NQRust-MicroVM/.github/workflows/test-installer.yml at main · NexusQuantum/NQRust-MicroVM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: Test Installer

# Verifies the installer binary builds and its non-interactive entry
# point is reachable. Skips full systemd / postgres / KVM provisioning
# because GitHub Actions containers don't have systemd init and can't
# load KVM modules — those paths are exercised in the KubeVirt-based
# integration suite (infra/test/*-runner.sh) and during release on the
# self-hosted runner instead.

on:
  push:
    branches: [main]
    paths:
      - 'apps/installer/**'
      - 'scripts/install/**'
      - '.github/workflows/test-installer.yml'
  pull_request:
    paths:
      - 'apps/installer/**'
      - 'scripts/install/**'
  workflow_dispatch:

jobs:
  build-and-cli:
    name: Build installer + CLI surface
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-installer-${{ hashFiles('**/Cargo.lock') }}

      - name: Build installer (release)
        run: cargo build --release -p nqr-installer

      - name: Verify --help renders
        run: ./target/release/nqr-installer --help

      - name: Verify `install --help` lists --non-interactive
        run: |
          ./target/release/nqr-installer install --help | tee /tmp/install-help.txt
          grep -q -- "--non-interactive" /tmp/install-help.txt

      - name: Verify `uninstall --help` lists --non-interactive
        run: |
          ./target/release/nqr-installer uninstall --help | tee /tmp/uninstall-help.txt
          grep -q -- "--non-interactive" /tmp/uninstall-help.txt

      - name: Verify non-interactive entry point is real (not stub)
        # The previous stub printed exactly "Non-interactive installation
        # not yet implemented" and exited 0. Run with --non-interactive
        # against /tmp paths as a non-root user — it must reject with the
        # root requirement, NOT silently succeed with the stub message.
        run: |
          set +e
          out=$(./target/release/nqr-installer install \
            --non-interactive \
            --mode production \
            --network-mode nat \
            --install-dir /tmp/nqrust-test/opt \
            --data-dir /tmp/nqrust-test/data \
            --config-dir /tmp/nqrust-test/etc \
            2>&1)
          rc=$?
          echo "$out"
          if echo "$out" | grep -q "not yet implemented"; then
            echo "::error::non-interactive stub is still present"
            exit 1
          fi
          if echo "$out" | grep -qi "must be run as root"; then
            echo "ok: rejects non-root, real code path"
            exit 0
          fi
          echo "::error::unexpected output (rc=$rc); expected root requirement"
          exit 1

  shell-scripts:
    name: Install shell scripts parse + shellcheck
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - name: Install shellcheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: bash -n syntax check
        run: |
          for f in scripts/install/install.sh scripts/install/uninstall.sh scripts/install/lib/*.sh; do
            bash -n "$f"
            echo "OK syntax: $f"
          done

      - name: shellcheck (informational)
        # ShellCheck is advisory here — the scripts are long-lived and
        # carry warnings that aren't worth blocking CI on. Run with
        # SC2034/SC2154 disabled (we have many sourced libraries) and
        # only fail on hard errors.
        run: |
          shellcheck \
            --severity=error \
            --shell=bash \
            scripts/install/install.sh \
            scripts/install/uninstall.sh \
            scripts/install/lib/*.sh