From fc44b26e58f61ab3643cedc71b7f87691c65febc Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 15 Sep 2026 13:39:45 +0900
Subject: [PATCH] CI: extract VM provisioning into host scripts

Kernel module loading and guest package setup are embedded in the VM
workflow. This was sufficient when the guest only hosted the DIND
development container, but native testing needs provisioning that can
also be run and checked outside GitHub Actions.

Move the existing commands into hack/host scripts, executed as root in
the guest. Keep the socket's login user supplied by the runner so this
preparatory refactor preserves the existing Docker setup.

Assisted-by: Codex
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/.vm.yml        | 37 ++------------------------------
 hack/host/load-kernel-modules.sh | 30 ++++++++++++++++++++++++++
 hack/host/provision.sh           | 14 ++++++++++++
 3 files changed, 46 insertions(+), 35 deletions(-)
 create mode 100755 hack/host/load-kernel-modules.sh
 create mode 100755 hack/host/provision.sh

diff --git a/.github/workflows/.vm.yml b/.github/workflows/.vm.yml
index 5ce610f664..b4ab143201 100644
--- a/.github/workflows/.vm.yml
+++ b/.github/workflows/.vm.yml
@@ -77,45 +77,12 @@ jobs:
       -
         name: Load kernel modules in the guest VM
         run: |
-          set -eux -o pipefail
-          cat <<-EOF | lima sudo tee /etc/modules-load.d/docker.conf
-          br_netfilter
-          bridge
-          ip6_tables
-          ip6table_filter
-          ip6table_nat
-          ip_tables
-          ip_vs
-          iptable_filter
-          iptable_nat
-          nf_tables
-          overlay
-          tap
-          tun
-          veth
-          x_tables
-          xt_addrtype
-          xt_comment
-          xt_conntrack
-          xt_mark
-          xt_multiport
-          xt_nat
-          xt_tcpudp
-          EOF
-          lima sudo systemctl restart systemd-modules-load.service
+          lima sudo bash < hack/host/load-kernel-modules.sh
       -
         name: Install dockerd in the guest VM
         run: |
           set -eux -o pipefail
-          lima sudo mkdir -p /etc/systemd/system/docker.socket.d
-          cat <<-EOF | lima sudo tee /etc/systemd/system/docker.socket.d/override.conf
-          [Socket]
-          SocketUser=$(whoami)
-          EOF
-          # TODO: use native packages for AlmaLinux: https://github.com/docker/packaging/pull/138
-          lima sudo dnf config-manager --add-repo=https://download.docker.com/linux/rhel/docker-ce.repo
-          lima sudo dnf -q -y install --nobest docker-ce make git
-          lima sudo systemctl enable --now docker
+          lima sudo bash -s -- "$(whoami)" < hack/host/provision.sh
           lima docker info
       -
         name: Copy the current directory
diff --git a/hack/host/load-kernel-modules.sh b/hack/host/load-kernel-modules.sh
new file mode 100755
index 0000000000..bfc987f19c
--- /dev/null
+++ b/hack/host/load-kernel-modules.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -eux -o pipefail
+
+cat << EOF > /etc/modules-load.d/docker.conf
+br_netfilter
+bridge
+ip6_tables
+ip6table_filter
+ip6table_nat
+ip_tables
+ip_vs
+iptable_filter
+iptable_nat
+nf_tables
+overlay
+tap
+tun
+veth
+x_tables
+xt_addrtype
+xt_comment
+xt_conntrack
+xt_mark
+xt_multiport
+xt_nat
+xt_tcpudp
+EOF
+
+systemctl restart systemd-modules-load.service
diff --git a/hack/host/provision.sh b/hack/host/provision.sh
new file mode 100755
index 0000000000..7b29288036
--- /dev/null
+++ b/hack/host/provision.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -eux -o pipefail
+
+# The argument is the login user that will run Docker in the guest.
+mkdir -p /etc/systemd/system/docker.socket.d
+cat <<- EOF | tee /etc/systemd/system/docker.socket.d/override.conf
+	[Socket]
+	SocketUser=$1
+EOF
+# TODO: use native packages for AlmaLinux: https://github.com/docker/packaging/pull/138
+dnf config-manager --add-repo=https://download.docker.com/linux/rhel/docker-ce.repo
+dnf -q -y install --nobest docker-ce make git
+systemctl enable --now docker