Build and verify development RPMs with Gitea Actions

packaging/README.md

@@ -0,0 +1,74 @@
+# Development RPM builds
+
+The Gitea workflow selects the `ubuntu-latest` runner and runs the build inside
+Fedora 43, matching the saved lab package context. The workstation currently
+reports Fedora 44; this first workflow does not claim a Fedora 44 build test.
+It runs on main pushes, pull requests and manual dispatch.
+
+The build installs only the OCF executable and nine modules, plus documentation.
+It includes no Quadlet, secrets, databases or cluster configuration. There are
+no RPM lifecycle scriptlets. Installation does not start, stop or restart a
+service or change maintenance mode. Host PostgreSQL packages are not required.
+
+The draft LicenseRef-Provenance-Pending field is a status marker, not a license
+grant. See PROVENANCE.md. Packages are unsigned development artifacts. The
+workflow does not publish a release or upload to the Gitea RPM registry.
+
+## Local build
+
+In a disposable Fedora 43 build environment, install the packages listed in
+Containerfile, then run from a Git checkout:
+
+```bash
+bash scripts/build-rpm.sh
+```
+
+Artifacts are written to dist/: a noarch binary RPM, a source RPM and SHA256SUMS.
+Build trees remain under .build/ for inspection. The script packages the current
+working tree; use a clean checkout for a build identified by its Git revision.
+Only explicitly listed project directories enter the source archive. Lab
+snapshots, local agent configuration, .git and secrets are excluded.
+
+Version comes from packaging/VERSION. Development Release values are
+`0.<UTC commit timestamp>.git<12-character commit>`, plus the Fedora dist suffix.
+A future release with Release 1 will sort after these development builds of the
+same version. SOURCE_REVISION and SOURCE_DATE_EPOCH can supply build identity
+when testing an exported source tree; RPM_OUTPUT_DIR selects the output path.
+
+%check runs the offline differential suite and checks the staged executable's
+metadata from both the build directory and /tmp. No live HA actions run.
+Actual target-node validate-all and HA transitions remain separate lab tests.
+
+## Gitea requirements
+
+Enable repository Actions. The runner must support container jobs and reach
+Gitea, GitHub (for actions), the Fedora image registry, and Fedora repositories.
+Checkout uses the job token over HTTPS; no SSH private key is required.
+
+The workflow uses upload-artifact v3 for compatibility with older act_runner
+installations. Newer Gitea runners may support v4; check the installed server
+and runner versions before changing the artifact action. Artifact upload and
+runner integration must be verified by the first actual Gitea run.
+
+Before release publishing, resolve licensing, add its text to the package,
+choose signing and version-tag policy, and configure registry authentication.
+
+## Validation performed
+
+On 2026-09-12, the working-tree candidate was built with Fedora 43 / RPM 6.0.2
+in a disposable rootless Podman container. Binary and source RPM builds passed,
+including all 22 offline differential scenarios and staged metadata checks.
+DNF successfully resolved dependencies and installed the binary RPM inside that
+container. tests/verify_installed_rpm.py verified the installed architecture,
+RPM integrity, exact agent bytes, root ownership, 0755/0644 modes, allowed file
+paths, absence of lifecycle scriptlets, and metadata from an unrelated cwd.
+The source RPM rebuilt with the same version/release without Git metadata.
+
+Fedora's automatic shebang rewriting is disabled for this shell-only package
+so the entrypoint remains byte-identical to the tested source. The Corosync
+runtime dependency is the corosync package (its cmapctl binary is in /usr/bin
+on Fedora 43). No package was installed on either lab host.
+
+The Gitea server reports 1.27.3. Its Actions API returned HTTP 401 without
+authentication, so a successful local build does not establish runner checkout
+or artifact upload success. Check the first run in the repository's Actions tab.