Add Alpine package runtime tests

.gitea/workflows/build.yml

@@ -53,7 +53,17 @@ jobs:
           scripts/apk/export-ci-assets.sh
           scripts/apk/list-packages.sh
 
+      - name: Check artifact upload support
+        id: artifact-upload
+        run: |
+          if [ -n "${ACTIONS_RUNTIME_TOKEN:-}" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Upload generated CI assets
+        if: steps.artifact-upload.outputs.available == 'true'
         uses: actions/upload-artifact@v3
         with:
           name: greptimedb-musl-binaries-${{ matrix.alpine_registry_branch }}
@@ -62,6 +72,9 @@ jobs:
       - name: Smoke test
         run: scripts/apk/ci-smoke.sh
 
+      - name: Runtime test
+        run: scripts/apk/runtime-test.sh
+
       - name: Publish Alpine packages
         if: github.event_name != 'pull_request'
         run: scripts/apk/publish-gitea.sh

README.md

@@ -16,16 +16,14 @@ https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
 
 ### Add The Package Repository
 
-Install the registry signing key on each Alpine node:
+Install the registry key:
 
 ```sh
 cd /etc/apk/keys
 curl -fsSLOJ https://code.factoring.digital/api/packages/public/alpine/key
 ```
 
-Keep the filename returned by Gitea. Alpine matches repository signatures by key filename, otherwise `apk update` reports `UNTRUSTED signature`.
-
-Add the stable package repository matching the Alpine branch on the node:
+Add the repository for the node's Alpine branch:
 
 ```sh
 printf '%s\n' \
@@ -35,8 +33,7 @@ printf '%s\n' \
 apk update
 ```
 
-If a forked or future registry is private, include a Gitea user and package token in the
-repository URL:
+Private registry URL format:
 
 ```text
 https://<user>:<token>@code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
@@ -59,8 +56,6 @@ seaweedfs    SeaweedFS 4.31 release binary and OpenRC role splits
 greptimedb   GreptimeDB 1.0.2 built from source for x86_64
 ```
 
-Package-specific details are in the linked package READMEs above.
-
 Local build output is written under:
 
 ```text
@@ -96,21 +91,18 @@ apk:smoke             Install-test built packages from the local repository in D
 apk:test-install      Test README installation instructions in a fresh Alpine container
 apk:test-shell        Open an Alpine shell with the current local package build installed
 apk:update-generated  Refresh packaged upstream examples and shell completions
+apk:runtime-test      Run package-local Docker runtime tests against the local...
 gitea-workflow-build  Run the Gitea build workflow locally through act as a pull_request event
 ```
 
 `apk:build` targets `x86_64` by default. Multi-arch builds target `x86_64` and
-`aarch64`; override with `ALPINE_ARCHES` when needed:
+`aarch64`:
 
 ```sh
 ALPINE_ARCHES="x86_64 aarch64" mise run apk:build-all
 ```
 
-Unqualified build and install-test tasks discover all packages. GreptimeDB is a
-source build and can take close to an hour; it is limited to `x86_64` during
-production evaluation. Target fast package work explicitly:
-
-Build or test a subset of packages with `ALPINE_PACKAGE` or `ALPINE_PACKAGES`:
+Limit package selection with `ALPINE_PACKAGE` or `ALPINE_PACKAGES`:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs mise run apk:build
@@ -121,76 +113,73 @@ ALPINE_PACKAGE=greptimedb mise run apk:build
 ALPINE_PACKAGE=greptimedb SKIP_BUILD=1 mise run apk:test-install
 ```
 
-Docker-backed build tasks keep Cargo registry, Rustup, and Cargo target caches in named Docker volumes. The default volume scope is derived from the Git remote owner/repository and is split by package and architecture. Override it when needed:
+Override Docker cache scope:
 
 ```sh
 ALPINE_APK_CACHE_SCOPE=public-alpine-packages ALPINE_PACKAGE=greptimedb mise run apk:build
 ALPINE_APK_CACHE_PREFIX=alpine-apk-ci ALPINE_PACKAGE=greptimedb mise run apk:build
 ```
 
-Use the test shell to inspect the package in Alpine with the current build
-installed:
+Open an Alpine test shell:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs mise run apk:shell
 mise run apk:test-shell
 ```
 
-Use the install test to validate the production instructions against the local
-package repository in a fresh Alpine container:
+Run the install test:
 
 ```sh
 mise run apk:test-install
 ```
 
-Use `SKIP_BUILD=1` to reuse existing local packages:
+Reuse existing local packages:
 
 ```sh
 SKIP_BUILD=1 mise run apk:test-install
 SKIP_BUILD=1 mise run apk:test-shell
 ```
 
+Run package-local runtime tests:
+
+```sh
+mise run apk:runtime-test
+ALPINE_PACKAGE=seaweedfs mise run apk:runtime-test
+ALPINE_VERSION=3.24 mise run apk:runtime-test
+```
+
 ### Adding Packages
 
-Each package lives under:
+Package path:
 
 ```text
 packaging/alpine/local/<pkgname>/
 ```
 
-The only required file is `APKBUILD`. Package-specific helpers can be added as
-hooks:
+Optional package hooks:
 
 ```text
 packaging/alpine/local/<pkgname>/scripts/test-install.sh
 packaging/alpine/local/<pkgname>/scripts/update-generated-sources.sh
+packaging/alpine/local/<pkgname>/scripts/runtime-test.sh
 ```
 
-Repo-level tasks discover all `packaging/alpine/local/*/APKBUILD` files. Hook
-tasks skip packages that do not provide the requested hook.
-
-Start new packages from the blueprint:
+Start from the blueprint:
 
 ```text
 packaging/alpine/blueprint/
 ```
 
-For compiled software, declare build tools in `makedepends` and use normal
-Alpine `build()`, `check()`, and `package()` functions in the package's
-`APKBUILD`.
-
 ### Generated Package Sources
 
-Generated files should live next to the package's `APKBUILD` so
-`abuild checksum` can track them as ordinary package sources. For SeaweedFS,
-that includes:
+Generated package sources live next to the package `APKBUILD`:
 
 ```text
 packaging/alpine/local/seaweedfs/example-*.toml
 packaging/alpine/local/seaweedfs/weed.bash-completion
 ```
 
-Refresh generated sources through package-local hooks:
+Refresh generated sources:
 
 ```sh
 mise run apk:update-generated
@@ -198,14 +187,10 @@ ALPINE_PACKAGE=seaweedfs mise run apk:update-generated
 mise run apk:checksum
 ```
 
-Run `apk:checksum` after changing any file listed in `source=`.
-
 ### Gitea Workflow
 
-The workflow at `.gitea/workflows/build.yml` builds against each stable Alpine
-target in its matrix and publishes to the matching registry branch, currently
-`v3.23` and `v3.24`, on push or tag. It skips publishing for pull request
-events.
+`.gitea/workflows/build.yml` builds and publishes `v3.23` and `v3.24`.
+Pull requests build only.
 
 Repository variables:
 
@@ -222,13 +207,13 @@ PACKAGE_USER=<gitea package publisher>
 PACKAGE_TOKEN=<token with package write access>
 ```
 
-Pre-check the workflow locally with `act`:
+Check the workflow locally:
 
 ```sh
 mise run gitea-workflow-build
 ```
 
-Publish already-built local packages manually:
+Publish local packages:
 
 ```sh
 INSTANCE_URL=https://code.factoring.digital \
@@ -247,6 +232,7 @@ Before opening a PR, run:
 mise run apk:publish-check
 mise run gitea-workflow-build
 mise run apk:test-install
+mise run apk:runtime-test
 ```
 
 Then test at least one installed role in the package shell:

mise.toml

@@ -52,6 +52,11 @@ run = "scripts/apk/test-shell.sh"
 description = "Test README installation instructions in a fresh Alpine container"
 run = "scripts/apk/test-install.sh"
 
+[tasks."apk:runtime-test"]
+description = "Run package-local Docker runtime tests against the local Alpine repository"
+run = "scripts/apk/runtime-test.sh"
+env = { ALPINE_ARCH = "x86_64", ALPINE_REPO_NAME = "local", ALPINE_VERSION = "3.24" }
+
 [tasks."apk:packages"]
 description = "List built Alpine packages and dependencies"
 run = "scripts/apk/list-packages.sh"

packaging/alpine/blueprint/README.md

@@ -12,6 +12,8 @@ Optional package-local hooks:
 - `scripts/test-install.sh` validates README-style installation instructions.
 - `scripts/update-generated-sources.sh` refreshes generated files that are
   listed in `source=`.
+- `scripts/runtime-test.sh` validates an installed package in the shared Docker
+  runtime test.
 
 Repo-level tasks discover packages from `packaging/alpine/local/*/APKBUILD`.
 Limit a task to one or more packages with:
@@ -20,6 +22,7 @@ Limit a task to one or more packages with:
 ALPINE_PACKAGE=<pkgname> mise run apk:build
 ALPINE_PACKAGES="<pkg-a> <pkg-b>" mise run apk:build-all
 ALPINE_PACKAGE=<pkgname> mise run apk:test-install
+ALPINE_PACKAGE=<pkgname> mise run apk:runtime-test
 ```
 
 For compiled software, put normal Alpine build logic in `build()`, `check()`,

packaging/alpine/local/greptimedb/README.md

@@ -1,8 +1,9 @@
 # GreptimeDB Alpine Package
 
-This package builds `greptime` from the upstream GreptimeDB source release and packages OpenRC service subpackages plus default `/etc/greptimedb` configuration.
+Builds `greptime` from the upstream source release and packages OpenRC service
+subpackages plus `/etc/greptimedb` defaults.
 
-The APKBUILD builds the release directly:
+Build command:
 
 ```sh
 cargo build --profile nightly --locked --bin greptime --features servers/dashboard
@@ -10,9 +11,7 @@ cargo build --profile nightly --locked --bin greptime --features servers/dashboa
 
 ## Runtime Layout
 
-The package installs the upstream `greptime` binary as `/usr/bin/greptime`.
-OpenRC support is split into component subpackages that map to the documented
-GreptimeDB commands:
+Installs `/usr/bin/greptime` and component OpenRC packages:
 
 - `greptimedb-docs`: upstream configuration examples and reference files from
   `config/`
@@ -22,23 +21,19 @@ GreptimeDB commands:
 - `greptimedb-flownode-openrc`: `greptime flownode start`
 - `greptimedb-frontend-openrc`: `greptime frontend start`
 
-Default TOML files are installed in `/etc/greptimedb`. The standalone config
-listens on the documented local ports:
+Default TOML files are installed in `/etc/greptimedb`. Standalone ports:
 
 - `127.0.0.1:4000`: HTTP API and dashboard
 - `127.0.0.1:4001`: gRPC
 - `127.0.0.1:4002`: MySQL
 - `127.0.0.1:4003`: PostgreSQL
 
-GreptimeDB binds to localhost by default. Edit the matching TOML file before
-exposing a service on another interface.
-
-Install `greptimedb-docs` for the full upstream configuration reference and
-example files under `/usr/share/doc/greptimedb/config`.
+Configs bind to localhost by default. Upstream config examples are in
+`/usr/share/doc/greptimedb/config`.
 
 ## OpenRC Usage
 
-Install and start the standalone service:
+Standalone:
 
 ```sh
 apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
@@ -46,7 +41,7 @@ rc-update add greptimedb.standalone default
 rc-service greptimedb.standalone start
 ```
 
-Install the distributed components when managing a small OpenRC deployment:
+Distributed components:
 
 ```sh
 apk add \
@@ -57,8 +52,7 @@ apk add \
   greptimedb-frontend-openrc
 ```
 
-The package starts each service with `-c /etc/greptimedb/<component>.toml`.
-Package wrapper settings live in `/etc/conf.d/greptimedb.<component>`:
+Wrapper settings in `/etc/conf.d/greptimedb.<component>`:
 
 - `GREPTIMEDB_CONFIG`: config file path passed with `-c`
 - `GREPTIMEDB_LOG_DIR`: component log directory passed with `--log-dir`
@@ -68,35 +62,27 @@ Package wrapper settings live in `/etc/conf.d/greptimedb.<component>`:
 - `GREPTIMEDB_OPTS`: extra component arguments appended after package defaults
 - `GREPTIMEDB_GLOBAL_OPTS`: arguments inserted before the component command
 
-GreptimeDB's own config environment variables are separate from these OpenRC
-wrapper variables. The upstream docs use component prefixes such as
-`GREPTIMEDB_STANDALONE`, `GREPTIMEDB_DATANODE`, `GREPTIMEDB_FRONTEND`, and
-`GREPTIMEDB_METASRV` with double underscores for nested config keys.
-
-For production clusters, follow the upstream deployment guidance. GreptimeDB
-recommends Kubernetes and the GreptimeDB Operator for production self-hosting.
-
 ## Package Commands
 
-Refresh the source checksum after changing `pkgver`:
+Refresh checksums:
 
 ```sh
 ALPINE_PACKAGE=greptimedb mise run apk:checksum
 ```
 
-Build only this package:
+Build:
 
 ```sh
 ALPINE_PACKAGE=greptimedb mise run apk:build
 ```
 
-Install-test an existing local build without recompiling:
+Install-test local build:
 
 ```sh
 ALPINE_PACKAGE=greptimedb SKIP_BUILD=1 mise run apk:test-install
 ```
 
-Install-test from a published Gitea Alpine repository:
+Install-test published repository:
 
 ```sh
 ALPINE_PACKAGE=greptimedb \
@@ -106,5 +92,4 @@ ALPINE_REPOSITORY_KEY_URL=https://code.factoring.digital/api/packages/public/alp
 mise run apk:test-install
 ```
 
-The full build can take close to an hour. Do not run it as part of lightweight
-metadata or script checks.
+Full builds take close to an hour.

packaging/alpine/local/greptimedb/scripts/runtime-test.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add greptimedb \
+  greptimedb-datanode-openrc \
+  greptimedb-docs \
+  greptimedb-flownode-openrc \
+  greptimedb-frontend-openrc \
+  greptimedb-metasrv-openrc \
+  greptimedb-standalone-openrc
+
+test -x /usr/bin/greptime
+test -d /etc/greptimedb
+test -f /etc/greptimedb/standalone.toml
+test -f /etc/conf.d/greptimedb.standalone
+test -f /etc/init.d/greptimedb.standalone
+test -f /usr/share/doc/greptimedb/config/config.md
+test -f /usr/share/doc/greptimedb/config/standalone.example.toml
+
+greptime --version
+
+rc-update add greptimedb.standalone default || true
+test -L /etc/runlevels/default/greptimedb.standalone

packaging/alpine/local/seaweedfs/README.md

@@ -1,23 +1,24 @@
 # SeaweedFS Alpine Package
 
-This package repackages the official SeaweedFS 4.31 Linux release tarballs for `x86_64` and `aarch64`. It installs the `weed` binary, short active config defaults, generated examples, bash completion, and split OpenRC service packages.
+Repackages official SeaweedFS 4.31 Linux release tarballs for `x86_64` and
+`aarch64`.
 
 ## Package Commands
 
-Refresh generated config examples and bash completion after changing the SeaweedFS version or generated source flow:
+Refresh generated sources:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs mise run apk:update-generated
 ALPINE_PACKAGE=seaweedfs mise run apk:checksum
 ```
 
-Build only this package:
+Build:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs mise run apk:build
 ```
 
-Install-test an existing local build without rebuilding:
+Install-test local build:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs SKIP_BUILD=1 mise run apk:test-install
@@ -25,9 +26,7 @@ ALPINE_PACKAGE=seaweedfs SKIP_BUILD=1 mise run apk:test-install
 
 ## Install Node Roles
 
-Install the base package plus only the OpenRC role packages needed on that node.
-
-For a single-node test or a compact small deployment:
+Single-node install:
 
 ```sh
 apk add seaweedfs \
@@ -36,7 +35,7 @@ apk add seaweedfs \
   seaweedfs-filer-openrc
 ```
 
-For separated production nodes, install only the role running there:
+Role-specific installs:
 
 ```sh
 apk add seaweedfs seaweedfs-master-openrc
@@ -57,7 +56,7 @@ seaweedfs-admin-openrc    -> /etc/init.d/seaweedfs.admin
 seaweedfs-worker-openrc   -> /etc/init.d/seaweedfs.worker
 ```
 
-The package name is `seaweedfs`, matching Alpine aports. If a node already has Alpine's old generic OpenRC package installed, remove it before installing a role-specific split:
+Replace Alpine's old generic OpenRC package before installing a role split:
 
 ```sh
 apk del seaweedfs-openrc
@@ -66,7 +65,7 @@ apk add seaweedfs seaweedfs-master-openrc
 
 ## Configure Services
 
-Runtime files are installed in the usual Alpine locations:
+Runtime paths:
 
 ```text
 /usr/bin/weed
@@ -75,13 +74,14 @@ Runtime files are installed in the usual Alpine locations:
 /etc/init.d/seaweedfs.*
 ```
 
-Edit `/etc/conf.d/seaweedfs.<role>` for command-line flags and `/etc/seaweedfs/*.toml` for SeaweedFS config. The packaged defaults are short and production-neutral; full upstream example configs are in:
+Edit `/etc/conf.d/seaweedfs.<role>` for flags and `/etc/seaweedfs/*.toml` for
+SeaweedFS config. Upstream examples:
 
 ```text
 /usr/share/doc/seaweedfs/examples/
 ```
 
-Enable and start only the services needed on the node:
+Enable services:
 
 ```sh
 rc-update add seaweedfs.master default
@@ -94,7 +94,7 @@ rc-update add seaweedfs.filer default
 rc-service seaweedfs.filer start
 ```
 
-Check the installed binary and service state:
+Check status:
 
 ```sh
 weed version
@@ -103,30 +103,28 @@ rc-service seaweedfs.master status
 
 ## Optional Packages
 
-Install docs and generated examples:
+Docs and examples:
 
 ```sh
 apk add seaweedfs-doc
 ```
 
-Install bash completion:
+Bash completion:
 
 ```sh
 apk add bash-completion seaweedfs-bash-completion
 ```
 
-`seaweedfs-bash-completion` is also selected automatically when `seaweedfs` and `bash-completion` are installed together.
-
 ## Upgrade Or Pin
 
-Use normal Alpine package operations:
+Upgrade:
 
 ```sh
 apk upgrade seaweedfs
 rc-service seaweedfs.master restart
 ```
 
-Pin a specific package build when needed:
+Pin:
 
 ```sh
 apk add seaweedfs=4.31-r3

packaging/alpine/local/seaweedfs/scripts/runtime-test.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add seaweedfs \
+  seaweedfs-doc \
+  bash-completion \
+  seaweedfs-master-openrc \
+  seaweedfs-volume-openrc \
+  seaweedfs-filer-openrc
+
+test -x /usr/bin/weed
+test -d /etc/seaweedfs
+test -f /etc/seaweedfs/master.toml
+test -f /etc/seaweedfs/filer.toml
+test -f /etc/conf.d/seaweedfs.master
+test -f /etc/conf.d/seaweedfs.volume
+test -f /etc/conf.d/seaweedfs.filer
+test -f /etc/init.d/seaweedfs.master
+test -f /etc/init.d/seaweedfs.volume
+test -f /etc/init.d/seaweedfs.filer
+test -d /usr/share/doc/seaweedfs/examples
+test -f /usr/share/doc/seaweedfs/examples/master.toml
+test -f /usr/share/bash-completion/completions/weed
+
+weed version
+
+rc-update add seaweedfs.master default || true
+rc-update add seaweedfs.volume default || true
+rc-update add seaweedfs.filer default || true
+
+rc-service seaweedfs.master start
+rc-service seaweedfs.volume start
+rc-service seaweedfs.filer start
+
+rc-service seaweedfs.master status
+rc-service seaweedfs.volume status
+rc-service seaweedfs.filer status

scripts/apk/runtime-test.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+. "${repo_root}/scripts/apk/package-lib.sh"
+
+alpine_version="${ALPINE_VERSION:-3.24}"
+repo_name="${ALPINE_REPO_NAME:-local}"
+arch="${ALPINE_ARCH:-x86_64}"
+platform="${ALPINE_TEST_PLATFORM:-linux/amd64}"
+repo_dir="${repo_root}/packages/${repo_name}/${arch}"
+runtime_mode="${ALPINE_RUNTIME_TEST_MODE:-auto}"
+
+validate_repo() {
+  if [[ ! -d "${repo_dir}" ]]; then
+    printf 'missing local repository: packages/%s/%s\n' "${repo_name}" "${arch}" >&2
+    printf 'run: ALPINE_ARCH=%s mise run apk:build\n' "${arch}" >&2
+    exit 1
+  fi
+
+  shopt -s nullglob
+  repo_keys=("${repo_dir}"/*.rsa.pub)
+  repo_indexes=("${repo_dir}"/APKINDEX.tar.gz)
+  shopt -u nullglob
+
+  if [[ "${#repo_keys[@]}" -eq 0 ]]; then
+    printf 'missing repository key: packages/%s/%s/*.rsa.pub\n' "${repo_name}" "${arch}" >&2
+    exit 1
+  fi
+  if [[ "${#repo_indexes[@]}" -eq 0 ]]; then
+    printf 'missing repository index: packages/%s/%s/APKINDEX.tar.gz\n' "${repo_name}" "${arch}" >&2
+    exit 1
+  fi
+}
+
+in_alpine() {
+  [[ -f /etc/alpine-release ]] && command -v apk >/dev/null 2>&1
+}
+
+prepare_direct_runtime() {
+  apk add --no-cache bash openrc >/dev/null
+  cp "${repo_dir}"/*.rsa.pub /etc/apk/keys/
+  printf '%s\n' "${repo_root}/packages/${repo_name}" >> /etc/apk/repositories
+  apk update
+  mkdir -p /run/openrc
+  touch /run/openrc/softlevel
+}
+
+run_hook_direct() {
+  local hook_path="$1"
+  local package_dir="$2"
+  local package_name="$3"
+
+  PACKAGE_DIR="${package_dir}" \
+    PACKAGE_NAME="${package_name}" \
+    "${hook_path}"
+}
+
+run_hook_docker() {
+  local package_dir_rel="$1"
+
+  docker run --rm --privileged --platform "${platform}" \
+    -e "ALPINE_ARCH=${arch}" \
+    -e "ALPINE_REPO_NAME=${repo_name}" \
+    -e "PACKAGE_DIR=/work/${package_dir_rel}" \
+    -e "PACKAGE_NAME=${package_name}" \
+    -v "${repo_root}:/work:ro" \
+    -v "${repo_root}/packages/${repo_name}:/repo:ro" \
+    "alpine:${alpine_version}" \
+    sh -lc '
+      set -e
+      apk add --no-cache bash openrc >/dev/null
+      cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
+      printf "%s\n" /repo >> /etc/apk/repositories
+      apk update
+      mkdir -p /run/openrc
+      touch /run/openrc/softlevel
+      exec /bin/bash "${PACKAGE_DIR}/scripts/runtime-test.sh"
+    '
+}
+
+validate_repo
+
+case "${runtime_mode}" in
+  auto)
+    if in_alpine; then
+      runtime_mode="direct"
+    else
+      runtime_mode="docker"
+    fi
+    ;;
+  direct|docker) ;;
+  *)
+    printf 'unsupported ALPINE_RUNTIME_TEST_MODE: %s\n' "${runtime_mode}" >&2
+    printf 'expected: auto, direct, or docker\n' >&2
+    exit 2
+    ;;
+esac
+
+if [[ "${runtime_mode}" == "direct" ]]; then
+  prepare_direct_runtime
+fi
+
+while IFS= read -r package_dir; do
+  apk_validate_package_dir "${package_dir}"
+  package_name="$(apk_package_name "${package_dir}")"
+  hook_path="${package_dir}/scripts/runtime-test.sh"
+
+  if [[ ! -e "${hook_path}" ]]; then
+    printf 'Skipping %s: no runtime-test hook\n' "${package_name}"
+    continue
+  fi
+  if [[ ! -x "${hook_path}" ]]; then
+    printf 'package hook is not executable: %s\n' "${hook_path}" >&2
+    exit 1
+  fi
+  if ! apk_package_supports_arch "${package_dir}" "${arch}"; then
+    printf 'Skipping %s: unsupported arch %s\n' "${package_name}" "${arch}"
+    continue
+  fi
+
+  case "${package_dir}" in
+    "${repo_root}"/*)
+      package_dir_rel="${package_dir#"${repo_root}/"}"
+      ;;
+    *)
+      printf 'package directory must be inside repository: %s\n' "${package_dir}" >&2
+      exit 1
+      ;;
+  esac
+
+  printf 'Running runtime-test hook for %s\n' "${package_name}"
+  if [[ "${runtime_mode}" == "direct" ]]; then
+    run_hook_direct "${hook_path}" "${package_dir}" "${package_name}"
+  else
+    run_hook_docker "${package_dir_rel}"
+  fi
+done < <(apk_package_dirs "${repo_root}")