Run initial upstream integration test

check-menu is a very robust test that also does not change the host too
much. This does not cover a lot of functionality to actually find
regressions in subsystems, but exposes the missing pieces for
running more integration tests in the dist-git pipeline.

Re-use the cockpit/tests container for this, which has the necessary
test dependencies -- most importantly, chromium-browser. Aside from not
being available in RHEL, this also better shields the tests from the
tested system. The container talks to Cockpit on the host, i. e. the
container's gateway.

Use a fixed tag to avoid running into failures with "latest", as we
don't gate container updates on the dist-git tests for now.

tests/tests.yml

@@ -11,7 +11,13 @@
     - classic
     required_packages:
     - cockpit
+    - cockpit-tests
+    - cockpit-dashboard
+    - podman
     tests:
     - smoke:
         dir: ./source/tools/debian/tests/
         run: ./smoke
+    - verify:
+        dir: .
+        run: ./verify.sh

tests/verify.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+set -eux
+
+# HACK: this should be a var: https://pagure.io/standard-test-roles/issue/263
+SOURCE=/var/str/source
+
+# HACK: reset the journal (tests should only look at the relevant portion)
+rm -rf /var/log/journal/*
+systemctl restart systemd-journald
+
+# create user account for logging in
+if ! id admin 2>/dev/null; then
+    useradd admin -G wheel
+    echo admin:foobar | chpasswd
+fi
+
+# The cockpit/tests container has chromium-browser and other test
+# dependencies, which we don't have on RHEL itself. Also, we don't actually
+# want to install these on the tested image, so run the test in a container,
+# which tests the host. Use a fixed tag to avoid running into failures with
+# "latest", as we don't gate container updates on the dist-git tests for now.
+RC=0
+cat <<EOF | podman run --rm -i docker.io/cockpit/tests:2018-11-09 /bin/sh -eux || RC=$?
+# CSP does not like the the invalid host name _gateway, so translate it
+HOST=\$(getent hosts _gateway | cut -f1 -d' ')
+
+# copy source dir, otherwise it's owned by root:root and not chown'able
+cp -a cockpit /tmp/
+cd /tmp/cockpit
+
+# check out current rhel-x branch to get the tests; they are not shipped in the source
+git fetch origin rhel-x
+git checkout FETCH_HEAD
+
+export TEST_OS=rhel-x
+test/verify/check-menu -tv --machine \$HOST:22 --browser \$HOST:9090
+EOF
+
+# reset system changes from verify tests, for running this multiple times in a row
+# HACK: Isolate tests from each other: https://pagure.io/fedora-ci/general/issue/11
+rm -f /etc/systemd/system/cockpit.service.d/notls.conf
+systemctl daemon-reload
+systemctl stop cockpit.service
+
+exit $RC