feat(ci): VM tests on the Gitea mirror: boot loaders and all suites on this commit, from the newest Steamify ISO release

vmtest.yml (Gitea only) runs steamify-cachyos-dev's vmbootloadertest.sh per loader (limine, systemd-boot, grub), then the vmtest.sh suites on a plain VM from the same ISO, on pushes to main and release/**, pull requests and by hand.

.github/workflows/bundle.yml

@@ -133,3 +133,79 @@ jobs:
             gh release create latest --title "Steamify CachyOS - latest (v$VERSION)" --notes "$latest_notes" --latest=false
           fi
           gh release upload latest dist/steamify.sh dist/steamify-app.sh dist/steamify-app.tar.gz assets/steam-gaming-settings.svg --clobber
+
+      # The mirror (Gitea) publishes its own release per version too, the same way: never overwrites one,
+      # notes from the changelog. gh can't talk to Gitea: its API for the check, a Gitea release action to
+      # publish. The token is the run's own (repository write); a secret RELEASE_TOKEN overrides it.
+      - name: Version (mirror)
+        id: mirror_version
+        if: github.server_url != 'https://github.com'
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+        run: |
+          version="$(grep -oP '^VERSION=\K.*' steamify.sh)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if curl -fsS -o /dev/null -H "Authorization: token $TOKEN" \
+              "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/v$version"; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+            echo "::warning::v$version is already released on this server and won't be overwritten."
+          else
+            echo "released=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Release notes (mirror)
+        if: >-
+          github.server_url != 'https://github.com' &&
+          github.event_name != 'pull_request' && github.ref == 'refs/heads/main' &&
+          steps.mirror_version.outputs.released == 'false'
+        env:
+          VERSION: ${{ steps.mirror_version.outputs.version }}
+        run: |
+          changes="$(awk -v v="$VERSION" '
+              $0 ~ "^## " { if (found) exit; if (index($0, "## " v " ") == 1) { found = 1; next } }
+              found' CHANGELOG.md)"
+          cat > dist/release-notes.md <<NOTES
+          Single-file build of v$VERSION ($(git describe --always), $(git log -1 --format=%cs)).
+          Run this version with:
+
+              curl -fsSL ${{ github.server_url }}/${{ github.repository }}/releases/download/v$VERSION/steamify.sh | bash
+
+          ## Changes in v$VERSION
+          $changes
+          NOTES
+
+      - name: Publish the v${{ steps.mirror_version.outputs.version }} release (mirror)
+        if: >-
+          github.server_url != 'https://github.com' &&
+          github.event_name != 'pull_request' && github.ref == 'refs/heads/main' &&
+          steps.mirror_version.outputs.released == 'false'
+        uses: akkuman/gitea-release-action@v1.3.7
+        with:
+          token: ${{ secrets.RELEASE_TOKEN || github.token }}
+          tag_name: v${{ steps.mirror_version.outputs.version }}
+          target_commitish: ${{ github.sha }}
+          name: Steamify CachyOS v${{ steps.mirror_version.outputs.version }}
+          body_path: dist/release-notes.md
+          files: |
+            dist/steamify.sh
+            dist/steamify-app.sh
+            dist/steamify-app.tar.gz
+            assets/steam-gaming-settings.svg
+
+      # A new Steamify release starts the Steamify ISO's release with it (a test build from the ISO repo's
+      # feat/steamify, until that is its master): its iso-release.yml names it after this version, tags it,
+      # and the Gitea mirror builds and attaches the ISO. Needs a fine-grained token for that repo
+      # (Actions: read and write) as the secret ISO_DISPATCH_TOKEN; without it, this is skipped.
+      - name: Start the Steamify ISO's release
+        if: >-
+          github.server_url == 'https://github.com' &&
+          github.event_name != 'pull_request' && github.ref == 'refs/heads/main' &&
+          steps.version.outputs.released == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.ISO_DISPATCH_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::notice::No ISO_DISPATCH_TOKEN: the Steamify ISO isn't released with this version."; exit 0
+          fi
+          gh workflow run iso-release.yml -R theupriser/steammachine-cachyos-live-iso --ref feat/steamify
+          echo "Started the Steamify ISO's release (theupriser/steammachine-cachyos-live-iso, feat/steamify)"

.github/workflows/vmtest.yml

@@ -0,0 +1,209 @@
+# Steamify's own test run on the Gitea mirror (git.upriser.nl, its own runner; skipped on GitHub): the same as
+# `scripts/vmtest.sh` in steamify-cachyos-dev, on this commit's steamify.sh. The base is the newest Steamify ISO
+# release of the mirror (steamify-cachyos-live-iso): the boot loader tests (limine, systemd-boot, grub) install
+# it with this commit's Steamify, then the suites (cli, menu, hw, installer, toggles) run on a plain VM from
+# the same ISO (its Steamify step skipped: the suites start from a system without Steamify).
+# The runner needs /dev/kvm and privileged containers, about 12 GB of RAM for two VMs at a time (6 GB to
+# install, 4 GB to test, 2 vCPUs each).
+name: Steamify VM tests (Gitea)
+
+on:
+  push:
+    branches: [main, 'release/**']
+  pull_request:
+  workflow_dispatch:
+
+# A new run on the same branch or pull request stops the old one.
+concurrency:
+  group: vmtest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  iso:
+    name: Newest Steamify ISO
+    if: github.server_url != 'https://github.com'
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.find.outputs.tag }}
+      url: ${{ steps.find.outputs.url }}
+    steps:
+      - name: Find the newest ISO release on the mirror
+        id: find
+        run: |
+          api="${{ github.server_url }}/api/v1/repos/theupriser/steamify-cachyos-live-iso/releases?limit=20"
+          read -r tag url < <(curl -fsS "$api" | python3 -c '
+          import json, sys
+          for r in json.load(sys.stdin):
+              for a in r["assets"]:
+                  if a["name"].endswith(".iso"):
+                      print(r["tag_name"], a["browser_download_url"]); raise SystemExit
+          ')
+          [ -n "$tag" ] || { echo "::error::no ISO release on the mirror"; exit 1; }
+          echo "Using $tag"
+          { echo "tag=$tag"; echo "url=$url"; } >> "$GITHUB_OUTPUT"
+
+  boot:
+    name: Boot loader ${{ matrix.loader }}
+    needs: iso
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    container:
+      image: docker.io/cachyos/cachyos:latest
+      options: --privileged
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        loader: [limine, systemd-boot, grub]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Node and git
+        id: node
+        run: |
+          pacman-key --init && pacman-key --populate
+          pacman -Syu --noconfirm --needed nodejs git
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+      - name: Cache - pacman packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/pacman/pkg
+          key: pacman-test-${{ steps.node.outputs.week }}
+          restore-keys: pacman-test-
+      - name: Cache - the VMs' packages
+        uses: actions/cache@v4
+        with:
+          path: /root/vms/pkg-cache
+          key: vmpkg-steamify-${{ steps.node.outputs.week }}
+          restore-keys: vmpkg-
+      - name: Tools and KVM
+        run: |
+          pacman -S --noconfirm --needed qemu-desktop edk2-ovmf openssh libarchive procps-ng util-linux python curl sudo
+          [ -c /dev/kvm ] || { echo "::error::no /dev/kvm in this container: the runner needs KVM (and privileged containers)"; exit 1; }
+      - name: Cache - the ISO
+        uses: actions/cache@v4
+        with:
+          path: iso
+          key: steamify-iso-${{ needs.iso.outputs.tag }}
+
+      # steamify-cachyos-dev (the scripts) and this commit of steamify-cachyos side by side (9p `repo` in the VMs).
+      - uses: actions/checkout@v4
+        with:
+          path: steamify-cachyos
+      - uses: actions/checkout@v4
+        with:
+          repository: theupriser/steamify-cachyos-dev
+          path: steamify-cachyos-dev
+      - name: ISO
+        run: |
+          mkdir -p iso
+          [ -n "$(ls iso/*.iso 2>/dev/null)" ] || curl -fL --retry 5 --retry-all-errors -o "iso/${{ needs.iso.outputs.tag }}.iso" "${{ needs.iso.outputs.url }}"
+      - name: Boot loader test (${{ matrix.loader }})
+        env:
+          CI: "1"
+          VM_TIMEZONE: UTC
+          VM_CPUS: "2"
+          VM_INSTALL_MEM: 6G
+        run: |
+          mkdir -p ~/.ssh ~/vms/pkg-cache
+          ssh-keygen -q -t ed25519 -N "" -C steamify-vm -f ~/.ssh/steamify-vm_ed25519
+          cd steamify-cachyos-dev
+          VM_ISO="$(ls "$GITHUB_WORKSPACE"/iso/*.iso | head -n 1)" scripts/vmbootloadertest.sh "${{ matrix.loader }}" --install
+      - name: Logs
+        if: always()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: boot-${{ matrix.loader }}
+          path: |
+            /root/vms/bl-${{ matrix.loader }}.test.log
+            /root/vms/bl-${{ matrix.loader }}/vm.log
+          retention-days: 7
+          if-no-files-found: ignore
+
+  suites:
+    name: Suites (vmtest.sh)
+    needs: [iso, boot]
+    runs-on: ubuntu-latest
+    timeout-minutes: 150
+    container:
+      image: docker.io/cachyos/cachyos:latest
+      options: --privileged
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Node and git
+        id: node
+        run: |
+          pacman-key --init && pacman-key --populate
+          pacman -Syu --noconfirm --needed nodejs git
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+      - name: Cache - pacman packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/pacman/pkg
+          key: pacman-test-${{ steps.node.outputs.week }}
+          restore-keys: pacman-test-
+      - name: Cache - the VMs' packages
+        uses: actions/cache@v4
+        with:
+          path: /root/vms/pkg-cache
+          key: vmpkg-steamify-${{ steps.node.outputs.week }}
+          restore-keys: vmpkg-
+      - name: Tools and KVM
+        run: |
+          pacman -S --noconfirm --needed qemu-desktop edk2-ovmf openssh libarchive procps-ng util-linux python curl sudo
+          [ -c /dev/kvm ] || { echo "::error::no /dev/kvm in this container: the runner needs KVM (and privileged containers)"; exit 1; }
+      - name: Cache - the ISO
+        uses: actions/cache@v4
+        with:
+          path: iso
+          key: steamify-iso-${{ needs.iso.outputs.tag }}
+
+      # vmtest.sh wants the live-iso repository too (which boot loaders the ISO advertises).
+      - uses: actions/checkout@v4
+        with:
+          path: steamify-cachyos
+      - uses: actions/checkout@v4
+        with:
+          repository: theupriser/steamify-cachyos-dev
+          path: steamify-cachyos-dev
+      - uses: actions/checkout@v4
+        with:
+          repository: theupriser/steamify-cachyos-live-iso
+          path: steamify-cachyos-live-iso
+      - name: ISO
+        run: |
+          mkdir -p iso
+          [ -n "$(ls iso/*.iso 2>/dev/null)" ] || curl -fL --retry 5 --retry-all-errors -o "iso/${{ needs.iso.outputs.tag }}.iso" "${{ needs.iso.outputs.url }}"
+      - name: Base VM from the ISO
+        env:
+          CI: "1"
+          VM_TIMEZONE: UTC
+          VM_CPUS: "2"
+          VM_INSTALL_MEM: 6G
+          VM_STEAMIFY: skip
+        run: |
+          mkdir -p ~/.ssh ~/vms/pkg-cache
+          ssh-keygen -q -t ed25519 -N "" -C steamify-vm -f ~/.ssh/steamify-vm_ed25519
+          cd steamify-cachyos-dev
+          VM_DIR="$HOME/vms/steamify-vm" scripts/vminstall.sh --iso "$(ls "$GITHUB_WORKSPACE"/iso/*.iso | head -n 1)"
+      - name: vmtest.sh (every suite)
+        env:
+          CI: "1"
+          VM_CPUS: "2"
+          MAX_PARALLEL: "2"
+        run: |
+          cd steamify-cachyos-dev
+          scripts/vmtest.sh cli menu hw installer toggles
+      - name: Logs
+        if: always()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: suites
+          path: |
+            /root/vms/last-test.txt
+            /root/vms/run-*.log
+          retention-days: 7
+          if-no-files-found: ignore

AGENTS.md

@@ -68,6 +68,13 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
   the entry point's `for lib in ...; do` source loop and wraps everything
   after that loop in `main()`. Keep that loop on one line, keep all logic in
   functions, and don't rely on `SCRIPT_DIR` for anything but sourcing.
+  The workflow is one file for GitHub and a Gitea mirror (`github.server_url`): build and check run on both
+  (shellcheck through `ludeeus/action-shellcheck`, which brings its own binary; the artifact with
+  `upload-artifact@v4` on GitHub and `christopherhx/gitea-upload-artifact@v4` elsewhere: never mention
+  `upload-artifact@v3`, GitHub fails a workflow for a deprecated version even in a skipped step); the
+  release is `gh` on GitHub and `akkuman/gitea-release-action` on Gitea. A new release on GitHub also starts the
+  Steamify ISO's release (`gh workflow run iso-release.yml` in steammachine-cachyos-live-iso, secret
+  `ISO_DISPATCH_TOKEN`; skipped without it): the ISO repo's GitHub tag names it, the Gitea mirror builds it.
   CI (`.github/workflows/bundle.yml`) publishes the bundle as release
   `v$VERSION` on pushes to `main`; an existing version is never overwritten,
   so bump `VERSION` for every release.
@@ -252,6 +259,11 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
   kernel only pairs that with a named lookup ("Port C") when the CEC driver
   registered first, which never happens since amdgpu loads from the
   initramfs. Without it `/dev/cec0` exists but stays at `f.f.f.f`.
+  The source comes from one raw.githubusercontent.com download, which GitHub rate-limits (HTTP 429 after a
+  day of test installs, per address): it's kept in `/var/cache/steamify/cros-ec-cec-<sha256:12>.c` and reused
+  while its checksum matches. The name carries the checksum, so a new pin (commit + SHA-256 in `lib/cec.sh`)
+  downloads its own file once and removes the old one. The repo is an unofficial mirror of Valve's kernel
+  without releases: if it ever disappears, ship the file with Steamify. The test VMs share the host's cache.
 - Power-off fix (`poweroff`, `lib/fremont-poweroff.sh`, a default sub-option
   of `machine`): recent kernels (7.2 and the 6.x/7.0/7.1 updates with the
   backport) keep the firmware's S4/S5 wake bit on GPIO

CHANGELOG.md

@@ -5,8 +5,19 @@ All notable changes, per version and per commit. Versions follow
 `steamify.sh`. Versions before 0.7.0 were numbered afterwards,
 one per merged pull request.
 
+## 2.9.4 - 2026-09-29
+
+- `619ef1f` **docs: AGENTS.md and TECHNICAL.md: the CEC driver cache, the one workflow for GitHub and a Gitea mirror, and that a new release starts the Steamify ISO's release**
+- `b624053` **chore: Version 2.9.4**
+
+## 2.9.3 - 2026-09-29
+
+- `7f5d29c` **feat(ci): a new Steamify release starts the Steamify ISO's release (a test build from the ISO repo's feat/steamify; secret ISO_DISPATCH_TOKEN)**
+- `cfe3ce7` **chore: Version 2.9.3**
+
 ## 2.9.2 - 2026-09-29
 
+- **feat(ci): a Gitea mirror publishes its own release per version (akkuman/gitea-release-action; never overwrites one, notes from the changelog, links to the mirror)**
 - **fix(ci): the build also runs on a Gitea mirror (act_runner): shellcheck through ludeeus/action-shellcheck, which brings its own binary; the artifact goes up there with christopherhx/gitea-upload-artifact (GitHub refuses a workflow that mentions the deprecated upload-artifact@v3); releases are only published on GitHub**
 - `fe4f3f4` **chore: Version 2.9.2**
 

TECHNICAL.md

@@ -514,7 +514,7 @@ immediately, which can turn into a loop - see
 | `services/` | The systemd units the scripts install (`service_file`, `@KEY@` placeholders); see its README |
 | `patches/` | Module sources and patches the scripts build or apply (`patch_file`); see its README |
 | `.github/tools/bundle.sh` | Builds the single-file version (`dist/steamify.sh`), with `patches/` and `services/` embedded |
-| `.github/workflows/bundle.yml` | Builds and checks it on every push; publishes it on `main` |
+| `.github/workflows/bundle.yml` | Builds and checks it on every push (GitHub and a Gitea mirror); publishes it on `main`, and starts the Steamify ISO's release |
 
 The single-file version is generated: on every push to `main`, GitHub
 Actions runs `.github/tools/bundle.sh`, checks the result with `bash -n` and

steamify.sh

@@ -15,7 +15,7 @@
 set -uo pipefail
 
 # Release version, see CHANGELOG.md.
-VERSION=2.9.2
+VERSION=2.9.4
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"