The Gitea workflow selects the ubuntu-latest runner and runs the build inside Fedora 43, matching the saved lab package context. The workstation currently reports Fedora 44; this first workflow does not claim a Fedora 44 build test. It runs on main pushes, pull requests and manual dispatch.

The build installs only the OCF executable and nine modules, plus documentation. It includes no Quadlet, secrets, databases or cluster configuration. There are no RPM lifecycle scriptlets. Installation does not start, stop or restart a service or change maintenance mode. Host PostgreSQL packages are not required.

The draft LicenseRef-Provenance-Pending field is a status marker, not a license grant. See PROVENANCE.md. Packages are unsigned development artifacts. The workflow does not publish a release or upload to the Gitea RPM registry.

Local build

In a disposable Fedora 43 build environment, install the packages listed in Containerfile, then run from a Git checkout:

bash scripts/build-rpm.sh

Artifacts are written to dist/: a noarch binary RPM, a source RPM and SHA256SUMS. Build trees remain under .build/ for inspection. The script packages the current working tree; use a clean checkout for a build identified by its Git revision. Only explicitly listed project directories enter the source archive. Lab snapshots, local agent configuration, .git and secrets are excluded.

Version comes from packaging/VERSION. Development Release values are 0.<UTC commit timestamp>.git<12-character commit>, plus the Fedora dist suffix. A future release with Release 1 will sort after these development builds of the same version. SOURCE_REVISION and SOURCE_DATE_EPOCH can supply build identity when testing an exported source tree; RPM_OUTPUT_DIR selects the output path.

%check runs the offline differential suite and checks the staged executable's metadata from both the build directory and /tmp. No live HA actions run. Actual target-node validate-all and HA transitions remain separate lab tests.

Gitea requirements

Enable repository Actions. The runner must support container jobs and reach Gitea, GitHub (for actions), the Fedora image registry, and Fedora repositories. Checkout uses the job token over HTTPS; no SSH private key is required.

The workflow uses upload-artifact v3 for compatibility with older act_runner installations. Newer Gitea runners may support v4; check the installed server and runner versions before changing the artifact action. Artifact upload and runner integration must be verified by the first actual Gitea run.

Before release publishing, resolve licensing, add its text to the package, choose signing and version-tag policy, and configure registry authentication.

Validation performed

On 2026-09-12, the working-tree candidate was built with Fedora 43 / RPM 6.0.2 in a disposable rootless Podman container. Binary and source RPM builds passed, including all 22 offline differential scenarios and staged metadata checks. DNF successfully resolved dependencies and installed the binary RPM inside that container. tests/verify_installed_rpm.py verified the installed architecture, RPM integrity, exact agent bytes, root ownership, 0755/0644 modes, allowed file paths, absence of lifecycle scriptlets, and metadata from an unrelated cwd. The source RPM rebuilt with the same version/release without Git metadata.

Fedora's automatic shebang rewriting is disabled for this shell-only package so the entrypoint remains byte-identical to the tested source. The Corosync runtime dependency is the corosync package (its cmapctl binary is in /usr/bin on Fedora 43). No package was installed on either lab host.

The Gitea server reports 1.27.3. Its Actions API returned HTTP 401 without authentication, so a successful local build does not establish runner checkout or artifact upload success. Check the first run in the repository's Actions tab.