Merge branch 'master' into add-verity-options-rebase-again

* master: (44 commits)
  wrappers: do not reload activation units (#14724)
  gadget/install: support for no{exec,dev,suid} mount flags
  interfaces/builtin/mount_control: add support for nfs mounts (#14694)
  tests: use gojq - part 1 (#14686)
  interfaces/desktop-legacy: allow DBus access to com.canonical.dbusmenu
  interfaces/builtin/fwupd.go: allow access to nvmem for thunderbolt plugin
  tests: removing uc16 executions (#14575)
  tests: Added arm github runner to build snapd (#14504)
  tests: no need to run spread when there are not tests matching the filter (#14728)
  tests/lib/tools/store-state: exit on errors, update relevant tests (#14725)
  tests: udpate the github workflow to run tests suggested by spread-filter tool (#14519)
  testtime: add mockable timers for use in tests (#14672)
  interface/screen_inhibit_control: Improve screen inhibit control for use on core (#14134)
  tests: use images with 20G disk in openstack (#14720)
  i/builtin: allow @ in custom-device filepaths (#14651)
  tests: refactor test-snapd-desktop-layout-with-content
  tests: fix broken app definition
  tests: capitalize sentences in comments
  tests: wrap very long shell line
  tests: fix raciness in async startup and sync install
  ...

.github/labeler.yml

@@ -3,11 +3,6 @@
 # - https://github.com/actions/labeler/issues/112
 # - https://github.com/actions/labeler/issues/104
 
-# Add 'Run nested -auto-' label to either any change on nested lib or nested test
-Run nested -auto-:
-  - tests/lib/nested.sh
-  - tests/nested/**/*
-
 # Add 'Needs Documentation -auto-' label to indicate a change needs changes in the docs
 Needs Documentation -auto-:
   - cmd/snap/**/*"

.github/workflows/actions/download-install-debian-deps/action.yaml

@@ -0,0 +1,28 @@
+name: 'Download cached dependencies and install Debian deps'
+description: 'Download and install Debian dependencies'
+inputs:
+  snapd-src-dir:
+    description: 'The snapd source code directory'
+    required: true
+    type: string
+
+runs:
+  using: "composite"
+  steps:
+  - name: Download Debian dependencies
+    uses: actions/download-artifact@v4
+    with:
+      name: debian-dependencies
+      path: ./debian-deps/
+
+  - name: Copy dependencies
+    shell: bash
+    run: |
+      test -f ./debian-deps/cached-apt.tar
+      sudo tar xvf ./debian-deps/cached-apt.tar -C /
+
+  - name: Install Debian dependencies
+    shell: bash
+    run: |
+        sudo apt update
+        sudo apt build-dep -y "${{ inputs.snapd-src-dir }}"

.github/workflows/snap-builds.yaml

@@ -0,0 +1,83 @@
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: 'A json list of tags to indicate which runner to use'
+        required: true
+        type: string
+      toolchain:
+        description: 'The go toolchain to use {default, FIPS}'
+        required: true
+        type: string
+      variant:
+        description: 'The type of snapd build {pristine, test}'
+        required: true
+        type: string
+
+jobs:
+  snap-builds:
+    runs-on: ${{ fromJSON(inputs.runs-on) }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Set artifact name
+      id: set_artifact_name
+      run: |
+        postfix="${{ inputs.toolchain }}-${{ inputs.variant }}"
+        if grep -iq "arm64" <<<"${{ inputs.runs-on }}"; then
+          echo "artifact_name=snap-files-arm64-${postfix}" >> $GITHUB_OUTPUT
+        else
+          echo "artifact_name=snap-files-amd64-${postfix}" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Select Go toolchain
+      run: |
+        case "${{ inputs.toolchain }}" in
+            default)
+                rm -f fips-build
+                ;;
+            FIPS)
+                touch fips-build
+                ;;
+            *)
+                echo "unknown toolchain ${{ inputs.toolchain }}"
+                exit 1
+                ;;
+        esac
+        case "${{ inputs.variant }}" in
+            pristine)
+                rm -f test-build
+                ;;
+            test)
+                touch test-build
+                ;;
+        esac
+
+    - name: Build snapd snap
+      uses: snapcore/action-build@v1
+      with:
+        snapcraft-channel: 8.x/stable
+        snapcraft-args: --verbose
+
+    - name: Check built artifact
+      run: |
+        unsquashfs snapd*.snap meta/snap.yaml usr/lib/snapd/
+        if cat squashfs-root/meta/snap.yaml | grep -q "version:.*dirty.*"; then
+          echo "PR produces dirty snapd snap version"
+          cat squashfs-root/usr/lib/snapd/dirty-git-tree-info.txt
+          exit 1
+        elif cat squashfs-root/usr/lib/snapd/info | grep -q "VERSION=.*dirty.*"; then
+          echo "PR produces dirty internal snapd info version"
+          cat squashfs-root/usr/lib/snapd/info
+          cat squashfs-root/usr/lib/snapd/dirty-git-tree-info.txt
+          exit 1
+        fi
+
+    - name: Uploading snapd snap artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.set_artifact_name.outputs.artifact_name }}
+        path: "*.snap"