Build Fedora aarch64 images for the Lenovo Yoga C630

Assembles a ready-to-write disk image via Gitea Actions. Mainline has carried
sdm850-lenovo-yoga-c630.dts since 5.5 and Fedora ships it in kernel-core, so
unlike aarch64-laptops/build there is no kernel or GRUB to compile — what is
left is producing an image that boots on firmware which hands Linux no device
tree.

The build runs in an aarch64 container under qemu-user and builds filesystems
from directory trees with mke2fs -d and mcopy rather than mounting loop
devices, so it works on runners that will not hand out /dev/loop-control.

A kernel-install hook writes the devicetree line into each BLS entry; without
it the first `dnf update kernel` would produce an unbootable system.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XWRjNJMistCy6ngXH5aJLS

config/device.env

@@ -0,0 +1,50 @@
+# Device parameters for the Lenovo Yoga C630 13Q50 (81JL) — Qualcomm SDM850.
+#
+# Sourced by build/stage2.sh. Everything here is overridable from the
+# environment, so CI can tweak a value without editing this file.
+
+# --- identity -----------------------------------------------------------
+: "${DEVICE_NAME:=lenovo-yoga-c630}"
+: "${DEVICE_DESC:=Lenovo Yoga C630 13Q50}"
+
+# Device tree shipped by Fedora's kernel-core, relative to /boot/dtb-$KVER/.
+: "${DEVICE_DTB:=qcom/sdm850-lenovo-yoga-c630.dtb}"
+
+# --- kernel command line ------------------------------------------------
+#
+# clk_ignore_unused / pd_ignore_unused
+#     The SDM850 clock and power-domain trees are only partially described in
+#     the device tree. Without these the kernel gates clocks and power domains
+#     that nothing has claimed but that the machine still needs, and the boot
+#     dies somewhere between the pivot and the display coming up.
+#
+# efi=noruntime
+#     The C630's EFI runtime services are not usable from Linux. Since 6.7 the
+#     qcom_uefisecapp driver provides efivars through SCM instead, so turning
+#     runtime services off costs nothing and avoids the hangs.
+#
+# arm64.nopauth
+#     Harmless on Cortex-A75/A55 (no pointer auth), kept for parity with the
+#     rest of the Snapdragon WoA laptop fleet.
+: "${DEVICE_CMDLINE:=clk_ignore_unused pd_ignore_unused efi=noruntime arm64.nopauth}"
+
+# Uncomment if USB dies during boot before the Windows DSP firmware has been
+# extracted — the ADSP reset puts the USB-C PHY into high-Z briefly.
+# DEVICE_CMDLINE="$DEVICE_CMDLINE modprobe.blacklist=qcom_q6v5_pas"
+
+# --- image geometry (MiB) -----------------------------------------------
+: "${ESP_SIZE_MIB:=512}"
+: "${BOOT_SIZE_MIB:=1024}"
+
+# Total image size. The root partition takes whatever is left, and grows to
+# fill the target medium on first boot.
+: "${IMAGE_SIZE_MIB:=8192}"
+
+# --- distro -------------------------------------------------------------
+: "${FEDORA_RELEASE:=44}"
+: "${TARGET_ARCH:=aarch64}"
+
+# --- default account ----------------------------------------------------
+# Password is expired at first login, so it must be changed immediately.
+: "${DEFAULT_USER:=fedora}"
+: "${DEFAULT_PASSWORD:=fedora}"

config/packages/base.pkgs

@@ -0,0 +1,65 @@
+# Packages common to every variant.
+# Lines are stripped of '#' comments and blanks before being handed to dnf.
+
+# --- core ---------------------------------------------------------------
+@core
+fedora-release-common
+glibc-langpack-en
+tzdata
+
+# --- kernel + firmware --------------------------------------------------
+kernel
+kernel-modules
+kernel-modules-extra
+linux-firmware
+
+# qcom-firmware carries the Adreno 630 bits (a630_gmu.bin, a630_sqe.fw,
+# sdm845/a630_zap.mbn) that freedreno needs for accelerated graphics.
+# atheros-firmware carries ath10k WCN3990 including wlanmdsp.mbn, so WiFi
+# works without touching the Windows partition.
+qcom-firmware
+atheros-firmware
+
+# Pulls the model-specific SDM850 DSP/display blobs off the Windows
+# partition. See docs/firmware.md — those cannot be redistributed.
+qcom-firmware-extract
+
+# --- boot ---------------------------------------------------------------
+grub2-efi-aa64
+grub2-efi-aa64-modules
+grub2-tools
+grub2-tools-minimal
+shim-aa64
+efibootmgr
+dracut
+dracut-config-generic
+
+# --- filesystem + growth ------------------------------------------------
+e2fsprogs
+dosfstools
+gdisk
+parted
+cloud-utils-growpart
+
+# --- selinux ------------------------------------------------------------
+selinux-policy-targeted
+policycoreutils
+
+# --- networking ---------------------------------------------------------
+NetworkManager
+NetworkManager-wifi
+wpa_supplicant
+iw
+openssh-server
+
+# --- power / peripherals ------------------------------------------------
+bluez
+alsa-utils
+libqmi-utils
+
+# --- basics -------------------------------------------------------------
+sudo
+shadow-utils
+vim-minimal
+less
+bash-completion

config/packages/minimal.pkgs

@@ -0,0 +1,12 @@
+# Bring-up variant: small enough to iterate on quickly, enough tooling to
+# diagnose whatever does not work on the first boot.
+
+tmux
+htop
+pciutils
+usbutils
+lshw
+dmidecode
+strace
+tcpdump
+dtc

config/packages/workstation.pkgs

@@ -0,0 +1,7 @@
+# Full GNOME desktop. Build this once the minimal image is confirmed to boot.
+
+@^workstation-product-environment
+gnome-initial-setup
+mesa-dri-drivers
+mesa-vulkan-drivers
+iio-sensor-proxy