ci: port Vagrant Fedora Rawhide test to GitHub Actions

Cirrus CI reports "Failed to start an instance:
FAILED_PRECONDITION: Monthly compute limit exceeded!" making the
Vagrant Fedora Rawhide test unusable.

Replace the Cirrus CI Vagrant-based Fedora Rawhide test with a
Lima VM-based equivalent in GitHub Actions. This follows the same
pattern used by the runc project (lima-vm/lima-actions).

The new vagrant-fedora-rawhide-test job:
- Starts a Lima Fedora VM with KVM acceleration
- Installs the latest vanilla kernel
- Reboots the VM to activate the new kernel
- Runs the fedora-rawhide CI target inside a podman container

The existing fedora-rawhide-test job is kept unchanged as it tests
against rawhide userspace on the host kernel, while the new job
tests against both rawhide userspace and a vanilla Fedora kernel.

Generated with Claude Code (https://claude.ai/code)

Signed-off-by: Adrian Reber <areber@redhat.com>

Author: adrianreber

.cirrus.yml

@@ -48,26 +48,6 @@ task:
   build_script: |
     make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_OPTS="-x zdtm/static/socket-raw"
 
-task:
-  name: Vagrant Fedora Rawhide based test
-  environment:
-    HOME: "/root"
-    CIRRUS_WORKING_DIR: "/tmp/criu"
-
-  compute_engine_instance:
-    image_project: cirrus-images
-    image: family/docker-kvm
-    platform: linux
-    cpu: 4
-    memory: 16G
-    nested_virtualization: true
-
-  setup_script: |
-    contrib/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker
-    sudo kvm-ok
-  build_script: |
-    make -C scripts/ci vagrant-fedora-rawhide
-
 task:
   name: Vagrant Fedora based test (non-root)
   environment:

.github/workflows/ci.yml

@@ -131,6 +131,48 @@ jobs:
       # FIXME: https://github.com/containers/podman/issues/14920
       run: sudo -E XDG_RUNTIME_DIR= make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"
 
+  vagrant-fedora-rawhide-test:
+    name: Vagrant Fedora Rawhide based test
+    needs: [alpine-test]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install Lima
+      uses: lima-vm/lima-actions/setup@v1
+    - name: Cache Lima images
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/lima
+        key: lima-fedora-${{ github.sha }}
+        restore-keys: lima-fedora-
+    - name: Enable KVM
+      run: |
+        sudo apt-get -y install qemu-system-x86
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+          | sudo tee /etc/udev/rules.d/99-kvm.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm
+    - name: Start Fedora VM
+      run: limactl start --plain --name=default --cpus=4 --memory=4 template://fedora
+    - name: Copy source into VM
+      run: |
+        lima sudo mkdir -p /home/criu
+        lima sudo chown "$(lima whoami)" /home/criu
+        limactl copy -r . default:/home/criu
+    - name: Setup VM
+      run: lima sudo /home/criu/scripts/ci/lima-fedora-rawhide.sh setup
+    - name: Reboot VM to activate new kernel
+      run: |
+        limactl stop default
+        limactl start default
+    - name: Show VM info
+      run: |
+        lima uname -a
+        lima cat /proc/cmdline
+    - name: Run tests
+      run: ssh -tt lima-default sudo -i /home/criu/scripts/ci/lima-fedora-rawhide.sh test
+
   gcov-test:
     needs: [alpine-test]
     runs-on: ubuntu-22.04

scripts/ci/lima-fedora-rawhide.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# This script runs inside a Lima Fedora VM to set up and run
+# the Fedora Rawhide based CI tests with a vanilla kernel.
+# It mirrors the logic from vagrant.sh's setup() and fedora-rawhide().
+
+set -e
+set -x
+
+CRIU_DIR="${CRIU_DIR:-/home/criu}"
+
+setup() {
+	# Disable sssd to avoid zdtm test failures in pty04 due to sssd socket
+	systemctl mask sssd
+
+	# Upgrade the kernel to the latest vanilla one
+	dnf -y copr enable @kernel-vanilla/stable
+	# The shellcheck tool misunderstands the "do" to be from a loop
+	# shellcheck disable=SC1010
+	dnf -y do --action=upgrade \* --action=install make podman
+}
+
+test() {
+	# Some tests in the container need selinux to be disabled.
+	# In the container it is not possible to change the state of selinux.
+	# Let's just disable it for this test run completely.
+	setenforce Permissive
+
+	cd "${CRIU_DIR}"
+	make -C scripts/ci fedora-rawhide \
+		CONTAINER_RUNTIME=podman \
+		BUILD_OPTIONS="--security-opt seccomp=unconfined"
+}
+
+"$@"