jjf-dev · dependabot · Apr 22, 2026 · Apr 22, 2026 · Apr 22, 2026 · Apr 22, 2026
diff --git a/.github/workflows/publish-asterinas-kata-image.yml b/.github/workflows/publish-asterinas-kata-image.yml
@@ -39,6 +39,7 @@ jobs:
       docker_image_version: ${{ steps.resolve.outputs.docker_image_version }}
       kata_static_tarball_release_repo: ${{ steps.resolve.outputs.kata_static_tarball_release_repo }}
       kata_static_tarball_url: ${{ steps.resolve.outputs.kata_static_tarball_url }}
+      kata_static_tarball_sha256: ${{ steps.resolve.outputs.kata_static_tarball_sha256 }}
       should_push: ${{ steps.resolve.outputs.should_push }}
     steps:
       - name: Resolve Publish Inputs
@@ -67,6 +68,27 @@ jobs:
           image_repository="${WORKFLOW_IMAGE_REPOSITORY:-${DEFAULT_IMAGE_REPOSITORY}}"
           kata_static_tarball_release_repo="${WORKFLOW_RELEASE_REPO:-${GITHUB_REPOSITORY}}"
           kata_static_tarball_url="${WORKFLOW_STATIC_TARBALL_URL:-}"
+          kata_static_tarball_sha256=
+          if [ -z "${kata_static_tarball_url}" ]; then
+            kata_static_tarball_url="$(
+              gh api "repos/${kata_static_tarball_release_repo}/releases/latest" --jq '
+                .assets[]
+                | select(.name | test("^kata-static-.*-asterinas-amd64\\.tar\\.zst$"))
+                | .browser_download_url
+              ' | head -n 1
+            )"
+          fi
+          test -n "${kata_static_tarball_url}"
+          kata_static_tarball_name="${kata_static_tarball_url##*/}"
+          kata_static_tarball_sha256="$(
+            gh api "repos/${kata_static_tarball_release_repo}/releases/latest" --jq '
+              .assets[]
+              | select(.name | test("^kata-static-.*-asterinas-amd64\\.SHA256SUMS$"))
+              | .browser_download_url
+            ' | head -n 1 |
+            xargs curl -fsSL |
+            awk -v asset_name="${kata_static_tarball_name}" '$2 == asset_name || $2 ~ ("/" asset_name "$") { print $1; exit }'
+          )"
           should_push=false
 
           if [ -n "${DOCKERHUB_USERNAME}" ] && [ -n "${DOCKERHUB_TOKEN}" ]; then
@@ -84,6 +106,7 @@ jobs:
           echo "docker_image_version=${docker_image_version}" >> "${GITHUB_OUTPUT}"
           echo "kata_static_tarball_release_repo=${kata_static_tarball_release_repo}" >> "${GITHUB_OUTPUT}"
           echo "kata_static_tarball_url=${kata_static_tarball_url}" >> "${GITHUB_OUTPUT}"
+          echo "kata_static_tarball_sha256=${kata_static_tarball_sha256}" >> "${GITHUB_OUTPUT}"
           echo "should_push=${should_push}" >> "${GITHUB_OUTPUT}"
 
           {
@@ -99,6 +122,7 @@ jobs:
             else
               echo "- Explicit Kata tarball URL: not set"
             fi
+            echo "- Kata tarball SHA256: \`${kata_static_tarball_sha256}\`"
             echo "- Push enabled: \`${should_push}\`"
           } >> "${GITHUB_STEP_SUMMARY}"
 
@@ -145,6 +169,7 @@ jobs:
             ASTERINAS_BASE_IMAGE=${{ env.ASTERINAS_BASE_IMAGE }}
             KATA_STATIC_TARBALL_RELEASE_REPO=${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_release_repo }}
             KATA_STATIC_TARBALL_URL=${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_url }}
+            KATA_STATIC_TARBALL_SHA256=${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_sha256 }}
             ASTERINAS_RELEASE_VERSION=${{ needs.resolve-upstream-asterinas-image.outputs.asterinas_version }}
             ASTERINAS_DOCKER_IMAGE_VERSION=${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}
 

diff --git a/.github/workflows/release-asterinas-kata-bundle.yml b/.github/workflows/release-asterinas-kata-bundle.yml
@@ -59,6 +59,8 @@ jobs:
   build-asterinas-kernel:
     name: Build Asterinas kernel artifact
     runs-on: ubuntu-22.04
+    outputs:
+      asterinas_commit: ${{ steps.asterinas_commit.outputs.value }}
     container:
       image: ${{ inputs.asterinas_builder_image || 'asterinas/asterinas:0.17.1-20260319' }}
     steps:
@@ -69,6 +71,13 @@ jobs:
           ref: ${{ env.ASTERINAS_REF }}
           path: asterinas
 
+      - name: Record Asterinas Commit
+        id: asterinas_commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "value=$(git -C asterinas rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
+
       - name: Build qemu-direct Kernels
         shell: bash
         run: |
@@ -153,6 +162,7 @@ jobs:
           ASTERINAS_TDX_KERNEL: ${{ github.workspace }}/build/asterinas-kernel/aster-kernel-osdk-bin.qemu_elf-tdx
           ASTERINAS_REPOSITORY: ${{ env.ASTERINAS_REPOSITORY }}
           ASTERINAS_REF: ${{ env.ASTERINAS_REF }}
+          ASTERINAS_COMMIT: ${{ needs.build-asterinas-kernel.outputs.asterinas_commit }}
           ASTERINAS_BUILDER_IMAGE: ${{ env.ASTERINAS_BUILDER_IMAGE }}
           FORCE_RUNTIME_BUILD: ${{ env.FORCE_RUNTIME_BUILD }}
           KATA_STATIC_RELEASE_REPOSITORY: ${{ env.KATA_STATIC_RELEASE_REPOSITORY }}

diff --git a/.github/workflows/test-asterinas-kata-docs.yml b/.github/workflows/test-asterinas-kata-docs.yml
@@ -0,0 +1,202 @@
+name: Test | Asterinas Kata Docs
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - asterinas
+
+permissions:
+  contents: read
+
+env:
+  ASTERINAS_REPOSITORY: jjf-dev/asterinas
+  ASTERINAS_REF: kata-support
+
+jobs:
+  resolve-upstream-asterinas-image:
+    name: Resolve upstream Asterinas image
+    runs-on: ubuntu-latest
+    outputs:
+      asterinas_version: ${{ steps.resolve.outputs.asterinas_version }}
+      docker_image_version: ${{ steps.resolve.outputs.docker_image_version }}
+      kata_static_tarball_url: ${{ steps.resolve.outputs.kata_static_tarball_url }}
+      kata_static_tarball_sha256: ${{ steps.resolve.outputs.kata_static_tarball_sha256 }}
+    steps:
+      - name: Resolve Upstream Asterinas Image Metadata
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          asterinas_version="$(
+            gh api repos/asterinas/asterinas/contents/VERSION?ref=main --jq .content |
+              base64 -d | tr -d '\n'
+          )"
+          docker_image_version="$(
+            gh api repos/asterinas/asterinas/contents/DOCKER_IMAGE_VERSION?ref=main --jq .content |
+              base64 -d | tr -d '\n'
+          )"
+          kata_static_tarball_url="$(
+            gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '
+              .assets[]
+              | select(.name | test("^kata-static-.*-asterinas-amd64\\.tar\\.zst$"))
+              | .browser_download_url
+            ' | head -n 1
+          )"
+          test -n "${kata_static_tarball_url}"
+          kata_static_tarball_name="${kata_static_tarball_url##*/}"
+          kata_static_tarball_sha256="$(
+            gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '
+              .assets[]
+              | select(.name | test("^kata-static-.*-asterinas-amd64\\.SHA256SUMS$"))
+              | .browser_download_url
+            ' | head -n 1 |
+            xargs curl -fsSL |
+            awk -v asset_name="${kata_static_tarball_name}" '$2 == asset_name || $2 ~ ("/" asset_name "$") { print $1; exit }'
+          )"
+          test -n "${asterinas_version}"
+          test -n "${docker_image_version}"
+          test -n "${kata_static_tarball_sha256}"
+
+          echo "asterinas_version=${asterinas_version}" >> "${GITHUB_OUTPUT}"
+          echo "docker_image_version=${docker_image_version}" >> "${GITHUB_OUTPUT}"
+          echo "kata_static_tarball_url=${kata_static_tarball_url}" >> "${GITHUB_OUTPUT}"
+          echo "kata_static_tarball_sha256=${kata_static_tarball_sha256}" >> "${GITHUB_OUTPUT}"
+          {
+            echo '## Resolved upstream Asterinas image'
+            echo
+            echo "- \`VERSION\`: \`${asterinas_version}\`"
+            echo "- \`DOCKER_IMAGE_VERSION\`: \`${docker_image_version}\`"
+            echo "- Base image: \`asterinas/asterinas:${docker_image_version}\`"
+            echo "- Kata static tarball: \`${kata_static_tarball_url}\`"
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+  test-documented-end-user-flow:
+    name: Test documented end-user flow
+    needs:
+      - resolve-upstream-asterinas-image
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      KATA_DOC_LOG_DIR: /tmp/asterinas-kata-doc-logs/end-user
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check Host Device Visibility
+        shell: bash
+        run: |
+          set -euxo pipefail
+          ls -l /dev/kvm /dev/vhost-net /dev/vhost-vsock
+          ls -l /dev/vsock || true
+
+      - name: Install pexpect if Needed
+        shell: bash
+        run: |
+          set -euxo pipefail
+          if ! python3 - <<'PY'
+          import importlib.util
+          import sys
+          sys.exit(0 if importlib.util.find_spec("pexpect") else 1)
+          PY
+          then
+            python3 -m pip install --user pexpect
+          fi
+
+      - name: Pull Published Asterinas Kata Image
+        shell: bash
+        run: |
+          set -euxo pipefail
+          docker pull "asterinas/kata:${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}"
+
+      - name: Replay Documented End-User Flow
+        shell: bash
+        run: |
+          set -euxo pipefail
+          python3 -u tools/kata/interactive_doc_test.py \
+            --scenario end-user \
+            --kata-image "asterinas/kata:${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}" \
+            --log-dir "${KATA_DOC_LOG_DIR}"
+
+      - name: Upload End-User Flow Logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: asterinas-kata-doc-end-user-logs
+          path: ${{ env.KATA_DOC_LOG_DIR }}
+          if-no-files-found: ignore
+
+  test-documented-kernel-developer-flow:
+    name: Test documented kernel-developer flow
+    needs:
+      - resolve-upstream-asterinas-image
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    env:
+      KATA_DOC_LOG_DIR: /tmp/asterinas-kata-doc-logs/kernel-developer
+      KATA_STATIC_TARBALL_RELEASE_REPO: ${{ github.repository }}
+      KATA_STATIC_TARBALL_URL: ${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_url }}
+      KATA_STATIC_TARBALL_SHA256: ${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_sha256 }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check Out Asterinas Source
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.ASTERINAS_REPOSITORY }}
+          ref: ${{ env.ASTERINAS_REF }}
+          path: asterinas-src
+
+      - name: Prepare Local Asterinas Tree
+        shell: bash
+        run: |
+          set -euxo pipefail
+          rm -rf "${HOME}/asterinas"
+          mkdir -p "${HOME}/asterinas"
+          rsync -a --delete "${GITHUB_WORKSPACE}/asterinas-src/" "${HOME}/asterinas/"
+
+      - name: Check Host Device Visibility
+        shell: bash
+        run: |
+          set -euxo pipefail
+          ls -l /dev/kvm /dev/vhost-net /dev/vhost-vsock
+          ls -l /dev/vsock || true
+
+      - name: Install pexpect if Needed
+        shell: bash
+        run: |
+          set -euxo pipefail
+          if ! python3 - <<'PY'
+          import importlib.util
+          import sys
+          sys.exit(0 if importlib.util.find_spec("pexpect") else 1)
+          PY
+          then
+            python3 -m pip install --user pexpect
+          fi
+
+      - name: Pull Published Asterinas Builder Image
+        shell: bash
+        run: |
+          set -euxo pipefail
+          docker pull "asterinas/asterinas:${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}"
+
+      - name: Replay Documented Kernel-Developer Flow
+        shell: bash
+        run: |
+          set -euxo pipefail
+          python3 -u tools/kata/interactive_doc_test.py \
+            --scenario kernel-developer \
+            --asterinas-image "asterinas/asterinas:${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}" \
+            --asterinas-dir "${HOME}/asterinas" \
+            --log-dir "${KATA_DOC_LOG_DIR}"
+
+      - name: Upload Kernel-Developer Flow Logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: asterinas-kata-doc-kernel-developer-logs
+          path: ${{ env.KATA_DOC_LOG_DIR }}
+          if-no-files-found: ignore
diff --git a/.github/workflows/test-asterinas-kata.yml b/.github/workflows/test-asterinas-kata.yml
@@ -20,6 +20,8 @@ jobs:
     outputs:
       asterinas_version: ${{ steps.resolve.outputs.asterinas_version }}
       docker_image_version: ${{ steps.resolve.outputs.docker_image_version }}
+      kata_static_tarball_url: ${{ steps.resolve.outputs.kata_static_tarball_url }}
+      kata_static_tarball_sha256: ${{ steps.resolve.outputs.kata_static_tarball_sha256 }}
     steps:
       - name: Resolve Upstream Asterinas Image Metadata
         id: resolve
@@ -37,17 +39,39 @@ jobs:
             gh api repos/asterinas/asterinas/contents/DOCKER_IMAGE_VERSION?ref=main --jq .content |
               base64 -d | tr -d '\n'
           )"
+          kata_static_tarball_url="$(
+            gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '
+              .assets[]
+              | select(.name | test("^kata-static-.*-asterinas-amd64\\.tar\\.zst$"))
+              | .browser_download_url
+            ' | head -n 1
+          )"
+          test -n "${kata_static_tarball_url}"
+          kata_static_tarball_name="${kata_static_tarball_url##*/}"
+          kata_static_tarball_sha256="$(
+            gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '
+              .assets[]
+              | select(.name | test("^kata-static-.*-asterinas-amd64\\.SHA256SUMS$"))
+              | .browser_download_url
+            ' | head -n 1 |
+            xargs curl -fsSL |
+            awk -v asset_name="${kata_static_tarball_name}" '$2 == asset_name || $2 ~ ("/" asset_name "$") { print $1; exit }'
+          )"
           test -n "${asterinas_version}"
           test -n "${docker_image_version}"
+          test -n "${kata_static_tarball_sha256}"
 
           echo "asterinas_version=${asterinas_version}" >> "${GITHUB_OUTPUT}"
           echo "docker_image_version=${docker_image_version}" >> "${GITHUB_OUTPUT}"
+          echo "kata_static_tarball_url=${kata_static_tarball_url}" >> "${GITHUB_OUTPUT}"
+          echo "kata_static_tarball_sha256=${kata_static_tarball_sha256}" >> "${GITHUB_OUTPUT}"
           {
             echo '## Resolved upstream Asterinas image'
             echo
             echo "- \`VERSION\`: \`${asterinas_version}\`"
             echo "- \`DOCKER_IMAGE_VERSION\`: \`${docker_image_version}\`"
             echo "- Base image: \`asterinas/asterinas:${docker_image_version}\`"
+            echo "- Kata static tarball: \`${kata_static_tarball_url}\`"
           } >> "${GITHUB_STEP_SUMMARY}"
 
   build-published-kata-image:
@@ -88,6 +112,8 @@ jobs:
           build-args: |
             ASTERINAS_BASE_IMAGE=${{ env.ASTERINAS_BASE_IMAGE }}
             KATA_STATIC_TARBALL_RELEASE_REPO=${{ github.repository }}
+            KATA_STATIC_TARBALL_URL=${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_url }}
+            KATA_STATIC_TARBALL_SHA256=${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_sha256 }}
             ASTERINAS_RELEASE_VERSION=${{ needs.resolve-upstream-asterinas-image.outputs.asterinas_version }}
             ASTERINAS_DOCKER_IMAGE_VERSION=${{ needs.resolve-upstream-asterinas-image.outputs.docker_image_version }}
 
@@ -119,6 +145,8 @@ jobs:
       KATA_GUEST_KERNEL: ${{ matrix.guest_kernel }}
       KATA_TEST_IMAGE_LOG_LABEL: ${{ matrix.image_variant == 'source' && 'base image / guest kernel' || 'test image / guest kernel' }}
       KATA_TEST_IMAGE_LOG_VALUE: ${{ matrix.image_variant == 'source' && format('asterinas/asterinas:{0} / {1}', needs.resolve-upstream-asterinas-image.outputs.docker_image_version, matrix.guest_kernel) || format('asterinas/kata:{0} / {1}', needs.resolve-upstream-asterinas-image.outputs.docker_image_version, matrix.guest_kernel) }}
+      KATA_STATIC_TARBALL_URL: ${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_url }}
+      KATA_STATIC_TARBALL_SHA256: ${{ needs.resolve-upstream-asterinas-image.outputs.kata_static_tarball_sha256 }}
     defaults:
       run:
         shell: bash