Merge testing into main for 44.x stable release44.20260913

1 files changed, 102 insertions, 14 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 78b6dc6..0b6b8df 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - testing
+      - testing-candidate
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
@@ -16,6 +17,18 @@ on:
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
+  REPO_ORGANIZATION: ${{ vars.REPO_ORGANIZATION || github.repository_owner }}
+  IMAGE_DESC: ${{ vars.IMAGE_DESC || 'AeroCore customized Bazzite Deck image' }}
+  IMAGE_KEYWORDS: ${{ vars.IMAGE_KEYWORDS || 'bootc,oci,linux,bazzite,steam-deck,aerocore' }}
+  IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }}
+  DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }}
+  BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }}
+  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
+  FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
+  HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
+  HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
+  OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
@@ -82,25 +95,49 @@ jobs:
       - name: Generate Version and Tags
         id: gen-version
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
         run: |
           set -euo pipefail
 
           sudo podman pull "${BASE_IMAGE}"
           FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
-          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
-
-          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+          VERSION_BASE="${FEDORA_VERSION}.$(date +%Y%m%d)"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            DEFAULT_TAG="testing-candidate"
+            VERSION_TAG="testing-candidate-${VERSION_BASE}"
+            VERSION_PRETTY_PREFIX="Testing candidate"
+            IMAGE_BRANCH="testing-candidate"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
             DEFAULT_TAG="testing"
             VERSION_TAG="testing-${VERSION_BASE}"
-            VERSION_PRETTY="Testing (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Testing"
             IMAGE_BRANCH="testing"
-            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
             DEFAULT_TAG="stable"
             VERSION_TAG="${VERSION_BASE}"
-            VERSION_PRETTY="Stable (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Stable"
             IMAGE_BRANCH="stable"
+          fi
+
+          mapfile -t existing_tags < <(skopeo list-tags "docker://${IMAGE_REGISTRY,,}/${IMAGE_NAME,,}" 2>/dev/null | jq -r '.Tags[]' || true)
+          if printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}"; then
+            build=1
+            while printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}.${build}"; do
+              ((build++))
+            done
+            VERSION_TAG="${VERSION_TAG}.${build}"
+          fi
+
+          VERSION_BASE_PRETTY="${VERSION_TAG#testing-candidate-}"
+          VERSION_BASE_PRETTY="${VERSION_BASE_PRETTY#testing-}"
+          VERSION_PRETTY="${VERSION_PRETTY_PREFIX} (F${VERSION_BASE_PRETTY})"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
+          else
             ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
           fi
 
@@ -124,7 +161,8 @@ jobs:
       - name: Build Image
         id: build-image
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
@@ -134,7 +172,11 @@ jobs:
           INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
           INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
-          sudo -E "$(command -v just)" build \
+          GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token"
+          umask 077
+          printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}"
+          trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT
+          sudo -E GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
@@ -173,18 +215,42 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
+      - name: Install Syft
+        id: setup-syft
+        if: github.event_name != 'pull_request'
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          syft-version: v1.44.0
+
+      - name: Generate RPM SBOM
+        id: generate-sbom
+        if: github.event_name != 'pull_request'
+        env:
+          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+        run: |
+          set -euo pipefail
+          sbom="${RUNNER_TEMP}/aerocore-sbom.json"
+          mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")"
+          trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT
+          sudo "${SYFT_CMD}" "dir:${mountpoint}" \
+            --select-catalogers rpm \
+            --source-name "${IMAGE_NAME}-${VERSION_TAG}" \
+            -o "syft-json=${sbom}"
+          sudo chown "$(id -u):$(id -g)" "${sbom}"
+          echo "sbom=${sbom}" >> "$GITHUB_OUTPUT"
+
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -199,20 +265,40 @@ jobs:
 
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
+      - name: Install ORAS
+        if: github.event_name != 'pull_request'
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Upload RPM SBOM
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.push-image.outputs.digest }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM: ${{ steps.generate-sbom.outputs.sbom }}
+        run: |
+          set -euo pipefail
+          echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+          cd "$(dirname "${SBOM}")"
+          oras attach \
+            --artifact-type application/vnd.spdx+json \
+            --annotation "filename=$(basename "${SBOM}")" \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \
+            "$(basename "${SBOM}")"
+
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
@@ -226,9 +312,11 @@ jobs:
     needs: [build_push]
     if: github.event_name != 'pull_request' &&
         (github.ref_name == github.event.repository.default_branch ||
-         github.ref_name == 'testing')
+         github.ref_name == 'testing' ||
+         github.ref_name == 'testing-candidate')
     permissions:
       contents: write
+      packages: read
     secrets: inherit
     uses: ./.github/workflows/generate_release.yml
     with: