Merge remote-tracking branch 'upstream/master' into spark/aarch64-settings-boot-dropins

# Conflicts:
#	.github/workflows/test.yml

.github/workflows/test.yml

@@ -1,9 +1,11 @@
 name: Tests
 
+# PR-only. Publishing on push has its own workflow and is what verifies the
+# merged tree: it resolves every package against the live channel and refuses
+# a filename that already exists with different bytes, so two PRs cannot land
+# the same version twice. A post-merge test run would only repeat the PR's.
 on:
   pull_request:
-  push:
-    branches: [master]
   workflow_dispatch:
 
 jobs:
@@ -30,6 +32,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Test PR workflow approval
+        run: node --test tests/pr-workflow-approval.cjs
+
+      - name: Test builder images
+        run: node --test tests/builder-image.cjs
+
       # An Arch container for vercmp: version ordering has to be decided by
       # the same comparator pacman uses on users' machines.
       - name: Run self-tests
@@ -40,6 +48,7 @@ jobs:
             archlinux:base-devel bash -lc '
               set -euo pipefail
               pacman -Syu --noconfirm git jq python libarchive
+              python tests/oma-service-removal.py
               python tests/upstream-watch.py
               ./bin/sync-upstream self-test
               ./bin/sync-rebuilds --self-test
@@ -48,4 +57,8 @@ jobs:
               ./tests/partial-release.sh
               ./tests/published-build-plan.sh
               ./tests/settings-boot-config.sh
+              ./tests/controller.sh
+              ./tests/artifact-helpers.sh
+              pacman -S --noconfirm --quiet rclone >/dev/null
+              ./tests/publish-artifact.sh
             '