test: add Kairos Fedora e2e boot validation (#765)

## Summary

- Add a Kairos Fedora e2e harness that builds or reuses the produced OCI
image, generates an installer ISO with AuroraBoot, installs through the
Kairos WebUI over HTTP, then boots the installed disk under QEMU/KVM.
- Verify the installed OS over SSH, including Fedora identity, Kairos
active boot state, K3s node readiness, and failed systemd units.
- Wire the image workflow to run the e2e check before pushing release
images, add a `just e2e-kairos-fedora` entrypoint, and document
local/devcontainer usage.

## Validation

- [Build Kairos-Fedora / run
100](https://github.com/marinatedconcrete/config/actions/runs/27395814468)
passed on commit `3ed000dc673d036f520f28dad4db88ddb3e91dd0`: built the
OCI image, built an installer ISO from it, installed via the Kairos
WebUI HTTP flow under QEMU/KVM, booted the installed disk, verified SSH
access, Fedora identity, Kairos active boot state, K3s node readiness,
and no failed systemd units.
- [Semantic Pull Request / run
1380](https://github.com/marinatedconcrete/config/actions/runs/27395814476)
passed.

## Notes

The e2e harness is designed to run directly in the devcontainer or CI
environment with `/dev/kvm` available. It avoids cidata mounting and
performs the install through the HTTP installer flow so it better
reflects a bare-metal install path while still verifying post-install
SSH connectivity.

Author: robarnold

.devcontainer/Dockerfile

@@ -3,7 +3,12 @@ FROM mcr.microsoft.com/devcontainers/python:3-3.14@sha256:882b17d068262c7af43001
 RUN apt-get update \
     && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends \
+        curl \
         libssh-dev \
+        openssh-client \
+        ovmf \
+        qemu-system-x86 \
+        qemu-utils \
         shellcheck \
         yq \
     && apt-get clean \

.github/workflows/image-kairos-fedora.yml

@@ -6,20 +6,25 @@ on: # yamllint disable-line rule:truthy
     branches:
       - main
     paths:
+      - .devcontainer/Dockerfile
       - .github/workflows/image-kairos-fedora.yml
       - images/kairos-fedora/**
+      - justfile
     tags:
       - kairos-fedora-*
   pull_request:
     branches:
       - main
     paths:
+      - .devcontainer/Dockerfile
       - .github/workflows/image-kairos-fedora.yml
       - images/kairos-fedora/**
+      - justfile
 
 jobs:
   build-container:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
     permissions:
       contents: read
       packages: write
@@ -36,7 +41,7 @@ jobs:
       # Note: this must start with a number for the build to work correctly!
       - name: Compute Version Tag
         env:
-          BRANCH: ${{ github.ref_type == 'tag' && github.ref_name || github.event_name != 'pull_request' && format('{0}.{1}.{2}', github.run_id, github.run_number, github.run_attempt) || format('{0}-pr', github.event.number) }}
+          BRANCH: ${{ github.ref_type == 'tag' && github.ref_name || github.event_name == 'pull_request' && format('{0}-pr', github.event.number) || format('{0}.{1}.{2}', github.run_id, github.run_number, github.run_attempt) }}
         id: version_tag
         run: echo "tag=$BRANCH" | sed -e 's/kairos-fedora-//' >> "$GITHUB_OUTPUT"
       - name: Generate Metadata
@@ -52,5 +57,34 @@ jobs:
           context: images/kairos-fedora
           file: images/kairos-fedora/Containerfile
           labels: ${{ steps.metadata.outputs.labels }}
-          push: ${{ github.ref_type == 'tag' }}
+          load: true
+          push: false
           tags: ghcr.io/${{ github.repository_owner }}/kairos-fedora:${{ steps.version_tag.outputs.tag }}
+      - name: Install E2E Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes curl openssh-client ovmf qemu-system-x86 qemu-utils
+      - name: Enable KVM Access
+        run: |
+          test -e /dev/kvm
+          sudo chmod a+rw /dev/kvm
+          test -r /dev/kvm
+          test -w /dev/kvm
+          ls -l /dev/kvm
+      - name: Run Kairos Fedora E2E
+        env:
+          KAIROS_IMAGE: ghcr.io/${{ github.repository_owner }}/kairos-fedora:${{ steps.version_tag.outputs.tag }}
+        run: bash images/kairos-fedora/e2e.sh
+      - name: Upload E2E Logs
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: kairos-fedora-e2e
+          path: |
+            build/e2e/kairos-fedora/install-cloud-config.yaml
+            build/e2e/kairos-fedora/id_ed25519.pub
+            build/e2e/kairos-fedora/logs
+          if-no-files-found: ignore
+      - name: Push Image
+        if: github.ref_type == 'tag'
+        run: docker push ghcr.io/${{ github.repository_owner }}/kairos-fedora:${{ steps.version_tag.outputs.tag }}

images/kairos-fedora/README.md

@@ -1,4 +1,36 @@
 # Marinated Concrete's Custom Fedora-Based Kairos Image
 
-This utilizes the [Kairos Factory](https://kairos.io/docs/reference/kairos-factory/) to produce our very own custom
-image!
+This utilizes the [Kairos Factory](https://kairos.io/docs/reference/kairos-factory/) to produce our very own custom image.
+
+## End-to-End Boot Test
+
+Run the e2e test from the devcontainer:
+
+```sh
+just e2e-kairos-fedora
+```
+
+The devcontainer includes QEMU, OVMF, Docker, and SSH client tooling, so the test runs directly in the current environment. It requires `/dev/kvm` to be present and readable/writable by the container user.
+
+The harness validates the same path a bare-metal install uses:
+
+1. Build or reuse the Kairos Fedora OCI image.
+2. Generate an installer ISO from that OCI image with AuroraBoot.
+3. Boot the installer ISO in QEMU.
+4. Submit the install through the Kairos WebUI on port 8080.
+5. Power off, detach the ISO, boot from the installed disk, and verify the OS over SSH.
+
+By default, `just e2e-kairos-fedora` builds `images/kairos-fedora/Containerfile` locally as `kairos-fedora:0.0.0-e2e`. Set `KAIROS_IMAGE` to test a specific image ref that already exists in Docker or can be pulled by AuroraBoot:
+
+```sh
+KAIROS_IMAGE=ghcr.io/marinatedconcrete/kairos-fedora:0.8.1 just e2e-kairos-fedora
+```
+
+Useful overrides:
+
+- `KAIROS_IMAGE`: OCI image ref to convert into an installer ISO.
+- `KAIROS_ISO`: existing ISO path for debugging the boot/install path without regenerating media.
+- `E2E_WORKDIR`: artifact and log directory, default `build/e2e/kairos-fedora`.
+- `E2E_INSTALL_TIMEOUT`, `E2E_BOOT_TIMEOUT`, `E2E_K3S_TIMEOUT`: timeout overrides.
+
+The CI workflow runs the same script after building the image into the local Docker daemon. On release tags, the workflow pushes the image only after the e2e test passes.