feat: Add integration test framework

.bazelrc

@@ -56,16 +56,35 @@ common:x86_64-qnx --config=_toolchain_common
 common:x86_64-qnx --platforms=@score_bazel_platforms//:x86_64-qnx-sdp_8.0.0-posix
 common:x86_64-qnx --extra_toolchains=@score_qcc_x86_64_toolchain//:all
 common:x86_64-qnx --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_pc_nto_qnx800
+common:x86_64-qnx --extra_toolchains=@score_qnx_x86_64_ifs_toolchain//:all
 common:x86_64-qnx --repo_env=TARGET_ARCH=x86_64
 
 common:aarch64-qnx --config=_toolchain_common
 common:aarch64-qnx --platforms=@score_bazel_platforms//:aarch64-qnx-sdp_8.0.0-posix
 common:aarch64-qnx --extra_toolchains=@score_qcc_aarch64_toolchain//:all
 common:aarch64-qnx --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_aarch64_unknown_nto_qnx800
+common:aarch64-qnx --extra_toolchains=@score_qnx_aarch64_ifs_toolchain//:all
 common:aarch64-qnx --repo_env=TARGET_ARCH=aarch64
 
 common --credential_helper=*.qnx.com=%workspace%/.github/tools/qnx_credential_helper.py
 
+# Force linux-sandbox to integration test execution only.
+# All integration tests have to have "integration_test" in their rule name,
+# otherwise they will be executed without sandboxing, which is not desired.
+# QEMU-based integration tests must run in linux-sandbox because they modify
+# network interfaces and IP configuration. Use this config for those runs:
+#   bazel test --config=qemu-integration //...
+test:qemu-integration --strategy_regexp='^Testing .*integration_test.*=linux-sandbox'
+test:qemu-integration --//quality/integration_testing/flags:linux_backend=qemu
+test:qemu-integration --run_under=@score_itf//scripts:run_under_qemu
+test:x86_64-qnx --strategy_regexp='^Testing .*integration_test.*=linux-sandbox'
+test:x86_64-qnx --run_under=@score_itf//scripts:run_under_qemu
+test:aarch64-qnx --strategy_regexp='^Testing .*integration_test.*=linux-sandbox'
+test:aarch64-qnx --run_under=@score_itf//scripts:run_under_qemu
+# Enforce isolated network namespaces for sandboxed tests (linux-sandbox), required by fixed network ports
+test --nosandbox_default_allow_network
+
+
 test --test_output=errors
 build --incompatible_strict_action_env
 

.bazelversion

@@ -1 +1 @@
-8.3.0
+8.4.1

.devcontainer/Dockerfile

@@ -28,5 +28,7 @@ RUN if [ "$USERNAME" != "vscode" ]; then \
         && chmod 0440 /etc/sudoers.d/${USERNAME}; \
     fi
 
+RUN apt-get update && apt-get install -y qemu-system-x86 iputils-ping tcpdump cloud-image-utils
+
 # Set the default user for the container
 USER ${USERNAME}

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:3": {
+      "version": "3.0.1",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:ca2508495b01ba29eba93e8153772a2daa65eaa86471cc6863fe2a3d21933df9",
+      "integrity": "sha256:ca2508495b01ba29eba93e8153772a2daa65eaa86471cc6863fe2a3d21933df9"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -8,7 +8,8 @@
     },
     "remoteUser": "${localEnv:USER}",
     "runArgs": [
-        "--privileged"
+        "--privileged",
+        "--device=/dev/kvm"
     ],
     "mounts": [
         {
@@ -22,13 +23,17 @@
             "type": "bind"
         }
     ],
+    "features": {
+        "ghcr.io/devcontainers/features/docker-in-docker:3": {}
+    },
     "initializeCommand": {
         "Make sure QNX licenses exists": "mkdir -p ~/.qnx/license && touch -a ~/.qnx/license/licenses",
         "Make sure .netrc exists": "touch -a ~/.netrc"
     },
     "onCreateCommand": {
         "Setup external symlink": "[ -L external ] || ln -s \"bazel-$(basename $PWD)/external\" external"
     },
+    "postStartCommand": "sudo chmod 666 /dev/kvm",
     "customizations": {
         "vscode": {
             "extensions": [

.github/workflows/build_and_test_host.yml

@@ -58,3 +58,48 @@ jobs:
           bazel test //... --build_tests_only
       - run: df -h
         if: always()
+
+  build_and_int_qemu_test_host:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: eclipse-score/more-disk-space@v1
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Create Bazel output base directory
+        run: |
+          sudo mkdir -p /mnt/.bazel
+          sudo chown -R $USER:$USER /mnt/.bazel
+      - name: Create config indicator file
+        run: echo "host" > .bazel_config
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.19.0
+        with:
+          output-base: /mnt/.bazel
+          # Avoid downloading Bazel every time.
+          bazelisk-cache: true
+          # Store build cache per workflow.
+          disk-cache: ${{ github.workflow }}
+          # Share repository cache between workflows.
+          repository-cache: |
+            - ./MODULE.bazel
+            - ./.bazel_config
+          # Cache external/
+          external-cache: true
+          cache-save: ${{ github.event_name == 'push' }}
+      - name: Install tools needed for ITF tests
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y qemu-system-x86 iputils-ping tcpdump cloud-image-utils
+      - name: Allow linux-sandbox
+        uses: ./.github/actions/unblock_user_namespace_for_linux_sandbox
+      - run: df -h
+      - name: Enable KVM group permissons
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - name: Run Linux QEMU integration tests
+        run: |
+          bazel test --config=qemu-integration //quality/... //tests/integration_test/...
+      - run: df -h
+        if: always()

.github/workflows/build_and_test_qnx.yml

@@ -23,13 +23,14 @@ jobs:
       fail-fast: false
       matrix:
         bazel-config: ["x86_64-qnx", "aarch64-qnx"]
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # main (2026-06-03)
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@dfc6ffae7b8db630dbf49865314df6c46802d385 # main (2026-06-09)
     permissions:
       contents: read
       pull-requests: read
     with:
       # TODO: build all targets ( //... ) once python toolchain issue is resolved.
       bazel-target: "//src/... //tests/... //examples/..."
+      bazel-test-target: "//quality/... //tests/integration_test/..."
       bazel-config: ${{ matrix.bazel-config }}
       credential-helper: ".github/tools/qnx_credential_helper.py"
       bazel-disk-cache: ${{ github.workflow }}-${{ matrix.bazel-config }}

.github/workflows/ci.yml

@@ -33,6 +33,13 @@ jobs:
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'test-cross')
     secrets: inherit
     uses: ./.github/workflows/build_and_test_cross_compilation.yml
+  build_and_test_qnx:
+    # just for testing
+    secrets: inherit
+    uses: ./.github/workflows/build_and_test_qnx.yml
+    permissions:
+      contents: read
+      pull-requests: read
   copyright:
     secrets: inherit
     uses: ./.github/workflows/copyright.yml

MODULE.bazel

@@ -120,7 +120,9 @@ use_repo(
     "score_gcc_aarch64_toolchain",
     "score_gcc_x86_64_toolchain",
     "score_qcc_aarch64_toolchain",
+    "score_qcc_aarch64_toolchain_pkg",
     "score_qcc_x86_64_toolchain",
+    "score_qcc_x86_64_toolchain_pkg",
 )
 
 # ============================================================================
@@ -185,6 +187,12 @@ download_archive(
 # ============================================================================
 bazel_dep(name = "score_docs_as_code", version = "3.0.0", dev_dependency = True)
 
+# score_itf depends on a newer (4.0.3) version, which causes a build break for us
+single_version_override(
+    module_name = "score_docs_as_code",
+    version = "3.0.0",
+)
+
 # ============================================================================
 # Communication Framework
 # ============================================================================
@@ -266,3 +274,36 @@ http_archive(
         "https://github.com/COVESA/vsomeip/archive/refs/tags/3.6.1.tar.gz",
     ],
 )
+
+# ============================================================================
+# Integration Testing
+# ============================================================================
+bazel_dep(name = "score_itf", version = "0.4.0", dev_dependency = True)
+bazel_dep(name = "score_rules_imagefs", version = "0.0.3", dev_dependency = True)
+bazel_dep(name = "rules_oci", version = "2.2.7", dev_dependency = True)
+
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+
+http_file(
+    name = "ubuntu_24_04_cloudimg",
+    downloaded_file_path = "noble-server-cloudimg-amd64.img",
+    # TODO: Pin sha256 after verifying a working snapshot URL.
+    url = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img",
+)
+
+imagefs = use_extension("@score_rules_imagefs//extensions:imagefs.bzl", "imagefs", dev_dependency = True)
+imagefs.toolchain(
+    name = "score_qnx_x86_64_ifs_toolchain",
+    sdp_to_import = "@score_qcc_x86_64_toolchain_pkg",
+    target_cpu = "x86_64",
+    target_os = "qnx",
+    type = "ifs",
+)
+imagefs.toolchain(
+    name = "score_qnx_aarch64_ifs_toolchain",
+    sdp_to_import = "@score_qcc_aarch64_toolchain_pkg",
+    target_cpu = "aarch64",
+    target_os = "qnx",
+    type = "ifs",
+)
+use_repo(imagefs, "score_qnx_aarch64_ifs_toolchain", "score_qnx_x86_64_ifs_toolchain")