[RamakrishnanPK]

Adds configurable QEMU source installation and caching.
Adds documentation and an integration test workflow.
Adds the test to the PR CI gate.

Fixes eclipse-score/score#1837

[Copilot]

🟡 Changes recommended

Direct shell interpolation, insecure KVM permissions, and incomplete cache identity create blocking security and reliability risks.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a reusable action to build, cache, install, and validate modern QEMU with Raspberry Pi 4 support.

Changes:

• Adds configurable QEMU source installation and caching.
• Adds documentation and an integration test workflow.
• Adds the test to the PR CI gate.

File summaries

File	Description
setup-qemu-latest/action.yml	Implements the composite action.
setup-qemu-latest/README.md	Documents configuration and usage.
.github/workflows/test-setup-qemu-latest.yml	Tests installation, outputs, and KVM configuration.
.github/workflows/_local_on_pr.yml	Adds the test to PR validation.

Review details

Suppressed comments (3)

setup-qemu-latest/action.yml:70

• Action inputs are interpolated directly into generated Bash source. A quoted value containing a quote, command separator, or newline can escape these assignments and execute arbitrary commands; the same pattern recurs for the dependency, download, build, cleanup, PATH, and validation steps. Pass every input through env, validate structured values such as versions and package names, and consume argument lists via arrays rather than embedding ${{ inputs.* }} in scripts.

        install_prefix="${{ inputs.install-prefix }}/${{ inputs.qemu-version }}"

setup-qemu-latest/action.yml:49

• Defaulting /dev/kvm to 0666 grants every local account access to the KVM kernel interface, and the udev rule persists after jobs on compatible self-hosted runners. Use the standard 0660 root:kvm policy and grant only the runner account group membership, or make this persistent host modification explicitly opt-in.

    default: "0666"

setup-qemu-latest/action.yml:72

• The cache can restore incompatible or stale binaries: runner.os is identical for x64 and ARM64 runners, and the hash omits the hard-coded build recipe. This can produce an exec-format failure across architectures and lets later action revisions skip their updated build logic. Include runner.arch and a recipe hash (or explicitly maintained cache schema) in the key.

        config_hash="$(printf '%s' "${{ inputs.qemu-targets }}|${{ inputs.configure-args }}|${{ inputs.extra-build-deps }}" | sha256sum | cut -d' ' -f1)"
        cache_key="qemu-${{ runner.os }}-${{ inputs.qemu-version }}-${config_hash}"

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Cache portability, target selection, output accuracy, and KVM permission issues remain unresolved.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Include architecture and distro release in cache keys · New
• Restrict KVM access without globally changing device permissions · New
• Add isolated tests for cache selection and policy branches · New
• Return the correct installation prefix for system QEMU · New

Resolved since last review (3)

• The action and README promise the latest stable QEMU, but the default is 10.2.4 while the current…
• This only checks that the binary starts, so a build without the Raspberry Pi 4 machine still passes…
• This guarantee is false on a cache hit because the dependency-install step is skipped entirely.…

[AlexanderLanin]

Please mark ready for review once all copilot findings are (commented or fixed) and resolved.