Assisted-by: AI
Signed-off-by: gursewak1997 <[email protected]>

Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>

The previous attempt (merged in #2391) failed silently because
compute-ci-level had no checkout step, so gh pr diff could not
infer the repository and produced empty output. The pipe into
grep swallowed the error, setting docs_only=true for all PRs.

Fix by adding a sparse checkout for PR events, separating the
gh pr diff fetch from the grep so failures abort via set -euo
pipefail, and guarding empty output explicitly.

Assisted-by: AI
Signed-off-by: gursewak1997 <[email protected]>

`priv-integration.sh` was hanging at the chunkah step where we mount an
entire image inside a podman container. In the logs I can see
`overlay.mount_program=/usr/local/bin/fuse-overlayfs` which might be
causing the test to timeout since fuse-overlayfs is pretty slow and the
image has tons of layers.

Switch to native overlay diff which hopefully fixes the issue

Also, skip networking for chunkah container as I see podman hanging at

```
time="2026-08-20T07:45:34Z" level=debug msg="Adding mount /dev"
time="2026-08-20T07:45:34Z" level=debug msg="Adding mount /dev/pts"
time="2026-08-20T07:45:34Z" level=debug msg="Adding mount /dev/mqueue"
time="2026-08-20T07:45:34Z" level=debug msg="Adding mount /sys"
time="2026-08-20T07:45:34Z" level=debug msg="Adding mount /sys/fs/cgroup"
time="2026-08-20T07:45:34Z" level=debug msg="Successfully loaded 1 networks"
```

Convert the image to an oci dir instead of trying to mount the entire
image

Signed-off-by: Pragyan Poudyal <[email protected]>

This job has been hanging in the chunkah/podman step for hours even
after the native-overlay fix in the previous commit, likely blocking
this PR and others behind unrelated CI infrastructure flakiness.

Disable it for now via if: false (same pattern used for test-coreos)
so it reports as skipped rather than pending/failed, and doesn't block
required-checks-heavy. Re-enable once the hang is root-caused.

Assisted-by: AI
Signed-off-by: Colin Walters <[email protected]>

CentOS 10 UKI CI jobs fail "bootc container export --format=tar" with
"No label found in policy ... for /var/tmp/rhc". rhc's post-install
scriptlet drops runtime state under /var/tmp during image build (same
rhc-1:0.3.12-1.el10 build in both passing and failing CI runs, so this
isn't a version regression in rhc itself), and the SELinux targeted
policy simply has no file-context entry for it. This only reproduces
reliably on the composefs+uki matrix legs, likely because that build
path takes long enough for the scriptlet's async write to land before
the image layer is committed - the file can be present or absent on
other legs depending on timing.

Rather than trying to tolerate arbitrary unlabeled paths anywhere in
the tree (which risks silently exporting genuinely mislabeled files),
extend the existing SKIP_PATHS list to always exclude /tmp and
/var/tmp. These are meant to hold only ephemeral, runtime-created
content - ostree-ext::commit's FORCE_CLEAN_PATHS already treats the
same two paths (plus /run and /var/cache) this way for regular ostree
commits, so tar export dropping them is consistent with how bootc
already treats the real /var as not being part of the shippable
content.

Add a unit test exercising export_filesystem_walk() directly (with
SELinux labeling disabled) against a synthetic root, verifying /tmp
and /var/tmp content is dropped while everything else is kept.

Assisted-by: AI
Signed-off-by: Colin Walters <[email protected]>

Document bootc's release process, versioning strategy, and support
policies for CNCF incubation (Issue #36). Covers semantic versioning,
weekly release cadence, the automated release workflow, release assets,
GPG-signed tags, pre-releases, security releases, and stability
guarantees.

Reflects decisions from the August 2026 community meeting: releases are
tagged from main with no release branches or backporting, deprecations
are announced in minor releases, and feature releases use minor version
bumps. Support duration and the deprecation advance-notice window remain
open questions pending broader maintainer input.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Signed-off-by: mohan-shash <[email protected]>

Add ROADMAP.md following the containerd model, using GitHub issues as
the "what" and milestones as the "when" rather than a static list that
quickly goes stale. Includes bootc's strategic direction and guidance
on how the community can contribute to the roadmap (Issue #35).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Signed-off-by: mohan-shash <[email protected]>

The transient overlay created by `bootc usr-overlay` is backed by a
tmpfs filesystem, meaning installed packages consume system RAM rather
than persistent disk.  The kernel default sizes this tmpfs at 50% of
physical RAM, and there is currently no pre-flight space check before
the overlay fills up.

This is not obvious from the existing documentation and can lead to
confusing ENOSPC errors on memory-constrained systems such as CI
runners or small VMs, where users may assume the overlay uses disk
storage.

Assisted-by: AI
Signed-off-by: Joseph Marrero Corchado <[email protected]>

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>