ci: run the checks of the Makefile on GitHub Actions

Nothing runs the checks of the Makefile on a change before it lands.
Add a workflow that runs them on ubuntu-24.04 for every pull request
and every push to main:
- lint-and-test: make setup, then make -k -o qemu, which runs every
  check but the QEMU boots.
- qemu: the packages of tests/qemu/ubuntu-packages, the udev rule
  that GitHub documents to open /dev/kvm to the runner user, then
  make qemu. The kernel RPMs and DriverSample.efi are cached under a
  key of the files that pin them and saved only when the job passes,
  as run.sh reuses DriverSample.efi unchecked. The logs of failed
  boots are uploaded.
The actions are pinned to commit SHAs, and the token can only read
the repository.

Signed-off-by: Dmitrii Okunev <xaionaro@meta.com>

Author: xaionaro

.github/workflows/checks.yml

@@ -0,0 +1,79 @@
+# The checks of the Makefile; the QEMU boots, which need KVM and apt packages, in
+# a job of their own.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+# PRs: a new push cancels the previous run. main: one group per run, as a shared
+# group drops pending runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - run: make setup
+
+      # After setup: the key covers installed toolchains.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      # Every check but the boots.
+      - run: make -k -o qemu
+
+  qemu:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - run: |
+          sudo apt-get update
+          xargs --arg-file=tests/qemu/ubuntu-packages sudo apt-get install --yes
+
+      # Opens /dev/kvm to the runner user, per
+      # https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/
+      - run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' |
+            sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      # No rust-cache: its cleanup takes run.sh's initramfs/tests for a cargo
+      # profile and logs errors; the builds take about a minute without it.
+      - run: make setup
+
+      # Kernel RPMs and DriverSample.efi. Saved only on success, as run.sh reuses
+      # DriverSample.efi unchecked.
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            target/qemu-test/kernel-rpms
+            target/qemu-test/driver-sample
+          key: qemu-inputs-${{ hashFiles('tests/qemu/kernel.sha256', 'tests/qemu/build-driver-sample.sh') }}
+
+      - run: make qemu
+
+      - if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: qemu-test-logs
+          path: |
+            target/qemu-test/*/*/*.log
+            target/qemu-test/*/executables
+          if-no-files-found: ignore
+          retention-days: 14

README.md

@@ -159,6 +159,8 @@ make help            # lists the checks
 
 `make qemu`, the QEMU tests, also needs an x86_64 host with `/dev/kvm` and the packages that [`tests/qemu/README.md`](tests/qemu/README.md) lists.
 
+GitHub Actions runs the checks on every pull request and every push to main, as [`.github/workflows/checks.yml`](.github/workflows/checks.yml) describes.
+
 ## QEMU tests
 
 End-to-end tests boot QEMU guests and run `uefisettings` against emulated firmware; [`tests/qemu/README.md`](tests/qemu/README.md) explains how to run them.