fix: apply 'ro' flag to iso9660 filesystems #9818

Workflow file for this run

	# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
	#
	# Generated on 2025-09-11T01:41:29Z by kres ba56673-dirty.

	concurrency:
	group: ${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true
	"on":
	push:
	branches:
	- main
	- release-*
	tags:
	- v*
	pull_request:
	branches:
	- main
	- release-*
	name: default
	jobs:
	base-lint:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: lint
	run: \|
	make lint
	base-unit-tests:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: unit-tests
	run: \|
	make unit-tests
	- name: unit-tests-fips
	run: \|
	make unit-tests-fips
	- name: unit-tests-race
	run: \|
	make unit-tests-race
	- name: coverage
	uses: codecov/codecov-action@v5
	with:
	files: _out/coverage.txt
	token: ${{ secrets.CODECOV_TOKEN }}
	timeout-minutes: 3
	default:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && github.event_name == 'pull_request'
	outputs:
	labels: ${{ steps.retrieve-pr-labels.outputs.result }}
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: external-artifacts
	run: \|
	make external-artifacts
	- name: generate
	run: \|
	make generate docs
	- name: uki-certs
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: check-dirty
	run: \|
	make check-dirty
	- name: build
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	run: \|
	make talosctl-cni-bundle
	- name: sbom
	run: \|
	make sbom
	- name: iso
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	run: \|
	make iso secureboot-iso
	- name: images-essential
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: Generate executable list
	run: \|
	find _out -type f -executable > _out/executable-artifacts
	- name: save artifacts
	uses: actions/upload-artifact@v4
	with:
	name: talos-artifacts
	path: \|
	_out
	retention-days: "5"
	- name: Retrieve PR labels
	id: retrieve-pr-labels
	uses: actions/github-script@v7
	with:
	retries: "3"
	script: \|
	if (context.eventName != "pull_request") { return "[]" }

	const resp = await github.rest.issues.get({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	})

	return resp.data.labels.map(label => label.name)
	e2e-docker-short:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: e2e-docker
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	run: \|
	make e2e-docker
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-e2e-docker-short
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	e2e-iso:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: e2e-iso
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	sudo -E make e2e-iso
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-e2e-iso
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	e2e-qemu-short:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	run: \|
	make ci-temp-release-tag
	- name: e2e-qemu
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-short
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-e2e-qemu-short
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	grype-scan:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: local-grype-scan-result
	env:
	DEST: _out
	run: \|
	make local-grype-scan-result
	- name: target-grype-validate
	run: \|
	make target-grype-validate
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-grype-scan-result
	path: \|
	_out/grype-scan.log
	retention-days: "5"
	integration-aws:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: image-aws
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-aws
	- name: e2e-aws-prepare
	env:
	E2E_AWS_TARGET: default
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make e2e-aws-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-aws
	run: \|
	make e2e-aws
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-aws-nvidia-nonfree-lts:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-nonfree-lts') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-nonfree') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-aws
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-aws
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make nvidia-container-toolkit-lts nonfree-kmod-nvidia-lts extensions-metadata -C _out/extensions
	- name: e2e-aws-prepare
	env:
	E2E_AWS_TARGET: nvidia-nonfree-lts
	EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make e2e-aws-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-aws-nvidia-nonfree-lts
	env:
	EXTRA_TEST_ARGS: -talos.extensions.nvidia
	run: \|
	make e2e-aws
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-aws-nvidia-nonfree-production:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-nonfree-production') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-nonfree') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-aws
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-aws
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make nvidia-container-toolkit-production nonfree-kmod-nvidia-production extensions-metadata -C _out/extensions
	- name: e2e-aws-prepare
	env:
	E2E_AWS_TARGET: nvidia-nonfree-production
	EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make e2e-aws-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-aws-nvidia-nonfree-production
	env:
	EXTRA_TEST_ARGS: -talos.extensions.nvidia
	run: \|
	make e2e-aws
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-aws-nvidia-oss-lts:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-oss-lts') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-oss') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-aws
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-aws
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make nvidia-container-toolkit-lts nvidia-open-gpu-kernel-modules-lts zfs extensions-metadata -C _out/extensions
	- name: e2e-aws-prepare
	env:
	E2E_AWS_TARGET: nvidia-oss-lts
	EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make e2e-aws-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-aws-nvidia-oss-lts
	env:
	EXTRA_TEST_ARGS: -talos.extensions.nvidia -talos.verifyukibooted=false
	run: \|
	make e2e-aws
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-aws-nvidia-oss-production:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-oss-production') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-oss') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-aws
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-aws
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make nvidia-container-toolkit-production nvidia-open-gpu-kernel-modules-production zfs extensions-metadata -C _out/extensions
	- name: e2e-aws-prepare
	env:
	E2E_AWS_TARGET: nvidia-oss-production
	EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make e2e-aws-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-aws-nvidia-oss-production
	env:
	EXTRA_TEST_ARGS: -talos.extensions.nvidia -talos.verifyukibooted=false
	run: \|
	make e2e-aws
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: aws
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-cilium:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/cilium') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-cilium
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/cilium-no-kubeproxy.yaml'
	WITH_CUSTOM_CNI: cilium
	WITH_FIREWALL: accept
	WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-cilium-strict
	env:
	CILIUM_INSTALL_TYPE: strict
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium-strict
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/cilium-kubeproxy.yaml'
	WITH_CUSTOM_CNI: cilium
	WITH_FIREWALL: accept
	WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-cilium-strict-kubespan
	env:
	CILIUM_INSTALL_TYPE: strict
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium-strict-kubespan
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/cilium-kubeproxy.yaml'
	WITH_CUSTOM_CNI: cilium
	WITH_FIREWALL: accept
	WITH_KUBESPAN: "true"
	WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-cilium
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-cloud-images:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/cloud-images')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: images
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images
	- name: cloud-images
	run: \|
	make cloud-images
	integration-conformance:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/conformance') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: conformance-qemu
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-conformance-qemu
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_CPUS_WORKERS: "6"
	QEMU_MEMORY_WORKERS: "4096"
	TEST_MODE: fast-conformance
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-conformance
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-conformance-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/conformance-enforcing')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: conformance-qemu
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-conformance-qemu
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_CPUS_WORKERS: "6"
	QEMU_MEMORY_WORKERS: "4096"
	TAG_SUFFIX_IN: -enforcing
	TEST_MODE: fast-conformance
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-conformance-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-extensions:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/extensions') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: unshallow-extensions
	run: \|
	git -C _out/extensions fetch --prune --unshallow
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make all extensions-metadata -C _out/extensions
	- name: installer extensions
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make installer-with-extensions
	- name: e2e-extensions
	env:
	EXTRA_TEST_ARGS: -talos.extensions.qemu
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-extensions
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "3"
	QEMU_MEMORY_WORKERS: "4096"
	QEMU_WORKERS: "1"
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH_WORKER: '@_out/installer-extensions-patch.yaml:@hack/test/patches/extensions.yaml:@hack/test/patches/dm-raid-module.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-extensions
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-gcp:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/gcp') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: image-gcp
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-gcp
	- name: e2e-gcp-prepare
	run: \|
	make e2e-gcp-prepare
	- name: checkout contrib
	uses: actions/checkout@v5
	with:
	path: _out/contrib
	ref: main
	repository: siderolabs/contrib
	- name: setup tf
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: "false"
	- name: tf apply
	env:
	TF_E2E_ACTION: apply
	TF_E2E_TEST_TYPE: gcp
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	- name: e2e-gcp
	run: \|
	make e2e-gcp
	- name: tf destroy
	if: always()
	env:
	TF_E2E_ACTION: destroy
	TF_E2E_REFRESH_ON_DESTROY: "false"
	TF_E2E_TEST_TYPE: gcp
	TF_SCRIPT_DIR: _out/contrib
	run: \|
	make e2e-cloud-tf
	integration-image-cache:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/image-cache') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-cache
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make cache-create
	- name: e2e-image-cache
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-image-cache
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	REGISTRY_MIRROR_FLAGS: "no"
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	WITH_CONFIG_PATCH: '@hack/test/patches/image-cache.yaml'
	WITH_ISO: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-image-cache
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-image-factory:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/image-factory')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: factory-1.10-iso
	env:
	FACTORY_BOOT_METHOD: iso
	FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE_VERSION: v1.10.4
	FACTORY_VERSION: v1.10.3
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.10-iso
	KUBERNETES_VERSION: 1.33.2
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.10-image
	env:
	FACTORY_BOOT_METHOD: disk-image
	FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE_VERSION: v1.10.4
	FACTORY_VERSION: v1.10.3
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.10-image
	KUBERNETES_VERSION: 1.33.2
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.10-pxe
	env:
	FACTORY_BOOT_METHOD: ipxe
	FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_VERSION: v1.10.4
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.10-pxe
	KUBERNETES_VERSION: 1.33.2
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.10-secureboot
	env:
	FACTORY_BOOT_METHOD: secureboot-iso
	FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE_VERSION: v1.10.4
	FACTORY_VERSION: v1.10.3
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.10-secureboot
	KUBERNETES_VERSION: 1.33.2
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.9-secureboot
	env:
	FACTORY_BOOT_METHOD: secureboot-iso
	FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE_VERSION: v1.9.6
	FACTORY_VERSION: v1.9.5
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.9-secureboot
	KUBERNETES_VERSION: 1.32.6
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.9-iso
	env:
	FACTORY_BOOT_METHOD: iso
	FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE_VERSION: v1.9.6
	FACTORY_VERSION: v1.9.5
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.9-iso
	KUBERNETES_VERSION: 1.32.6
	run: \|
	sudo -E make e2e-image-factory
	- name: factory-1.8-iso
	env:
	FACTORY_BOOT_METHOD: iso
	FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
	FACTORY_UPGRADE: "true"
	FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
	FACTORY_UPGRADE_VERSION: v1.8.4
	FACTORY_VERSION: v1.8.3
	GITHUB_STEP_NAME: ${{ github.job}}-factory-1.8-iso
	KUBERNETES_VERSION: 1.31.10
	run: \|
	sudo -E make e2e-image-factory
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-image-factory
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-images:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: generic
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/images') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images
	integration-misc-0:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-0') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: image-metal-uki
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make image-metal-uki
	- name: e2e-firewall
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-firewall
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_FIREWALL: block
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-canal-reset
	env:
	CUSTOM_CNI_URL: https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/canal.yaml
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-canal-reset
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	INTEGRATION_TEST_RUN: TestIntegration/api.ResetSuite/TestResetWithSpec
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-controlplane-port
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-controlplane-port
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/ephemeral-min-max.yaml'
	WITH_CONTROL_PLANE_PORT: "443"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-uki-4k
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-uki-4k
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_4K_DISK: "true"
	WITH_UKI_BOOT: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-0
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-1:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-1') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-airgapped
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-airgapped
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_AIRGAPPED: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-no-cluster-discovery
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-no-cluster-discovery
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CLUSTER_DISCOVERY: "false"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-kubespan
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-kubespan
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CLUSTER_DISCOVERY: "true"
	WITH_KUBESPAN: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-default-hostname
	env:
	DISABLE_DHCP_HOSTNAME: "true"
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-default-hostname
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-min-requirements
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-min-requirements
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_MEMORY_CONTROLPLANES: "2048"
	QEMU_MEMORY_WORKERS: "1024"
	QEMU_SYSTEM_DISK_SIZE: "10240"
	SHORT_INTEGRATION_TEST: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-1
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	/tmp/airgapped*.log
	retention-days: "5"
	integration-misc-1-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-1-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: e2e-no-cluster-discovery
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-no-cluster-discovery
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_CLUSTER_DISCOVERY: "false"
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-kubespan
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-kubespan
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_CLUSTER_DISCOVERY: "true"
	WITH_ENFORCING: "true"
	WITH_KUBESPAN: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-default-hostname
	env:
	DISABLE_DHCP_HOSTNAME: "true"
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-default-hostname
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	VIA_MAINTENANCE_MODE: "true"
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-min-requirements
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-min-requirements
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_MEMORY_CONTROLPLANES: "2048"
	QEMU_MEMORY_WORKERS: "1024"
	QEMU_SYSTEM_DISK_SIZE: "10240"
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-1-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-2:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-2') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: iso
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	run: \|
	make iso
	- name: images-essential
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: e2e-bios
	env:
	EXTRA_TEST_ARGS: -talos.verifyukibooted=false
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-bios
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_UEFI: "false"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-bios-iso
	env:
	EXTRA_TEST_ARGS: -talos.verifyukibooted=false
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-bios-iso
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	WITH_ISO: "true"
	WITH_UEFI: "false"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-disk-image
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-disk-image
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	USE_DISK_IMAGE: "true"
	VIA_MAINTENANCE_MODE: "true"
	WITH_DISK_ENCRYPTION: "true"
	WITH_JSON_LOGS: "false"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-disk-image-bios
	env:
	EXTRA_TEST_ARGS: -talos.verifyukibooted=false
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-disk-image-bios
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	USE_DISK_IMAGE: "true"
	VIA_MAINTENANCE_MODE: "true"
	WITH_DISK_ENCRYPTION: "true"
	WITH_UEFI: "false"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-node-address-v2
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-disk-image
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/node-address-v2.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-tpm1_2
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-tpm1_2
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_TPM1_2: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-2
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-3:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-3') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-network-chaos
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-network-chaos
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_NETWORK_CHAOS: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-metal-iso
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-metal-iso
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_INJECTION_METHOD: metal-iso
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-iommu-pcidriverrebind
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-iommu-pcidriverrebind
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_IOMMU: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-3
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-3-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-3-enforcing')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: e2e-network-chaos
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-network-chaos
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_ENFORCING: "true"
	WITH_NETWORK_CHAOS: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-metal-iso
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-metal-iso
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_CONFIG_INJECTION_METHOD: metal-iso
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-iommu-pcidriverrebind
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-iommu-pcidriverrebind
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_ENFORCING: "true"
	WITH_IOMMU: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-3-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-4:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-4') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-siderolink
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	WITH_SIDEROLINK_AGENT: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-siderolink-tunnel
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tunnel
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	WITH_SIDEROLINK_AGENT: tunnel
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-siderolink-tls
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tls
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	VIA_MAINTENANCE_MODE: "true"
	WITH_SIDEROLINK_AGENT: wireguard+tls
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-apparmor
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-apparmor
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_APPARMOR_LSM_ENABLED: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-k8s-user-namespace
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-k8s-user-namespace
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH: '@hack/test/patches/usernamespace.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-4
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-misc-4-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/misc-4-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: e2e-siderolink
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	VIA_MAINTENANCE_MODE: "true"
	WITH_ENFORCING: "true"
	WITH_SIDEROLINK_AGENT: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-siderolink-tunnel
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tunnel
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	VIA_MAINTENANCE_MODE: "true"
	WITH_ENFORCING: "true"
	WITH_SIDEROLINK_AGENT: tunnel
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-siderolink-tls
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tls
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	VIA_MAINTENANCE_MODE: "true"
	WITH_ENFORCING: "true"
	WITH_SIDEROLINK_AGENT: wireguard+tls
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-apparmor
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-apparmor
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	WITH_APPARMOR_LSM_ENABLED: "yes"
	run: \|
	sudo -E make e2e-qemu
	- name: e2e-k8s-user-namespace
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-k8s-user-namespace
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	SHORT_INTEGRATION_TEST: "yes"
	TAG_SUFFIX_IN: -enforcing
	WITH_CONFIG_PATCH: '@hack/test/patches/usernamespace.yaml'
	WITH_ENFORCING: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-misc-4-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-provision-0:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/provision-0') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: provision-tests-prepare
	run: \|
	make provision-tests-prepare
	- name: provision-tests-track-0
	env:
	GRPC_ENFORCE_ALPN_ENABLED: "false"
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	sudo -E make provision-tests-track-0
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-provision-0
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-provision-1:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/provision-1') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: provision-tests-prepare
	run: \|
	make provision-tests-prepare
	- name: provision-tests-track-1
	env:
	GRPC_ENFORCE_ALPN_ENABLED: "false"
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	sudo -E make provision-tests-track-1
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-provision-1
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-provision-2:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/provision-2') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: provision-tests-prepare
	run: \|
	make provision-tests-prepare
	- name: provision-tests-track-2
	env:
	GRPC_ENFORCE_ALPN_ENABLED: "false"
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	sudo -E make provision-tests-track-2
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-provision-2
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-qemu
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "3"
	QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
	QEMU_EXTRA_DISKS_SIZE: "10240"
	USER_DISKS_MOUNTS: /var/mnt/extra,/var/mnt/p1,/var/mnt/p2
	WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
	WITH_USER_DISK: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-csi-longhorn:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/extensions') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-longhorn') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: generate
	if: github.event_name == 'schedule'
	run: \|
	make generate
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: checkout extensions
	uses: actions/checkout@v5
	with:
	path: _out/extensions
	ref: main
	repository: siderolabs/extensions
	- name: set variables
	run: \|
	cat _out/talos-metadata >> "$GITHUB_ENV"
	- name: build extensions
	env:
	PLATFORM: linux/amd64
	PUSH: "true"
	REGISTRY: registry.dev.siderolabs.io
	run: \|
	make iscsi-tools util-linux-tools extensions-metadata -C _out/extensions
	- name: installer extensions
	env:
	EXTENSIONS_FILTER_COMMAND: grep -E 'iscsi-tools\|util-linux-tools'
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make installer-with-extensions
	- name: kubelet-fat-patch
	run: \|
	make kubelet-fat-patch
	- name: e2e-qemu-csi-longhorn
	env:
	EXTRA_TEST_ARGS: -talos.csi=longhorn
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-longhorn
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "1"
	QEMU_EXTRA_DISKS_DRIVERS: nvme
	QEMU_EXTRA_DISKS_SIZE: "12288"
	QEMU_MEMORY_WORKERS: "4096"
	QEMU_SYSTEM_DISK_SIZE: "20480"
	QEMU_WORKERS: "3"
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/longhorn-cp.yaml'
	WITH_CONFIG_PATCH_WORKER: '@_out/installer-extensions-patch.yaml:@_out/kubelet-fat-patch.yaml:@hack/test/patches/longhorn.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	uses: actions/upload-artifact@v4
	with:
	name: fio-integration-qemu-csi-longhorn
	path: \|
	/tmp/fio-*.json
	retention-days: "180"
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-csi-longhorn
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-csi-openebs:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-openebs') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-qemu-csi-openebs
	env:
	EXTRA_TEST_ARGS: -talos.csi=openebs
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-openebs
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_CPUS_WORKERS: "4"
	QEMU_EXTRA_DISKS: "1"
	QEMU_EXTRA_DISKS_SIZE: "12288"
	QEMU_MEMORY_WORKERS: "4096"
	QEMU_WORKERS: "3"
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/openebs-cp.yaml'
	WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/openebs.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	uses: actions/upload-artifact@v4
	with:
	name: fio-integration-qemu-csi-openebs
	path: \|
	/tmp/fio-*.json
	retention-days: "180"
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-csi-openebs
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-csi-rook-ceph:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-rook-ceph') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-qemu-csi-rook-ceph
	env:
	EXTRA_TEST_ARGS: -talos.csi=rook-ceph
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-rook-ceph
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_CPUS_WORKERS: "6"
	QEMU_EXTRA_DISKS: "1"
	QEMU_EXTRA_DISKS_SIZE: "12288"
	QEMU_MEMORY_WORKERS: "8192"
	QEMU_WORKERS: "3"
	SHORT_INTEGRATION_TEST: "yes"
	WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/rook-ceph.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	uses: actions/upload-artifact@v4
	with:
	name: fio-integration-qemu-csi-rook-ceph
	path: \|
	/tmp/fio-*.json
	retention-days: "180"
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-csi-rook-ceph
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-encrypted-vip:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-encrypted-vip') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: e2e-qemu
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "3"
	QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
	QEMU_EXTRA_DISKS_SIZE: "10240"
	WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
	WITH_DISK_ENCRYPTION: "true"
	WITH_KUBESPAN: "true"
	WITH_VIRTUAL_IP: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-encrypted-vip
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-enforcing') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: e2e-qemu
	env:
	EXTRA_TEST_ARGS: -talos.enforcing
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "3"
	QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
	QEMU_EXTRA_DISKS_SIZE: "10240"
	TAG_SUFFIX_IN: -enforcing
	USER_DISKS_MOUNTS: /var/mnt/extra,/var/mnt/p1,/var/mnt/p2
	WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
	WITH_ENFORCING: "true"
	WITH_USER_DISK: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-qemu-race:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-race') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: build-race
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64
	PUSH: "true"
	TAG_SUFFIX: -race
	WITH_RACE: "1"
	run: \|
	make initramfs installer-base imager installer
	- name: e2e-qemu-race
	env:
	GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-race
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	QEMU_EXTRA_DISKS: "3"
	QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
	QEMU_EXTRA_DISKS_SIZE: "10240"
	QEMU_MEMORY_CONTROLPLANES: "4096"
	QEMU_MEMORY_WORKERS: "4096"
	TAG_SUFFIX: -race
	WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-qemu-race
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-reproducibility-test:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/reproducibility-test') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: reproducibility-test
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	run: \|
	make reproducibility-test
	integration-trusted-boot:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/trusted-boot') \|\| contains(fromJSON(needs.default.outputs.labels), 'integration/release-gate')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images-essential
	- name: secureboot-iso
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make secureboot-iso
	- name: integration-trusted-boot
	env:
	EXTRA_TEST_ARGS: -talos.trustedboot
	GITHUB_STEP_NAME: ${{ github.job}}-integration-trusted-boot
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	VIA_MAINTENANCE_MODE: "true"
	WITH_TRUSTED_BOOT_ISO: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-trusted-boot
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	integration-trusted-boot-enforcing:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: contains(fromJSON(needs.default.outputs.labels), 'integration/trusted-boot-enforcing')
	needs:
	- default
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Download artifacts
	if: github.event_name != 'schedule'
	uses: actions/download-artifact@v4
	with:
	name: talos-artifacts
	path: _out
	- name: Fix artifact permissions
	if: github.event_name != 'schedule'
	run: \|
	xargs -a _out/executable-artifacts -I {} chmod +x {}
	- name: ci-temp-release-tag
	if: github.event_name != 'schedule'
	run: \|
	make ci-temp-release-tag
	- name: uki-certs
	if: github.event_name == 'schedule'
	env:
	PLATFORM: linux/amd64
	run: \|
	make uki-certs
	- name: build
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	run: \|
	make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
	- name: talosctl-cni-bundle
	if: github.event_name == 'schedule'
	run: \|
	make talosctl-cni-bundle
	- name: images-essential-enforcing
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	PUSH: "true"
	TAG_SUFFIX_OUT: -enforcing
	run: \|
	make images-essential
	- name: secureboot-iso
	if: github.event_name == 'schedule'
	env:
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make secureboot-iso
	- name: integration-trusted-boot-enforcing
	env:
	EXTRA_TEST_ARGS: -talos.trustedboot -talos.enforcing
	GITHUB_STEP_NAME: ${{ github.job}}-integration-trusted-boot-enforcing
	IMAGE_REGISTRY: registry.dev.siderolabs.io
	TAG_SUFFIX_IN: -enforcing
	VIA_MAINTENANCE_MODE: "true"
	WITH_ENFORCING: "true"
	WITH_TRUSTED_BOOT_ISO: "true"
	run: \|
	sudo -E make e2e-qemu
	- name: save artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: talos-logs-integration-trusted-boot-enforcing
	path: \|-
	/tmp/logs-*.tar.gz
	/tmp/support-*.zip
	retention-days: "5"
	push:
	permissions:
	actions: read
	contents: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/')
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: build
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make talosctl-all kernel sd-boot sd-stub initramfs installer-base imager talos
	- name: release-notes
	run: \|
	make release-notes
	- name: login-to-registry
	uses: docker/login-action@v3
	with:
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	- name: push
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make push
	- name: push-latest
	if: '!startsWith(github.ref, ''refs/tags/'')'
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make push-latest
	tag:
	permissions:
	actions: read
	contents: write
	id-token: write
	issues: read
	packages: write
	pull-requests: read
	runs-on:
	group: large
	if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && startsWith(github.ref, 'refs/tags/')
	steps:
	- name: gather-system-info
	id: system-info
	uses: kenchan0130/[email protected]
	continue-on-error: true
	- name: print-system-info
	run: \|
	MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

	OUTPUTS=(
	"CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
	"CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
	"Hostname: ${{ steps.system-info.outputs.hostname }}"
	"NodeName: ${NODE_NAME}"
	"Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
	"Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
	"Name: ${{ steps.system-info.outputs.name }}"
	"Platform: ${{ steps.system-info.outputs.platform }}"
	"Release: ${{ steps.system-info.outputs.release }}"
	"Total memory: ${MEMORY_GB} GB"
	)

	for OUTPUT in "${OUTPUTS[@]}";do
	echo "${OUTPUT}"
	done
	continue-on-error: true
	- name: checkout
	uses: actions/checkout@v5
	- name: Unshallow
	run: \|
	git fetch --prune --unshallow
	- name: Set up Docker Buildx
	id: setup-buildx
	uses: docker/setup-buildx-action@v3
	with:
	driver: remote
	endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
	timeout-minutes: 10
	- name: Mask secrets
	run: \|
	echo "$(sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| "::add-mask::" + .value')"
	- name: Set secrets for job
	run: \|
	sops -d .secrets.yaml \| yq -e '.secrets \| to_entries[] \| .key + "=" + .value' >> "$GITHUB_ENV"
	- name: build
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make talosctl-all kernel sd-boot sd-stub initramfs installer-base imager talos talosctl-cni-bundle
	- name: release-notes
	run: \|
	make release-notes
	- name: sbom
	run: \|
	make sbom
	- name: login-to-registry
	uses: docker/login-action@v3
	with:
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	- name: push
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make push
	- name: images
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make images
	- name: cloud-images
	env:
	PLATFORM: linux/amd64,linux/arm64
	run: \|
	make cloud-images
	- name: Install Cosign
	uses: sigstore/cosign-installer@v3
	- name: Sign artifacts
	run: \|
	cosign sign-blob --output-signature _out/cloud-images.json.sig --yes _out/cloud-images.json
	cosign sign-blob --output-signature _out/initramfs-amd64.xz.sig --yes _out/initramfs-amd64.xz
	cosign sign-blob --output-signature _out/initramfs-arm64.xz.sig --yes _out/initramfs-arm64.xz
	cosign sign-blob --output-signature _out/metal-amd64.iso.sig --yes _out/metal-amd64.iso
	cosign sign-blob --output-signature _out/metal-arm64.iso.sig --yes _out/metal-arm64.iso
	cosign sign-blob --output-signature _out/metal-amd64-uki.efi.sig --yes _out/metal-amd64-uki.efi
	cosign sign-blob --output-signature _out/metal-arm64-uki.efi.sig --yes _out/metal-arm64-uki.efi
	cosign sign-blob --output-signature _out/metal-amd64.raw.zst.sig --yes _out/metal-amd64.raw.zst
	cosign sign-blob --output-signature _out/metal-arm64.raw.zst.sig --yes _out/metal-arm64.raw.zst
	cosign sign-blob --output-signature _out/talos-arm64.spdx.json.sig --yes _out/talos-arm64.spdx.json
	cosign sign-blob --output-signature _out/talos-amd64.spdx.json.sig --yes _out/talos-amd64.spdx.json
	cosign sign-blob --output-signature _out/talos-container-arm64.spdx.json.sig --yes _out/talos-container-arm64.spdx.json
	cosign sign-blob --output-signature _out/talos-container-amd64.spdx.json.sig --yes _out/talos-container-amd64.spdx.json
	cosign sign-blob --output-signature _out/talosctl-cni-bundle-amd64.tar.gz.sig --yes _out/talosctl-cni-bundle-amd64.tar.gz
	cosign sign-blob --output-signature _out/talosctl-cni-bundle-arm64.tar.gz.sig --yes _out/talosctl-cni-bundle-arm64.tar.gz
	cosign sign-blob --output-signature _out/talosctl-darwin-amd64.sig --yes _out/talosctl-darwin-amd64
	cosign sign-blob --output-signature _out/talosctl-darwin-arm64.sig --yes _out/talosctl-darwin-arm64
	cosign sign-blob --output-signature _out/talosctl-freebsd-amd64.sig --yes _out/talosctl-freebsd-amd64
	cosign sign-blob --output-signature _out/talosctl-freebsd-arm64.sig --yes _out/talosctl-freebsd-arm64
	cosign sign-blob --output-signature _out/talosctl-linux-amd64.sig --yes _out/talosctl-linux-amd64
	cosign sign-blob --output-signature _out/talosctl-linux-arm64.sig --yes _out/talosctl-linux-arm64
	cosign sign-blob --output-signature _out/talosctl-linux-armv7.sig --yes _out/talosctl-linux-armv7
	cosign sign-blob --output-signature _out/talosctl-windows-amd64.exe.sig --yes _out/talosctl-windows-amd64.exe
	cosign sign-blob --output-signature _out/talosctl-windows-arm64.exe.sig --yes _out/talosctl-windows-arm64.exe
	cosign sign-blob --output-signature _out/vmlinuz-amd64.sig --yes _out/vmlinuz-amd64
	cosign sign-blob --output-signature _out/vmlinuz-arm64.sig --yes _out/vmlinuz-arm64
	- name: Generate Checksums
	run: \|
	cd _out
	sha256sum cloud-images.json initramfs-amd64.xz initramfs-arm64.xz metal-amd64.iso metal-arm64.iso metal-amd64-uki.efi metal-arm64-uki.efi metal-amd64.raw.zst metal-arm64.raw.zst talos-arm64.spdx.json talos-amd64.spdx.json talos-container-arm64.spdx.json talos-container-amd64.spdx.json talosctl-cni-bundle-amd64.tar.gz talosctl-cni-bundle-arm64.tar.gz talosctl-darwin-amd64 talosctl-darwin-arm64 talosctl-freebsd-amd64 talosctl-freebsd-arm64 talosctl-linux-amd64 talosctl-linux-arm64 talosctl-linux-armv7 talosctl-windows-amd64.exe talosctl-windows-arm64.exe vmlinuz-amd64 vmlinuz-arm64 > sha256sum.txt
	sha512sum cloud-images.json initramfs-amd64.xz initramfs-arm64.xz metal-amd64.iso metal-arm64.iso metal-amd64-uki.efi metal-arm64-uki.efi metal-amd64.raw.zst metal-arm64.raw.zst talos-arm64.spdx.json talos-amd64.spdx.json talos-container-arm64.spdx.json talos-container-amd64.spdx.json talosctl-cni-bundle-amd64.tar.gz talosctl-cni-bundle-arm64.tar.gz talosctl-darwin-amd64 talosctl-darwin-arm64 talosctl-freebsd-amd64 talosctl-freebsd-arm64 talosctl-linux-amd64 talosctl-linux-arm64 talosctl-linux-armv7 talosctl-windows-amd64.exe talosctl-windows-arm64.exe vmlinuz-amd64 vmlinuz-arm64 > sha512sum.txt
	- name: Sign checksums
	run: \|
	cd _out
	cosign sign-blob --output-signature sha256sum.txt.sig --yes sha256sum.txt
	cosign sign-blob --output-signature sha512sum.txt.sig --yes sha512sum.txt
	- name: release
	uses: crazy-max/ghaction-github-release@v2
	with:
	body_path: _out/RELEASE_NOTES.md
	draft: "true"
	files: \|-
	_out/cloud-images.json
	_out/initramfs-amd64.xz
	_out/initramfs-arm64.xz
	_out/metal-amd64.iso
	_out/metal-arm64.iso
	_out/metal-amd64-uki.efi
	_out/metal-arm64-uki.efi
	_out/metal-amd64.raw.zst
	_out/metal-arm64.raw.zst
	_out/talos-arm64.spdx.json
	_out/talos-amd64.spdx.json
	_out/talos-container-arm64.spdx.json
	_out/talos-container-amd64.spdx.json
	_out/talosctl-cni-bundle-amd64.tar.gz
	_out/talosctl-cni-bundle-arm64.tar.gz
	_out/talosctl-darwin-amd64
	_out/talosctl-darwin-arm64
	_out/talosctl-freebsd-amd64
	_out/talosctl-freebsd-arm64
	_out/talosctl-linux-amd64
	_out/talosctl-linux-arm64
	_out/talosctl-linux-armv7
	_out/talosctl-windows-amd64.exe
	_out/talosctl-windows-arm64.exe
	_out/vmlinuz-amd64
	_out/vmlinuz-arm64
	_out/sha*.txt
	_out/*.sig

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: apply 'ro' flag to iso9660 filesystems #9818

Workflow file

fix: apply 'ro' flag to iso9660 filesystems #9818

Uh oh!

Jobs

Run details

Workflow file for this run