ci: build BIND against OPNsense LMDB ABI

.github/ci/build-bind920.sh

@@ -45,7 +45,7 @@ pkg_creator_record=$("$python_command" "$script_directory/target_pkg.py" install
     --pkg-static "$pkg_static") || fail 'cannot select target package creator'
 [ -n "$pkg_creator_record" ] || fail 'target package creator record is empty'
 "$pkg_command" install -y autoconf automake fstrm gmake json-c libedit libidn2 \
-    libnghttp2 libtool liburcu libuv libxml2 lmdb pkgconf protobuf-c
+    libnghttp2 libtool liburcu libuv libxml2 lmdb0 pkgconf protobuf-c
 "$python_command" "$script_directory/target_pkg.py" verify \
     "$target_pkg_metadata" "$series" --pkg-command "$pkg_command" \
     --pkg-static "$pkg_static"

.github/ci/ci-tests/test_build_bind920.py

@@ -0,0 +1,13 @@
+from pathlib import Path
+import re
+
+
+ROOT = Path(__file__).resolve().parents[3]
+BUILD_SCRIPT = ROOT / ".github" / "ci" / "build-bind920.sh"
+
+
+def test_build_bootstraps_the_lmdb_abi_used_by_the_target_opnsense_repository():
+    script = BUILD_SCRIPT.read_text(encoding="utf-8")
+
+    assert re.search(r"\blmdb0\b", script)
+    assert not re.search(r"\blmdb\b", script)

.github/ci/ci-tests/test_package_release_workflow.py

@@ -390,3 +390,18 @@ def test_all_freebsd_install_gates_pin_pkg_and_test_the_official_replacement_pat
     ]
     assert '/usr/local/sbin/pkg-static install -y -r resolver-plugins' in verifiers['staged']
     assert 'RP_PKG_STATIC_COMMAND=/usr/local/sbin/pkg-static' in verifiers['published']
+
+
+def test_all_runtime_dependencies_must_resolve_from_the_target_opnsense_repository():
+    workflow = workflow_text()
+    development = workflow.split('  verify-development:', 1)[1].split(
+        '  publish-development:', 1
+    )[0]
+    staged = workflow.split('  verify:', 1)[1].split('  verify-published:', 1)[0]
+    published = workflow.split('  verify-published:', 1)[1].split(
+        '  source-release:', 1
+    )[0]
+
+    assert 'pkg install -y -r OPNsense $dependencies' in development
+    assert 'pkg install -y -r OPNsense $dependencies' in staged
+    assert 'pkg install -y -r OPNsense "$dependency"' in published

.github/workflows/package-release.yml

@@ -238,7 +238,7 @@ jobs:
               done | awk '$0 != "bind-tools" && !seen[$0]++'
             )
             if [ -n "$dependencies" ]; then
-              pkg install -y $dependencies
+              pkg install -y -r OPNsense $dependencies
             fi
             pkg add "$output"/bind-tools-*.pkg "$output"/bind920-*.pkg
             if [ "$mode" = development ]; then
@@ -307,7 +307,7 @@ jobs:
               done | awk '$0 != "bind-tools" && $0 != "bind920" && $0 != "os-bind-rp" && !seen[$0]++'
             )
             if [ -n "$dependencies" ]; then
-              pkg install -y $dependencies
+              pkg install -y -r OPNsense $dependencies
             fi
             python3 .github/ci/target_pkg.py verify .resolver-plugins/target-pkg.json "$series"
             python3 .github/ci/package_checksums.py \
@@ -567,7 +567,7 @@ jobs:
               done | awk '$0 != "bind-tools" && $0 != "bind920" && $0 != "os-bind-rp" && !seen[$0]++'
             )
             if [ -n "$dependencies" ]; then
-              pkg install -y $dependencies
+              pkg install -y -r OPNsense $dependencies
             fi
             python3 .github/ci/target_pkg.py verify .resolver-plugins/target-pkg.json "$series"
             python3 .github/ci/package_checksums.py \
@@ -718,7 +718,7 @@ jobs:
             )
             if [ -n "$dependencies" ]; then
               printf '%s\n' "$dependencies" | while IFS= read -r dependency; do
-                pkg install -y "$dependency"
+                pkg install -y -r OPNsense "$dependency"
               done
             fi
             python3 .github/ci/target_pkg.py verify .resolver-plugins/target-pkg.json "$series"