norrietaylor · Jul 9, 2026 · Jul 9, 2026 · Jul 9, 2026 · Jul 9, 2026 · Jul 9, 2026
@@ -8,18 +8,8 @@ description: >
 runs:
   using: composite
   steps:
-    - name: Free Disk Space
-      uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
-      with:
-        remove_android: true
-        remove_dotnet: true
-        remove_haskell: true
-        remove_tool_cache: true
-    - name: Install protoc
-      shell: bash
-      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-    - name: Cache cargo registry and build artifacts
-      uses: Swatinem/rust-cache@v2
+    - name: Setup Rust
+      uses: ./.github/actions/setup-rust
     - name: Install nextest
       uses: taiki-e/install-action@v2
       with:

@@ -0,0 +1,39 @@
+name: Setup libkrun (Linux)
+description: >
+  Materialize the upstream libkrun package (libkrun.so + libkrunfw.so.5) into
+  a flat prefix at ~/.krun via scripts/fetch-libkrun.sh — a cache fetch keyed
+  by the pinned upstream commit, NOT a from-source build — and publish
+  LIBKRUN_PREFIX (minvmd build.rs link search + rpath) and LD_LIBRARY_PATH
+  (libkrun.so -> libkrunfw.so.5 at runtime) to GITHUB_ENV for later steps.
+  The job-wide LD_LIBRARY_PATH is safe to persist: fetch-libkrun.sh strips
+  the package's glibc/libgcc layers, so the prefix holds only the libkrun
+  libraries and shadows nothing. Assumes the repository is checked out and
+  any cargo cache restore has already happened (without a prebuilt mip the
+  fetch builds the mip CLI).
+
+inputs:
+  arch:
+    description: Kernel-style arch (x86_64 or aarch64)
+    required: true
+  mip:
+    description: >
+      Optional path to a prebuilt mip binary; skips compiling a debug mip
+      just to drive the cache fetch.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Materialize libkrun prefix (upstream package)
+      shell: bash
+      env:
+        ARCH: ${{ inputs.arch }}
+        MIP: ${{ inputs.mip }}
+      run: |
+        prefix="$HOME/.krun"
+        ./scripts/fetch-libkrun.sh "$prefix" "$ARCH"
+        {
+          echo "LIBKRUN_PREFIX=$prefix"
+          echo "LD_LIBRARY_PATH=$prefix${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+        } >> "$GITHUB_ENV"
@@ -0,0 +1,32 @@
+name: Setup libkrun (macOS)
+description: >
+  Provision libkrun from the slp/krun Homebrew tap. Self-installing keeps
+  macOS jobs from depending on hand-provisioned runner state — a missing
+  libkrun.dylib silently broke every code PR. Idempotent (a no-op when
+  already present); same tap the runner setup used, so the supply-chain
+  surface is unchanged. The existence check matters even after a successful
+  install: brew exits 0 for an installed-but-UNLINKED keg ("it's just not
+  linked"), a plausible state on a persistent shared runner, and minvmd's
+  build.rs links against /opt/homebrew/lib unconditionally on macOS.
+
+runs:
+  using: composite
+  steps:
+    - name: Provision libkrun (slp/krun tap)
+      shell: bash
+      run: brew install slp/krun/libkrun
+    - name: Verify libkrun is available (>= 1.19.0)
+      # krun_add_disk3 (the /dev/vdb attach) needs libkrun >= 1.19.0. Assert
+      # the runner's libkrun exports it, so a stale runner fails here with an
+      # actionable message instead of a cryptic dyld symbol-not-found at boot.
+      shell: bash
+      run: |
+        dylib=/opt/homebrew/lib/libkrun.dylib
+        if [ ! -f "$dylib" ]; then
+          echo "::error::libkrun.dylib not found under /opt/homebrew/lib despite brew exiting 0 (installed-but-unlinked keg?). Fix with: brew link slp/krun/libkrun" >&2
+          exit 1
+        fi
+        if ! nm -gU "$dylib" 2>/dev/null | grep -q '_krun_add_disk3'; then
+          echo "::error::runner libkrun lacks krun_add_disk3 (need >= 1.19.0); upgrade with: brew upgrade slp/krun/libkrun" >&2
+          exit 1
+        fi
@@ -11,7 +11,6 @@ runs:
         remove_dotnet: true
         remove_haskell: true
     - name: Install Minimal
-      if: steps.cache-minimal.outputs.cache-hit != 'true'
       shell: bash
       run: |
         curl --proto '=https' --tlsv1.2 -sSf https://storage.googleapis.com/minimal-shim/install.sh | sh -s -- -y

@@ -0,0 +1,21 @@
+name: Setup Rust
+description: >
+  Common Rust CI preamble for GitHub-hosted Ubuntu runners: free disk space,
+  install protoc, and restore the cargo registry/build cache. Assumes the
+  repository is already checked out.
+
 runs:
+  using: composite
+  steps:
+    - name: Free Disk Space
+      uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
+      with:
+        remove_android: true
+        remove_dotnet: true
+        remove_haskell: true
+        remove_tool_cache: true
+    - name: Install protoc
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+    - name: Cache cargo registry and build artifacts
+      uses: Swatinem/rust-cache@v2
@@ -26,6 +26,10 @@ on:
       - "Cargo.lock"
       - ".minimal/minimal.toml"
       - ".github/workflows/ci-linux-kvm.yml"
+      # Composite actions this lane's setup runs through — without these, a
+      # composite-only edit would skip this lane and break it post-merge.
+      - ".github/actions/setup-libkrun-linux/**"
+      - ".github/actions/materialize/**"
   pull_request:
     branches: ["main"]
     paths:
@@ -36,6 +40,10 @@ on:
       - "Cargo.lock"
       - ".minimal/minimal.toml"
       - ".github/workflows/ci-linux-kvm.yml"
+      # Composite actions this lane's setup runs through — without these, a
+      # composite-only edit would skip this lane and break it post-merge.
+      - ".github/actions/setup-libkrun-linux/**"
+      - ".github/actions/materialize/**"
   workflow_dispatch:
 
 env:
@@ -103,28 +111,18 @@ jobs:
           ls -l /dev/kvm
 
       - name: Resolve build paths
-        # Publish the libkrun prefix and guest-artifact paths (plus the E2E gate)
-        # to $GITHUB_ENV for later steps; `runner.temp`/`$HOME` are not available
-        # in job-level `env:`.
+        # Publish the guest-artifact paths (plus the E2E gate) to $GITHUB_ENV
+        # for later steps; `runner.temp` is not available in job-level `env:`.
+        # The libkrun link + runtime paths (LIBKRUN_PREFIX, LD_LIBRARY_PATH)
+        # are published by the setup-libkrun-linux composite below.
         run: |
           {
-            echo "KRUN_PREFIX=$HOME/.krun"
             echo "MINVMD_E2E=1"
             echo "MINVMD_KERNEL_PATH=$RUNNER_TEMP/vmlinuz"
             echo "MINVMD_ROOTFS_PATH=$RUNNER_TEMP/rootfs.img"
             echo "MINVMD_INITRAMFS=$RUNNER_TEMP/initramfs.cpio"
           } >> "$GITHUB_ENV"
 
-      - name: Export libkrun link + runtime paths
-        # LIBKRUN_PREFIX: minvmd build.rs link-search dir (it emits an rpath to
-        # it too). LD_LIBRARY_PATH: libkrun.so -> libkrunfw.so.5 at runtime. Both
-        # point at the flat prefix that the materialize step below populates.
-        run: |
-          {
-            echo "LIBKRUN_PREFIX=$KRUN_PREFIX"
-            echo "LD_LIBRARY_PATH=$KRUN_PREFIX${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-          } >> "$GITHUB_ENV"
-
       - name: Install cross
         uses: taiki-e/install-action@v2
         with:
@@ -143,18 +141,21 @@ jobs:
           restore-keys: ${{ runner.os }}-x86_64-minvmd-kvm-
 
       - name: Materialize libkrun prefix (upstream package)
-        # Cache fetch of the upstream libkrun package (libkrun.so + libkrunfw.so.5),
-        # extracted into $KRUN_PREFIX. Runs after the cargo cache restore so the
-        # `minimal` CLI build it drives is incremental.
-        run: ./scripts/fetch-libkrun.sh "$KRUN_PREFIX" x86_64
+        # Runs after the cargo cache restore so the CLI build the cache fetch
+        # drives is incremental.
+        uses: ./.github/actions/setup-libkrun-linux
+        with:
+          arch: x86_64
 
       - name: Assert libkrun exports krun_add_disk3 (>= 1.19.0)
         # krun_add_disk3 (this PR's /dev/vdb attach) needs libkrun >= 1.19.0. Fail
         # loudly here rather than with a cryptic runtime error at VM boot if the
         # materialized upstream libkrun is too old.
+        # LIBKRUN_PREFIX is published by the setup-libkrun-linux composite above
+        # (the old KRUN_PREFIX env was retired with the composite extraction).
         run: |
-          so="$(ls "$KRUN_PREFIX"/libkrun.so* 2>/dev/null | head -1)"
-          test -n "$so" || { echo "::error::no libkrun.so under $KRUN_PREFIX"; exit 1; }
+          so="$(ls "$LIBKRUN_PREFIX"/libkrun.so* 2>/dev/null | head -1)"
+          test -n "$so" || { echo "::error::no libkrun.so under $LIBKRUN_PREFIX"; exit 1; }
           nm -D "$so" 2>/dev/null | grep -q krun_add_disk3 \
             || { echo "::error::materialized libkrun ($so) does not export krun_add_disk3; need >= 1.19.0"; exit 1; }
           echo "libkrun OK: $so exports krun_add_disk3"

@@ -16,6 +16,10 @@ on:
             - "Cargo.lock"
             - ".github/workflows/ci-macos.yml"
             - "scripts/**"
+            # Composite actions this lane's setup runs through — without these,
+            # a composite-only edit would skip this lane and break it post-merge.
+            - ".github/actions/setup-libkrun-macos/**"
+            - ".github/actions/materialize/**"
     pull_request:
         branches: ["main"]
         paths:
@@ -27,6 +31,10 @@ on:
             - "Cargo.lock"
             - ".github/workflows/ci-macos.yml"
             - "scripts/**"
+            # Composite actions this lane's setup runs through — without these,
+            # a composite-only edit would skip this lane and break it post-merge.
+            - ".github/actions/setup-libkrun-macos/**"
+            - ".github/actions/materialize/**"
     workflow_dispatch:
 
 env:
@@ -148,25 +156,7 @@ jobs:
             - name: Toolchain
               uses: dtolnay/rust-toolchain@stable
             - name: Provision libkrun (slp/krun tap)
-              # Self-install libkrun so macOS jobs no longer depend on hand-provisioned
-              # runner state — a missing libkrun.dylib silently broke every code PR.
-              # Idempotent (a no-op when already present); same slp/krun tap the runner
-              # setup used, so the supply-chain surface is unchanged.
-              run: brew install slp/krun/libkrun
-            - name: Verify libkrun is available (>= 1.19.0)
-              # krun_add_disk3 (the /dev/vdb attach) needs libkrun >= 1.19.0. Assert
-              # the runner's libkrun exports it, so a stale runner fails here with an
-              # actionable message instead of a cryptic dyld symbol-not-found at boot.
-              run: |
-                  dylib=/opt/homebrew/lib/libkrun.dylib
-                  if [ ! -f "$dylib" ]; then
-                    echo "::error::libkrun.dylib not found under /opt/homebrew/lib. Provision the runner with: brew install slp/krun/libkrun" >&2
-                    exit 1
-                  fi
-                  if ! nm -gU "$dylib" 2>/dev/null | grep -q '_krun_add_disk3'; then
-                    echo "::error::runner libkrun lacks krun_add_disk3 (need >= 1.19.0); upgrade with: brew upgrade slp/krun/libkrun" >&2
-                    exit 1
-                  fi
+              uses: ./.github/actions/setup-libkrun-macos
             - name: Download virtio-linux kernel
               uses: actions/download-artifact@v8
               with:
@@ -212,16 +202,25 @@ jobs:
                   MINVMD_INITRAMFS="$RUNNER_TEMP/initramfs/initramfs.cpio" \
                   MINVMD_BOOT_LOG="$RUNNER_TEMP/boot.log" \
                     "$testbin" --include-ignored --nocapture --exact minimald_exec_over_bridge
-            - name: Reap the Session-E2E VM before auto-spawn
+            - name: Reap Session-E2E leftovers before auto-spawn
               # The session harness (Guest::drop) kills its minvmd but not the
-              # detached `__krun-vmm` grandchild it spawned; that VM lingers into
-              # the Auto-spawn step and, as a second concurrent VM, wedges the
-              # host→guest bridge over libkrun's vsock (#588), so the cold
-              # `minimal ls` connection is never delivered to the guest accept
-              # loop. Reap it so Auto-spawn starts from the single-VM state it had
-              # when it was its own job (before the boot+autospawn jobs merged).
+              # rest of the process tree it spawned: the detached `__krun-vmm`
+              # grandchild AND the host gvproxy switch minvmd owns. Either
+              # leftover wedges the host→guest bridge over libkrun's vsock
+              # (#588) — a healthy guest accept loop that never receives the
+              # bridged connection — so the cold `minimal ls` dies with `ssh
+              # connect: Disconnected`. The `__krun-vmm`-only reap proved
+              # insufficient: main run 29032763009 (on the commit that added
+              # it) failed exactly this way, with the new VM's proxy-publish
+              # WARN pointing at a lingering gvproxy. Reap the whole tree —
+              # any stray minvmd first (so nothing respawns), then the VMM and
+              # gvproxy — so Auto-spawn starts from the single-VM state it had
+              # when it was its own job. The proper fix (harness reaps its own
+              # process group) is tracked under #588.
               run: |
+                  pkill -x minvmd 2>/dev/null || true
                   pkill -f '__krun-vmm' 2>/dev/null || true
+                  pkill -f gvproxy 2>/dev/null || true
                   sleep 1
             - name: Auto-spawn E2E (minimal ls cold/warm, R4.5)
               # The R4.5 CLI proof artifact, on real hardware. From a clean state
@@ -329,25 +328,7 @@ jobs:
               with:
                   components: clippy
             - name: Provision libkrun (slp/krun tap)
-              # Self-install libkrun from the slp/krun tap so this job no longer depends
-              # on hand-provisioned runner state. Idempotent (a no-op when already
-              # present); same tap the runner setup used, so the supply-chain surface
-              # is unchanged.
-              run: brew install slp/krun/libkrun
-            - name: Verify libkrun is available (>= 1.19.0)
-              # krun_add_disk3 (the /dev/vdb attach) needs libkrun >= 1.19.0. Assert
-              # the runner's libkrun exports it, so a stale runner fails here with an
-              # actionable message instead of a cryptic dyld symbol-not-found at boot.
-              run: |
-                  dylib=/opt/homebrew/lib/libkrun.dylib
-                  if [ ! -f "$dylib" ]; then
-                    echo "::error::libkrun.dylib not found under /opt/homebrew/lib. Provision the runner with: brew install slp/krun/libkrun" >&2
-                    exit 1
-                  fi
-                  if ! nm -gU "$dylib" 2>/dev/null | grep -q '_krun_add_disk3'; then
-                    echo "::error::runner libkrun lacks krun_add_disk3 (need >= 1.19.0); upgrade with: brew upgrade slp/krun/libkrun" >&2
-                    exit 1
-                  fi
+              uses: ./.github/actions/setup-libkrun-macos
             - name: Clippy (minvmd)
               run: cargo clippy -p minvmd --all-targets -- -D warnings
             - name: Test (minvmd)

@@ -40,18 +40,8 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 30
         steps:
-            - name: Free Disk Space
-              uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
-              with:
-                  remove_android: true
-                  remove_dotnet: true
-                  remove_haskell: true
-                  remove_tool_cache: true
             - uses: actions/checkout@v7
-            - name: Install protoc
-              run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-            - name: Cache cargo registry and build artifacts
-              uses: Swatinem/rust-cache@v2
+            - uses: ./.github/actions/setup-rust
             - name: Run Clippy
               run: cargo clippy --workspace --all-targets -- -D warnings