            else
+              echo "[ROOTFS-CI] ERROR: Missing required path: $path"
+              exit 1
+            fi
+          }
+
+          check_path "etc/os-release"
+          check_path "bin/sh"
+
+          echo "[ROOTFS-CI] Rootfs content checks passed."

docs/CI_OVERVIEW.md

@@ -113,3 +113,27 @@ The Screaming Penguin CI pipeline provides:
 This combination helps prevent regressions in the installer image and catches errors early, while respecting the unique constraints of an installer-focused repository.
 
 ---
+
+## Rootfs CI Harness (Phase 4 Optional)
+
+A separate CI workflow validates the Debian rootfs builder:
+
+- **Workflow file:** `.github/workflows/rootfs-ci.yml`
+- **Triggers:**
+  - Manual (`workflow_dispatch`)
+  - Weekly cron schedule (`0 3 * * 0`)
+
+The rootfs CI job:
+
+1. Installs `debootstrap` and related tools on the CI runner.
+2. Runs `make rootfs` to build the Debian Bookworm (amd64) root filesystem.
+3. Verifies that the expected tarball exists and is non-empty:
+   - `dist/debian-rootfs-bookworm-amd64.tar.gz`
+4. Inspects the tarball contents and asserts the presence of:
+   - `etc/os-release`
+   - `bin/sh`
+
+This workflow does not run on every push or pull request to avoid
+overloading Debian mirrors and to keep PR latency low. It is intended
+for periodic validation of the rootfs builder and can be triggered
+manually when needed.

docs/SP_BIBLE.md

@@ -67,3 +67,15 @@ under build/ and packages it into a versioned tarball under dist/. Safety
 constraints are enforced: no host system modification and no real block device
 access. Documentation updated to describe the implemented pipeline.
 
+
+## Entry 008 — Rootfs CI Harness Added
+
+**Date:** 2025-11-16
+
+Added a dedicated GitHub Actions workflow for the Debian rootfs builder.
+The `rootfs-ci` workflow can be triggered manually or on a weekly schedule.
+It installs debootstrap, runs `make rootfs` to produce
+`dist/debian-rootfs-bookworm-amd64.tar.gz`, and verifies that the tarball
+exists, is non-empty, and contains key files such as etc/os-release and bin/sh.
+This CI job does not run on every push or pull request and is intended as a
+periodic validation of the rootfs bakery.