Merge branch 'main' into testing

1 files changed, 172 insertions, 0 deletions

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
new file mode 100644
index 0000000..f7897b9
--- /dev/null
+++ b/.github/workflows/build-installer-iso.yml
@@ -0,0 +1,172 @@
+name: Build installer ISO
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "AeroCore image tag to install"
+        required: false
+        default: latest
+        type: string
+  workflow_call:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-installer-iso:
+    name: Build KDE installer ISO
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
+      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
+      FEDORA_VERSION: "43"
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Mount container storage BTRFS loopback
+        run: |
+          sudo truncate -s 70G /mnt/podman-storage.img
+          sudo mkfs.btrfs -f /mnt/podman-storage.img
+          sudo podman system reset --force
+          sudo systemctl stop podman.service
+          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
+          sudo systemctl start podman.service
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Prepare image references
+        run: |
+          image_name="$(just image_name)"
+          image_registry="${IMAGE_REGISTRY,,}"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        run: |
+          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
+            --username '${{ github.actor }}' --password-stdin
+
+      - name: Pull AeroCore install image
+        run: |
+          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+
+      - name: Build installer ISO payload
+        run: |
+          mkdir -p output
+          sudo podman tag \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            localhost/aerocore-os-installer:latest
+          sudo podman save \
+            --format oci-archive \
+            --output output/install-payload.oci \
+            localhost/aerocore-os-installer:latest
+
+          sudo podman build \
+            --cap-add sys_admin \
+            --security-opt label=disable \
+            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --tag localhost/aerocore-os-installer:latest \
+            --file installer/Containerfile \
+            .
+
+      - name: Build ISO
+        id: build
+        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
+        with:
+          image-ref: localhost/aerocore-os-installer:latest
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+
+      - name: Normalize ISO output path
+        shell: bash
+        env:
+          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+        run: |
+          if [[ ! -f "${GENERATED_ISO}" ]]; then
+            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
+            exit 1
+          fi
+          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
+            mkdir -p "$(dirname "${EXPECTED_ISO}")"
+            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
+          fi
+
+      - name: Display checksum
+        shell: bash
+        run: |
+          set -o pipefail
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          checksum_path="${iso_path}-CHECKSUM"
+          sha256sum "${iso_path}" | tee "${checksum_path}"
+          {
+            echo "# ISO Checksum (SHA256)"
+            echo
+            echo "ISO: $(basename "${iso_path}")"
+            echo
+            echo '```'
+            cat "${checksum_path}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Move ISO to upload directory
+        id: upload-directory
+        shell: bash
+        run: |
+          iso_upload_dir="${{ github.workspace }}/output/upload"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_name="$(basename "${iso_path}")"
+
+          mkdir -p "${iso_upload_dir}"
+          mv "${iso_path}" "${iso_upload_dir}/"
+          (
+            cd "${iso_upload_dir}"
+            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
+          )
+          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload ISO checksum to Job Artifacts
+        if: github.ref_name == 'testing'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
+          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Upload ISO and checksum to R2
+        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        shell: bash
+        env:
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_REGION: auto
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy "$SOURCE_DIR" R2:bazzite