ci: Build image from Containerfile when tag changes

.github/workflows/Containerfile

@@ -0,0 +1,53 @@
+# This Containerfile builds the image that we use in all github workflows.
+# When this file is changed, or one needs to rebuild the image for another
+# reason, bump the `IMAGE_TAG` in the container.yml workflow.
+
+FROM ubuntu:latest
+
+RUN apt update
+RUN apt upgrade -y
+
+# Install dependencies
+RUN apt install -y --no-install-recommends \
+    gcc clang \
+    ca-certificates \
+    desktop-file-utils \
+    fuse3 \
+    gettext \
+    git \
+    gnome-desktop-testing \
+    gtk-doc-tools \
+    libcap2-bin \
+    libflatpak-dev \
+    libfontconfig1-dev \
+    libfuse3-dev \
+    libgdk-pixbuf-2.0-dev \
+    librsvg2-2 \
+    librsvg2-common \
+    libgeoclue-2-dev \
+    libglib2.0-dev \
+    libjson-glib-dev \
+    libpipewire-0.3-dev \
+    libsystemd-dev \
+    libtool \
+    llvm \
+    libclang-rt-18-dev \
+    python3-gi \
+    shared-mime-info
+
+# Install meson
+RUN apt install -y --no-install-recommends meson
+
+# Install pytest
+RUN apt install -y --no-install-recommends \
+    python3-pytest \
+    python3-pytest-xdist \
+    python3-dbusmock \
+    python3-dbus
+
+# Install doc dependencies
+RUN apt install -y --no-install-recommends \
+    python3-sphinx-copybutton \
+    python3-sphinxext-opengraph \
+    furo \
+    python3-sphinx

.github/workflows/build-and-test.yml

@@ -0,0 +1,98 @@
+name: Build and Test
+
+on: [push, pull_request]
+
+env:
+  TESTS_TIMEOUT: 10 # in minutes
+
+jobs:
+  build-container:
+    uses: ./.github/workflows/container.yml
+    permissions:
+      packages: write
+
+  build-and-test:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    needs: build-container
+    strategy:
+      matrix:
+        compiler: ['gcc', 'clang']
+        sanitizer: ['address']
+
+    container:
+      image: ${{ needs.build-container.outputs.image }}
+      env:
+        CFLAGS: -Wp,-D_FORTIFY_SOURCE=2
+        CC: ${{ matrix.compiler }}
+        TEST_IN_CI: 1
+        G_MESSAGES_DEBUG: all
+      options: ${{ needs.build-container.outputs.image_options }}
+
+    steps:
+      - name: Configure environment
+        run: |
+          git config --global --add safe.directory $GITHUB_WORKSPACE
+          echo XDG_DATA_DIRS=$GITHUB_WORKSPACE/tests/share:/usr/local/share:/usr/share | tee -a $GITHUB_ENV
+
+      - name: Check out xdg-desktop-portal
+        uses: actions/checkout@v4
+
+      - name: Check out libportal fork with a similarly named branch
+        id: libportal-branched
+        uses: actions/checkout@v4
+        continue-on-error: true
+        with:
+          repository: ${{ github.actor }}/libportal
+          ref: ${{ github.head_ref || github.ref_name }}
+          path: libportal
+
+      - name: Check out libportal default branch
+        if: steps.libportal-branched.outcome == 'failure'
+        uses: actions/checkout@v4
+        with:
+          repository: flatpak/libportal
+          path: libportal
+
+      - name: Build libportal
+        run: |
+          meson setup libportal _build_libportal $MESON_OPTIONS
+          meson compile -C _build_libportal
+          meson install -C _build_libportal
+        env:
+          MESON_OPTIONS: --prefix=/usr -Ddocs=false -Dintrospection=false -Dtests=false
+
+      - name: Build xdg-desktop-portal
+        run: |
+          meson setup _build $MESON_OPTIONS
+          meson compile -C _build
+        env:
+          MESON_OPTIONS: -Dinstalled-tests=true -Dpytest=enabled -Db_sanitize=${{ matrix.sanitizer }}
+
+      - name: Run xdg-desktop-portal tests
+        run: timeout --signal=KILL -v ${TESTS_TIMEOUT}m meson test -C _build
+
+      - name: Install xdg-desktop-portal
+        run: meson install -C _build
+
+      - name: Run xdg-desktop-portal installed-tests
+        run: |
+          test -n "$(gnome-desktop-testing-runner -l xdg-desktop-portal)"
+          gnome-desktop-testing-runner --report-directory installed-test-logs/ \
+            -t $((TESTS_TIMEOUT * 60)) xdg-desktop-portal
+
+      - name: Create dist tarball
+        run: |
+          ls -la
+          timeout --signal=KILL -v ${TESTS_TIMEOUT}m meson dist -C _build
+
+      - name: Upload test logs
+        uses: actions/upload-artifact@v4
+        if: success() || failure()
+        with:
+          name: test logs (${{ matrix.compiler }}, ${{ matrix.sanitizer }})
+          path: |
+            tests/*.log
+            test-*.log
+            installed-test-logs/
+            _build/meson-logs/testlog.txt

.github/workflows/container.yml

@@ -0,0 +1,52 @@
+name: Create build container
+
+env:
+  IMAGE_TAG: 20241008-1
+
+on:
+  workflow_call:
+    outputs:
+      image:
+        description: "The build image"
+        value: ${{ jobs.build-container.outputs.image }}
+      image_options:
+        description: "The options to use with the image"
+        value: --device /dev/fuse --cap-add SYS_ADMIN --security-opt apparmor:unconfined --privileged
+
+jobs:
+  build-container:
+    name: Create build container
+    runs-on: ubuntu-latest
+
+    outputs:
+      image: ${{ steps.check.outputs.image }}
+
+    steps:
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set lower case owner name
+        env:
+          OWNER: '${{ github.repository_owner }}'
+        run: |
+          echo "OWNER_LOWERCASE=${OWNER,,}" >>${GITHUB_ENV}
+
+      - name: Check if image already exists on GHCR
+        id: check
+        run: |
+          image=ghcr.io/${{ env.OWNER_LOWERCASE }}/xdg-desktop-portal:${{ env.IMAGE_TAG }}
+          echo "exists=$(docker manifest inspect $image >/dev/null && echo 'true' || echo 'false')" \
+            >> "$GITHUB_OUTPUT"
+          echo "image=$image" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        if: ${{ steps.check.outputs.exists == 'false' }}
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          file: .github/workflows/Containerfile
+          tags: ghcr.io/${{ env.OWNER_LOWERCASE }}/xdg-desktop-portal:${{ env.IMAGE_TAG }}