Repository navigation
Zero-infra hosted-runner lane + TCG fallback; lead README with Falco proof - #1
Merged
Merged
Conversation
…lco proof GitHub-hosted ubuntu-latest runners now expose /dev/kvm (proven by the Falco modern_bpf PoC run), so the full QEMU VM compatibility gate no longer needs a self-hosted runner. Make that the headline on-ramp and harden it: - New .github/workflows/bpfcompat-example-hosted.yml runs the VM gate on stock ubuntu-latest; reports KVM status, installs its own deps. - QEMU executor falls back to TCG software emulation (-accel tcg -cpu max) when /dev/kvm is absent instead of failing the launch. Split into a pure machineArgsFor(arch, kvm) with TestMachineArgsForAccelFallback. - README leads with the CO-RE/BTFHub wedge, the no-self-hosted-runner path, and the Falco modern_bpf 5-kernel proof (red ubuntu-20.04-5.4 UNSUPPORTED_MAP_TYPE). - Fix stale "self-hosted/GitHub-hosted has no KVM" claims in README and firecracker-preflight.yml; record the lane in docs/falco-parity.md + CHANGELOG. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds the trust signals that were missing (SBOM + cosign signing already shipped in release-artifacts.yml): - .github/workflows/codeql.yml: CodeQL Go analysis (build-mode none, so no C/libbpf toolchain needed), security-and-quality queries, on push/PR/weekly. - .github/workflows/scorecard.yml: OpenSSF Scorecard, publishes to the public Scorecard API and uploads SARIF to code scanning. - .github/dependabot.yml: weekly grouped updates for Go modules and the pinned GitHub Actions. - README: CI / CodeQL / Scorecard / license badges + a Supply-chain posture section with a cosign verify-blob example. - docs/supply-chain.md: in-repo controls table plus a checklist of maintainer-side repo settings that can't be set from files (branch protection, secret-scanning push protection, OpenSSF Best Practices badge registration). No untrusted github.event.* input is interpolated into any run: step in the new workflows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Layer 4 supply-chain trust signals: CodeQL, Scorecard, Dependabot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub-hosted
ubuntu-latestrunners now expose/dev/kvm(proven by the Falcomodern_bpfPoC run), so the full QEMU VM compatibility gate no longer needs a self-hosted runner. The repo previously told users the opposite. This makes the zero-infra path the headline and hardens it.What
.github/workflows/bpfcompat-example-hosted.yml— runs the VM gate on stockubuntu-latest, installs its own deps, reports KVM status as a notice/warning.internal/vm/qemu.go— falls back to TCG software emulation (-accel tcg -cpu max) when/dev/kvmis absent instead of failing the launch. Split into puremachineArgsFor(arch, kvm)+kvmAvailable(), covered byTestMachineArgsForAccelFallback.modern_bpf5-kernel proof table (redubuntu-20.04-5.4UNSUPPORTED_MAP_TYPE).firecracker-preflight.yml; recorded the lane indocs/falco-parity.md+ CHANGELOG.Verification
go build ./...,go vet,gofmt, andgo test ./internal/vm/all pass. New workflow YAML validates. Worth dispatchingbpfcompat-example-hosted.ymlonce on this PR to confirm hosted KVM end-to-end before relying on it publicly — the TCG fallback means a KVM-less runner degrades to slow, not broken.🤖 Generated with Claude Code