ci: Test bootc-ubuntu-setup with arm64 fixes

Copy the bootc-ubuntu-setup action locally and fix:
1. Use correct apt mirror for arm64 (ports.ubuntu.com/ubuntu-ports)
2. Handle missing /dev/kvm on arm64 runners gracefully

Also syncs other improvements from upstream actions repo.

Assisted-by: OpenCode (Claude claude-opus-4-5)

Author: cgwalters

.github/actions/bootc-ubuntu-setup/action.yml

@@ -14,7 +14,8 @@ runs:
       run: |
         set -xeuo pipefail
         sudo df -h
-        unwanted_pkgs=('^aspnetcore-.*' '^dotnet-.*' '^llvm-.*' 'php.*' '^mongodb-.*' '^mysql-.*'
+        # Use globs for package patterns (apt and dpkg both support fnmatch globs)
+        unwanted_pkgs=('aspnetcore-*' 'dotnet-*' 'llvm-*' 'php*' 'mongodb-*' 'mysql-*'
                        azure-cli google-chrome-stable firefox mono-devel)
         unwanted_dirs=(/usr/share/dotnet /opt/ghc /usr/local/lib/android /opt/hostedtoolcache/CodeQL)
         # Start background removal operations as systemd units; if this causes
@@ -30,9 +31,12 @@ runs:
         for x in ${unwanted_dirs[@]}; do
           runcleanup rm -rf "$x"
         done
-        # Apt removals in foreground, as we can't parallelize these
+        # Apt removals in foreground, as we can't parallelize these.
+        # Only attempt removal if matching packages are installed.
         for x in ${unwanted_pkgs[@]}; do
-          /bin/time -f '%E %C' sudo apt-get remove -y $x
+          if dpkg -l "$x" >/dev/null 2>&1; then
+            /bin/time -f '%E %C' sudo apt-get remove -y "$x"
+          fi
         done
     # We really want support for heredocs
     - name: Update podman and install just
@@ -43,7 +47,22 @@ runs:
         IDV=$(. /usr/lib/os-release && echo ${ID}-${VERSION_ID})
         test "${IDV}" = "ubuntu-24.04"
         # plucky is the next release
-        echo 'deb http://azure.archive.ubuntu.com/ubuntu plucky universe main' | sudo tee /etc/apt/sources.list.d/plucky.list
+        # Ubuntu uses different mirrors for different architectures:
+        # - amd64: azure.archive.ubuntu.com/ubuntu (on Azure runners)
+        # - arm64: ports.ubuntu.com/ubuntu-ports
+        case "$(arch)" in
+          x86_64)
+            mirror="http://azure.archive.ubuntu.com/ubuntu"
+            ;;
+          aarch64)
+            mirror="http://ports.ubuntu.com/ubuntu-ports"
+            ;;
+          *)
+            echo "Unsupported architecture: $(arch)" >&2
+            exit 1
+            ;;
+        esac
+        echo "deb ${mirror} plucky universe main" | sudo tee /etc/apt/sources.list.d/plucky.list
         /bin/time -f '%E %C' sudo apt update
         # skopeo is currently older in plucky for some reason hence --allow-downgrades
         /bin/time -f '%E %C' sudo apt install -y --allow-downgrades crun/plucky podman/plucky skopeo/plucky just
@@ -54,31 +73,27 @@ runs:
         set -xeuo pipefail
         echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
         sudo udevadm control --reload-rules
-        sudo udevadm trigger --name-match=kvm
-        ls -l /dev/kvm
+        # Only trigger if /dev/kvm exists (may not be available on arm64 runners)
+        if [ -e /dev/kvm ]; then
+          sudo udevadm trigger --name-match=kvm
+          ls -l /dev/kvm
+        else
+          echo "Note: /dev/kvm not available on this runner"
+        fi
     # Used by a few workflows, but generally useful
     - name: Set architecture variable
       id: set_arch
       shell: bash
       run: echo "ARCH=$(arch)" >> $GITHUB_ENV
-    # We often use Rust, so set up opinionated default caching
-    - name: Setup Rust cache
-      uses: Swatinem/rust-cache@v2
-      with:
-        cache-all-crates: true
-        # Only generate caches on push to git main
-        save-if: ${{ github.ref == 'refs/heads/main' }}
-        # Suppress actually using the cache for builds running from
-        # git main so that we avoid incremental compilation bugs
-        lookup-only: ${{ github.ref == 'refs/heads/main' }}
     # Install libvirt stack if requested
     - name: Install libvirt and virtualization stack
       if: ${{ inputs.libvirt == 'true' }}
       shell: bash
       run: |
         set -xeuo pipefail
-        export BCVK_VERSION=0.6.0
-        /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils qemu-kvm virtiofsd libvirt-daemon-system
+        export BCVK_VERSION=0.10.0
+        # see https://github.com/bootc-dev/bcvk/issues/176
+        /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils qemu-kvm virtiofsd libvirt-daemon-system python3-virt-firmware
         # Something in the stack is overriding this, but we want session right now for bcvk
         echo LIBVIRT_DEFAULT_URI=qemu:///session >> $GITHUB_ENV
         td=$(mktemp -d)

.github/workflows/debug-arm64-upterm.yml

@@ -19,29 +19,18 @@ jobs:
           cat /etc/os-release
           df -h
 
-      - name: Test plucky apt mirror fix
+      - name: Test local bootc-ubuntu-setup action
+        uses: ./.github/actions/bootc-ubuntu-setup
+
+      - name: Verify setup worked
         run: |
-          set -eux
-          # This is the proposed fix - use correct mirror per architecture
-          case "$(arch)" in
-            x86_64)
-              mirror="http://azure.archive.ubuntu.com/ubuntu"
-              ;;
-            aarch64)
-              mirror="http://ports.ubuntu.com/ubuntu-ports"
-              ;;
-            *)
-              echo "Unsupported architecture: $(arch)" >&2
-              exit 1
-              ;;
-          esac
-          echo "Using mirror: ${mirror}"
-          echo "deb ${mirror} plucky universe main" | sudo tee /etc/apt/sources.list.d/plucky.list
-          /bin/time -f '%E %C' sudo apt update
-          # Test that we can actually install packages from plucky
-          apt-cache policy podman
+          set -x
+          podman --version
+          just --version
+          echo "Setup completed successfully!"
 
       - name: Setup upterm session
+        if: failure()
         uses: owenthereal/action-upterm@v1
         with:
           limit-access-to-actor: true