From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Sat, 12 Jul 2025 08:58:17 +0000 (+0100)
Subject: ci: re-enable uefi secure boot
X-Git-Tag: v257.8~102
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=25ac624d3fe62c35d03bd38307bd40071497d39e;p=thirdparty%2Fsystemd.git

ci: re-enable uefi secure boot

Kernel 6.11.0-1018-azure is now in use, which has a workaround
for the HyperV bug, so this should work again in GHA

(cherry picked from commit 375d80b04a95bc460f54df26308ad4adcfce9bc4)
---

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 524caab8665..b0dfd18f048 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -49,9 +49,6 @@ jobs:
 
       - name: Configure
         run: |
-          # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
-          sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build
-
           tee mkosi/mkosi.local.conf <<EOF
           [Distribution]
           Distribution=arch
diff --git a/test/integration-tests/integration-test-wrapper.py b/test/integration-tests/integration-test-wrapper.py
index 2e87d39901b..611dffbf534 100755
--- a/test/integration-tests/integration-test-wrapper.py
+++ b/test/integration-tests/integration-test-wrapper.py
@@ -537,15 +537,9 @@ def main() -> None:
     else:
         rtc = None
 
-    # mkosi will use the UEFI secure boot firmware by default on UEFI platforms. However, this breaks on
-    # Github Actions in combination with KVM because of a HyperV bug so make sure we use the non secure
-    # boot firmware on Github Actions.
-    # TODO: Drop after the HyperV bug that breaks secure boot KVM guests is solved
-    if args.firmware == 'auto' and os.getenv('GITHUB_ACTIONS'):
-        firmware = 'uefi'
     # Whenever possible, boot without an initrd. This requires the target distribution kernel to have the
     # necessary modules (virtio-blk, ext4) builtin.
-    elif args.firmware == 'linux-noinitrd' and (summary.distribution, summary.release) not in (
+    if args.firmware == 'linux-noinitrd' and (summary.distribution, summary.release) not in (
         ('fedora', 'rawhide'),
         ('arch', 'rolling'),
     ):