Automated (unattended) installation from a YAML answer file

.github/actions/vm-setup/action.yml

@@ -0,0 +1,105 @@
+name: VM test setup
+description: >
+  Enable KVM, install QEMU/OVMF/swtpm and ISO tooling, fetch the pinned
+  LMDE ISO (cached), and build the dev ISO with the working-tree
+  installer. Leaves fixtures/lmde-7-dev.iso ready for run_scenario.py.
+
+inputs:
+  iso-name:
+    description: Base ISO filename under tests/integration/fixtures
+    default: lmde-7-cinnamon-64bit.iso
+  iso-url:
+    description: Download URL for the base ISO
+    default: https://mirrors.kernel.org/linuxmint/debian/lmde-7-cinnamon-64bit.iso
+
+runs:
+  using: composite
+  steps:
+    - name: Free up disk space
+      shell: bash
+      run: |
+        # The PXE scenario unsquashfs's the full desktop rootfs (~8GB) to
+        # merge our code in; reclaim space the runner image spends on toolsets
+        # we don't use so it fits. Best-effort, never fails the job.
+        df -h / | tail -1
+        sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \
+          /usr/local/.ghcup /usr/local/share/powershell || true
+        df -h / | tail -1
+
+    - name: Enable KVM for the runner user
+      shell: bash
+      run: |
+        echo "=== KVM diagnostics ==="
+        echo "cpu virt flags: $(grep -c -E 'vmx|svm' /proc/cpuinfo) cores"
+        ls -l /dev/kvm 2>&1 || echo "/dev/kvm absent"
+        # The udev rule persists the permission; the direct chmod applies
+        # it synchronously so there is no race with the next step (the
+        # udev trigger is asynchronous and `test -w` can run before it).
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+          | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm || true
+        sudo chmod 0666 /dev/kvm
+        ls -l /dev/kvm
+        test -w /dev/kvm && echo "KVM is writable" \
+          || { echo "KVM NOT available — hosted runner lacks hardware virtualization"; exit 1; }
+
+    - name: Install QEMU, OVMF, swtpm and ISO tooling
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends \
+          qemu-system-x86 qemu-utils ovmf swtpm swtpm-tools \
+          squashfs-tools xorriso openssh-client
+
+    - name: Install Python deps for the harness
+      shell: bash
+      run: pip install pyyaml
+
+    # UEFI PXE needs an EFI boot binary (OVMF can't run a raw iPXE script the
+    # way the BIOS NIC option ROM does). Build ipxe.efi once, with an embedded
+    # script that chainloads the per-run boot.ipxe over TFTP — so the EFI
+    # binary itself is static and cacheable while the real boot script stays
+    # dynamic. Bump the cache key when the embedded script changes.
+    - name: Cache iPXE EFI binary
+      id: ipxe-cache
+      uses: actions/cache@v5
+      with:
+        path: tests/integration/fixtures/ipxe.efi
+        key: ipxe-efi-chain-v1
+
+    - name: Build iPXE EFI for UEFI netboot
+      if: steps.ipxe-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        sudo apt-get install -y --no-install-recommends \
+          build-essential liblzma-dev git
+        git clone --depth 1 https://github.com/ipxe/ipxe.git /tmp/ipxe
+        printf '#!ipxe\ndhcp\nchain tftp://${next-server}/boot.ipxe\n' \
+          > /tmp/embed.ipxe
+        make -C /tmp/ipxe/src -j"$(nproc)" bin-x86_64-efi/ipxe.efi \
+          EMBED=/tmp/embed.ipxe
+        mkdir -p tests/integration/fixtures
+        cp /tmp/ipxe/src/bin-x86_64-efi/ipxe.efi \
+          tests/integration/fixtures/ipxe.efi
+
+    - name: Cache the base ISO
+      id: iso-cache
+      uses: actions/cache@v5
+      with:
+        path: tests/integration/fixtures/${{ inputs.iso-name }}
+        key: lmde-iso-${{ inputs.iso-name }}
+
+    - name: Download and verify the base ISO
+      if: steps.iso-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        mkdir -p tests/integration/fixtures
+        cd tests/integration/fixtures
+        curl -sLO https://mirrors.kernel.org/linuxmint/debian/sha256sum.txt
+        curl -sLo "${{ inputs.iso-name }}" "${{ inputs.iso-url }}"
+        sha256sum -c <(grep "${{ inputs.iso-name }}" sha256sum.txt)
+
+    - name: Build the dev ISO
+      shell: bash
+      run: python tests/integration/harness/make_test_iso.py

.github/workflows/integration-tests.yml

@@ -0,0 +1,90 @@
+name: integration tests
+
+# Boots real VMs and performs full unattended installs — slow and
+# KVM-dependent, so it runs nightly and on demand rather than per-push.
+on:
+  schedule:
+    - cron: "0 4 * * *"   # 04:00 UTC nightly
+  workflow_dispatch:
+    inputs:
+      scenarios:
+        description: "Space-separated scenario names (default: all)"
+        required: false
+        default: ""
+
+# A newer run supersedes an in-flight one on the same ref (these are
+# expensive; don't pile them up).
+concurrency:
+  group: integration-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Fast gate: the failure-mode scenarios abort in ~2 min and need no
+  # successful install, so they run first and block the slow matrix.
+  failure-modes:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/vm-setup
+      - name: Run failure-mode scenarios
+        run: |
+          for s in fail-malformed-yaml fail-no-disk-match fail-bios-grub-on-uefi fail-snapshots-on-ext4; do
+            python tests/integration/harness/run_scenario.py \
+              "tests/integration/scenarios/$s.yaml" \
+              --junit "tests/integration/.work/$s.xml"
+          done
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: failure-mode-results
+          path: tests/integration/.work/*.xml
+
+  install-scenarios:
+    needs: failure-modes
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        scenario: [bios-simple, uefi-simple, uefi-lvm, uefi-lvm-luks, bios-multi-disk, pxe-simple, pxe-uefi-simple, netboot-ipv6-simple, custom-uefi, custom-btrfs, static-network, uefi-luks-prompt, raid1-bios, raid5-lvm-bios, flatpak]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Skip if not selected
+        id: gate
+        run: |
+          sel="${{ github.event.inputs.scenarios }}"
+          if [ -n "$sel" ] && ! echo "$sel" | grep -qw "${{ matrix.scenario }}"; then
+            echo "run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: ./.github/actions/vm-setup
+        if: steps.gate.outputs.run == 'true'
+
+      - name: Run ${{ matrix.scenario }}
+        if: steps.gate.outputs.run == 'true'
+        run: |
+          python tests/integration/harness/run_scenario.py \
+            "tests/integration/scenarios/${{ matrix.scenario }}.yaml" \
+            --keep \
+            --junit "tests/integration/.work/${{ matrix.scenario }}.xml"
+
+      - name: Collect serial log on failure
+        if: failure() && steps.gate.outputs.run == 'true'
+        run: |
+          mkdir -p artifacts
+          cp "tests/integration/.work/${{ matrix.scenario }}/${{ matrix.scenario }}-serial.log" \
+            "artifacts/${{ matrix.scenario }}-serial.log" || true
+          cp tests/integration/.work/*.xml artifacts/ || true
+
+      - uses: actions/upload-artifact@v7
+        if: always() && steps.gate.outputs.run == 'true'
+        with:
+          name: ${{ matrix.scenario }}-results
+          path: |
+            tests/integration/.work/${{ matrix.scenario }}.xml
+            artifacts/
+          if-no-files-found: ignore

.github/workflows/nfs-tests.yml

@@ -0,0 +1,34 @@
+name: nfs tests
+
+# Stands up a real NFS server on the runner and fetches an answer file through
+# the installer's actual nfs:// transport over the full matrix of protocol
+# version (v3, v4.2) x address form (IPv4, IPv6, hostname). Cheap enough
+# (~2 min) to run per push for fast feedback.
+on:
+  push:
+    branches: [automated-install]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  nfs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r tests/requirements-test.txt
+
+      - name: Provision NFS server (v3 + v4.2, IPv4/IPv6/hostname)
+        run: bash tests/nfs/setup-nfs-server.sh
+
+      - name: Run real NFS transport tests
+        # mount(2) needs root, so run pytest under sudo with the same Python
+        # (its site-packages already hold the installed test deps).
+        run: sudo env LI_NFS_TEST=1 "$(command -v python)" -m pytest tests/nfs -v

.github/workflows/unit-tests.yml

@@ -0,0 +1,28 @@
+name: unit tests
+
+on:
+  push:
+    branches: [master, automated-install]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install test dependencies
+        run: pip install -r tests/requirements-test.txt
+
+      - name: Run unit tests
+        run: pytest tests/unit -v

.gitignore

@@ -3,4 +3,11 @@ debian/*debhelper*
 debian/files
 debian/*substvar*
 *interface.ui~
-usr/share/locale/*
+usr/share/locale/*
+__pycache__/
+*.pyc
+.pytest_cache/
+.venv/
+tests/integration/fixtures/*.iso
+tests/integration/fixtures/sha256sum.txt
+tests/integration/.work/