Fork Sync

.github/labeler.yml

@@ -0,0 +1,8 @@
+"5.21 LTS":
+- base-branch: '^5\.21-.+$'
+
+"5.0 LTS":
+- base-branch: '^5\.0-.+$'
+
+"4.0 LTS":
+- base-branch: '^4\.0-.+$'

.github/workflows/builds.yml

@@ -1,6 +1,5 @@
 name: Builds
 on:
-  pull_request:
   push:
     branches:
       - latest-candidate
@@ -9,72 +8,37 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
-  lxd-migrate:
-    name: Test lxd-migrate build
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.20.x
-
-      - name: Test lxd-migrate build
-        run: |
-          set -eux
-          cd ~/work/lxd-pkg-snap/lxd-pkg-snap/lxd-migrate
-          CGO_ENABLED=0 go build -v -tags netgo
-
   snap:
     name: Trigger snap build
-    runs-on: ubuntu-22.04
-    needs: lxd-migrate
-    if: ${{ github.repository == 'canonical/lxd-pkg-snap' && github.event_name == 'push' && github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-24.04
+    if: ${{ github.repository == 'canonical/lxd-pkg-snap' && github.actor != 'dependabot[bot]' }}
+    env:
+      SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+      PACKAGE: "lxd"
+      REPO: "git+ssh://lxdbot@git.launchpad.net/~lxd-snap/lxd"
+      BRANCH: ${{ github.ref_name }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Setup Launchpad SSH access
-        env:
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          LAUNCHPAD_LXD_BOT_KEY: ${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}
-        run: |
-          ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
-          ssh-add - <<< "${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}"
-          mkdir -m 0700 -p ~/.ssh/
-          # In ephemeral environments like GitHub Action runners, relying on TOFU isn't providing any security
-          # so require the key obtained by `ssh-keyscan` to match the expected hash from https://help.launchpad.net/SSHFingerprints
-          ssh-keyscan git.launchpad.net >> ~/.ssh/known_hosts
-          ssh-keygen -qlF git.launchpad.net | grep -xF 'git.launchpad.net RSA SHA256:UNOzlP66WpDuEo34Wgs8mewypV0UzqHLsIFoqwe8dYo'
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Install Go
-        uses: actions/setup-go@v5
+      - uses: canonical/lxd/.github/actions/lp-snap-build@main
         with:
-          go-version: 1.20.x
+          ssh-key: "${{ secrets.LAUNCHPAD_LXD_BOT_KEY}}"
 
       - name: Trigger Launchpad snap build
-        env:
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-          TARGET: ${{ github.ref_name }}
         run: |
-          set -x
-          git config --global user.name "Canonical LXD Bot"
-          git config --global user.email "lxd@lists.canonical.com"
-          localRev=$(git rev-parse HEAD)
-          go install github.com/canonical/lxd-ci/lxd-snapcraft@latest
-          git clone -b "${TARGET}" git+ssh://lxdbot@git.launchpad.net/~canonical-lxd/lxd ~/lxd-pkg-snap-lp
-          originVer=($(lxd-snapcraft -get-version -file snapcraft.yaml))
-          rsync -a --exclude .git --delete . ~/lxd-pkg-snap-lp/
-          cd ~/lxd-pkg-snap-lp
-          lxd-snapcraft -set-version "${originVer[0]}-${localRev:0:7}" -set-source-commit ""
+          set -eux
+          localRev="$(git rev-parse HEAD)"
+          # XXX: `originVer` contains an array with the 2 versions
+          originVer=($(lxd-snapcraft -package "${PACKAGE}" -get-version -file snapcraft.yaml))
+          rsync -a --exclude .git --delete . ~/"${PACKAGE}-pkg-snap-lp"/
+          cd ~/"${PACKAGE}-pkg-snap-lp"
+          lxd-snapcraft -package lxd -set-version "${originVer[0]}-${localRev:0:7}" -set-source-commit ""
           git add --all
-          git commit --all --quiet -s --allow-empty -m "Automatic upstream build (${TARGET})" -m "Upstream commit: ${localRev}"
+          git commit --all --quiet -s --allow-empty -m "Automatic upstream build (${BRANCH})" -m "Upstream commit: ${localRev}"
           git show
           git push --quiet
-

.github/workflows/commits.yml

@@ -6,31 +6,18 @@ permissions:
   contents: read
 
 jobs:
-  dco-check:
-    permissions:
-      pull-requests: read  # for tim-actions/get-pr-commits to get list of commits from the PR
-    name: Signed-off-by (DCO) and branch target
-    runs-on: ubuntu-22.04
+  commits:
+    name: Branch target
+    runs-on: ubuntu-24.04
     steps:
-    - name: Get PR Commits
-      id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@master
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Check that all commits are signed-off
-      uses: tim-actions/dco@master
-      with:
-        commits: ${{ steps.get-pr-commits.outputs.commits }}
-
     - name: Check branch target
       env:
         TARGET: ${{ github.event.pull_request.base.ref }}
         TITLE: ${{ github.event.pull_request.title }}
       if: ${{ github.actor != 'dependabot[bot]' }}
       run: |
-        set -x
-        TARGET_FROM_PR_TITLE="$(echo "${TITLE}" | sed -n 's/.*(\(\(latest\|[0-9]\.[0-9]\)-\(edge\|candidate\)\))$/\1/p')"
+        set -eux
+        TARGET_FROM_PR_TITLE="$(echo "${TITLE}" | sed -n 's/.*(\(\(latest\|[0-9]\+\.[0-9]\+\)-\(edge\|candidate\)\))$/\1/p')"
         if [ -z "${TARGET_FROM_PR_TITLE}" ]; then
           TARGET_FROM_PR_TITLE="latest-edge"
         else

.github/workflows/tests.yml

@@ -0,0 +1,46 @@
+name: Tests
+on:
+  pull_request:
+    paths:
+      - 'snapcraft/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # Make sure bash is always invoked with `-eo pipefail`
+    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
+    shell: bash
+
+jobs:
+  code-tests:
+    name: Code
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          # A non-shallow clone is needed for the Differential ShellCheck
+          fetch-depth: 0
+
+      - name: Require GHA pinning
+        uses: canonical/lxd/.github/actions/require-gha-pinning@main
+
+      - id: ShellCheck
+        name: Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@d965e66ec0b3b2f821f75c8eff9b12442d9a7d1e # v5.5.6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+        if: github.event_name == 'pull_request'
+
+      - name: Upload artifact with ShellCheck defects in SARIF format
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: Differential ShellCheck SARIF
+          path: ${{ steps.ShellCheck.outputs.sarif }}
+        if: github.event_name == 'pull_request'

.gitignore

@@ -4,3 +4,5 @@ snap/
 stage/
 *.snap
 edk2-vars-generator/UEFI/__pycache__/
+.github/dependabot.yml
+renovate.json

README.md

@@ -0,0 +1,23 @@
+# LXD
+
+LXD is a modern, secure and powerful system container and virtual machine manager.
+
+This is the snap packaging repository that is used to build the [LXD snap](https://snapcraft.io/lxd). The LXD repository is available [here](https://github.com/canonical/lxd).
+
+# Build the LXD snap locally
+
+Local build require the LXD snap to be installed as `snapcraft` creates a container to use as build environment. Here's how to do a local build for the native architecture:
+
+```
+snapcraft
+```
+
+# Build the LXD snap on Launchpad
+
+To build the snap for multiple architectures, Launchpad builders can be used.
+
+They are available for various architectures (`amd64`, `armhf`, `arm64`, `ppc64el`, `riscv64` and `s390x`) and you can ask for multiple to be built in parallel. Here's how to build for both `amd64` and `arm64`:
+
+```
+snapcraft remote-build --launchpad-accept-public-upload --build-for amd64,arm64
+```

edk2-vars-generator/UEFI/Qemu.py

@@ -37,7 +37,7 @@ class QemuEfiVariant(enum.Enum):
 
 
 class QemuEfiFlashSize(enum.Enum):
-    DEFAULT = enum.auto
+    DEFAULT = enum.auto()
     SIZE_2MB = enum.auto()
     SIZE_4MB = enum.auto()