Complete migration from Cirrus CI to GHA (Lima)

[AkihiroSuda]

Fix #5238

[kolyshkin]

1. This part seems missing from the setup_host script:

# Allow potentially unsafe tests.
echo 'export RUNC_ALLOW_UNSAFE_TESTS=yes' >> /root/.bashrc

I realize it was also missing from setup_host_fedora, too, but it was in cirrus.yml. See #5212 for motivation.

2. This part is missing:

# To avoid "avc: denied { nosuid_transition }" from SELinux as we run tests on /tmp. 
mount -o remount,suid /tmp

Do we have selinux off in fedora lima template? Or is this no longer required?

[AkihiroSuda]

echo 'export RUNC_ALLOW_UNSAFE_TESTS=yes' >> /root/.bashrc

Added

Do we have selinux off in fedora lima template?

On.

https://github.com/opencontainers/runc/actions/runs/24313386479/job/70988120894?pr=5239

+ lima sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      35

Or is this no longer required?

Apparently no longer required

[rata]

Thanks for tackling this! It mostly LGTM, left some simple comments

[kolyshkin]

LGTM, thank you!

[kolyshkin]

Not sure if we need the 1.3 backport; most probably we'll still make one more 1.3.x, so I guess we have to. Adding the label.

[rata]

LGTM, thanks!

[rata]

The cirrus CI is ofc not running, so that means to merge I need to bypass the rules. I'll do it, as I think it's the only way out of this