Actions to install latest QEMU support on GitHub runners

.github/workflows/_local_on_pr.yml

@@ -47,6 +47,11 @@ jobs:
     permissions:
       contents: read
 
+  setup-qemu-latest-tests:
+    uses: ./.github/workflows/test-setup-qemu-latest.yml
+    permissions:
+      contents: read
+
   setup-bazel-cache-persistence-tests:
     if: github.event_name == 'merge_group'
     uses: ./.github/workflows/test-setup-bazel-cache-persistence.yml
@@ -97,6 +102,7 @@ jobs:
       - common
       - inter-repo-access-tests
       - setup-qnx-sdp-tests
+      - setup-qemu-latest-tests
       - unblock-user-namespace-for-linux-sandbox-tests
       - setup-bazel-cache-tests
       - setup-bazel-cache-persistence-tests

.github/workflows/test-setup-qemu-latest.yml

@@ -0,0 +1,89 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Test Setup QEMU Latest
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  setup-qemu-latest:
+    name: Build and validate QEMU
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run setup-qemu-latest action
+        id: setup-qemu
+        uses: ./setup-qemu-latest
+        with:
+          validation-target: aarch64
+          nproc: "2"
+
+      - name: Verify outputs
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${{ steps.setup-qemu.outputs.install-prefix }}" ]]; then
+            echo "ERROR: install-prefix output is empty"
+            exit 1
+          fi
+
+          if [[ -z "${{ steps.setup-qemu.outputs.bin-path }}" ]]; then
+            echo "ERROR: bin-path output is empty"
+            exit 1
+          fi
+
+          if [[ -z "${{ steps.setup-qemu.outputs.cache-key }}" ]]; then
+            echo "ERROR: cache-key output is empty"
+            exit 1
+          fi
+
+      - name: Verify QEMU executable
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          qemu_bin="${{ steps.setup-qemu.outputs.bin-path }}/qemu-system-aarch64"
+          if [[ ! -x "$qemu_bin" ]]; then
+            echo "ERROR: expected QEMU binary not found: $qemu_bin"
+            exit 1
+          fi
+
+          "$qemu_bin" --version
+          "$qemu_bin" -machine help | grep -Eq '(^|[[:space:]])raspi4b([[:space:]]|$)'
+
+          x86_qemu_bin="${{ steps.setup-qemu.outputs.bin-path }}/qemu-system-x86_64"
+          if [[ ! -x "$x86_qemu_bin" ]]; then
+            echo "ERROR: expected QEMU binary not found: $x86_qemu_bin"
+            exit 1
+          fi
+
+          "$x86_qemu_bin" --version
+          if [[ -e /dev/kvm ]]; then
+            device_mode="$(stat -c '%a' /dev/kvm)"
+            if [[ "$device_mode" != "666" ]]; then
+              echo "ERROR: expected /dev/kvm mode 666, got $device_mode"
+              exit 1
+            fi
+
+            stat -c '%A %n' /dev/kvm
+          else
+            echo "KVM device not available on this runner; skipping permission check."
+          fi

setup-qemu-latest/README.md

@@ -0,0 +1,94 @@
+# Setup QEMU latest stable version
+
+Reusable composite action that builds QEMU from source, installs it on the runner, validates the selected machine target, and adds it to `PATH`.
+
+The default configuration builds the `aarch64-softmmu` and `x86_64-softmmu` targets. The AArch64 target includes Raspberry Pi 4 Model B support (`-machine raspi4b`).
+
+## Usage
+
+Use the action from a GitHub Actions workflow:
+
+```yaml
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - name: Setup QEMU latest
+        id: qemu
+        uses: eclipse-score/cicd-actions/setup-qemu-latest@main
+
+      - name: Check Raspberry Pi 4B support
+        run: qemu-system-aarch64 -machine help
+```
+
+Pin the action to a commit SHA for immutable builds:
+
+```yaml
+- uses: eclipse-score/cicd-actions/setup-qemu-latest@<commit-sha>
+```
+
+## Inputs
+
+| Input | Default | Description |
+| --- | --- | --- |
+| `qemu-version` | `11.1.1` | QEMU release to download from `download.qemu.org` and build. |
+| `allow-downgrade` | `false` | Build `qemu-version` instead of keeping a newer preinstalled QEMU. An exact version match is always kept. |
+| `qemu-targets` | `aarch64-softmmu,x86_64-softmmu` | Comma-separated targets passed to `--target-list`. |
+| `install-prefix` | `/opt/qemu` | Base installation directory. The QEMU version is appended. |
+| `configure-args` | Empty | Newline-delimited arguments appended to `./configure`; each non-empty line is one argument. |
+| `extra-build-deps` | Empty | Additional space-separated apt packages required by custom configurations. |
+| `nproc` | Automatic | Number of parallel `make` jobs. Empty uses the runner CPU count. |
+| `validation-target` | `aarch64` | Target validated with `-machine help`. Empty disables validation. |
+
+For example, build multiple targets with a custom configure option:
+
+```yaml
+- name: Setup QEMU
+  uses: eclipse-score/cicd-actions/setup-qemu-latest@main
+  with:
+    qemu-targets: aarch64-softmmu,arm-softmmu
+    configure-args: |
+      --enable-slirp
+      --extra-cflags=-O2 -g
+    nproc: "4"
+```
+
+To replace a newer installed QEMU with the requested version, set `allow-downgrade: "true"`.
+
+## Outputs
+
+| Output | Description |
+| --- | --- |
+| `install-prefix` | Full directory containing the QEMU installation. |
+| `cache-key` | Cache key used for the build. |
+| `bin-path` | Directory containing the QEMU executables. |
+
+The action adds `bin-path` to `PATH` for subsequent steps in the same job. Outputs are also available through the step ID:
+
+```yaml
+- name: Show QEMU location
+  run: |
+    echo "Install: ${{ steps.qemu.outputs.install-prefix }}"
+    echo "Binaries: ${{ steps.qemu.outputs.bin-path }}"
+```
+
+## Behavior
+
+- On a cache miss, an exact preinstalled QEMU version match is always kept. A newer preinstalled version is kept unless `allow-downgrade` is `true`; an older, missing, or unrecognized version is replaced with a source build of `qemu-version`.
+- QEMU source archives are verified with the published detached GPG signature before extraction.
+- Builds are cached by runner OS, QEMU version, installation prefix, targets, configure arguments, and extra build dependencies.
+- On a cache miss, build dependencies remain installed for the rest of the job so later build or test steps can use them.
+- After QEMU setup and validation, if `/dev/kvm` exists its mode is set to `0666` so subsequent steps can access KVM.
+
+## Requirements
+
+The action is intended for GitHub-hosted Ubuntu runners or compatible Linux runners with:
+
+- `sudo` access
+- `apt-get`
+- `curl`, `tar`, and `gpg`
+- GitHub Actions cache support
+
+This action runs inside a GitHub Actions workflow. It cannot be referenced directly from `devcontainer.json` or used as a local shell setup script.