Merge testing into main for 44.x stable release44.20260913

6 files changed, 185 insertions, 42 deletions

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index cef58be..30882e1 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -81,9 +81,10 @@ jobs:
 
       - name: Build disk images
         id: build
-        uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
+        uses: osbuild/bootc-image-builder-action@cb4b3e9c112077ea96a191fad229d51d2a012885 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
+          rootfs: btrfs
           config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso-kde.toml' || './disk_config/disk.toml' }}
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 1352080..da3ef10 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -26,11 +26,12 @@ jobs:
 
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:44
+      FEDORA_VERSION: "44"
       OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
@@ -51,12 +52,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
       - name: Prepare image references
         run: |
-          image_name="$(just image_name)"
+          image_name="${IMAGE_NAME,,}"
           image_registry="${IMAGE_REGISTRY,,}"
           echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
           echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
@@ -152,18 +150,8 @@ jobs:
           )
           echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
 
-      - name: Upload ISO checksum to Job Artifacts
-        if: github.ref_name == 'testing'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
-          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-
       - name: Upload ISO and checksum to R2
-        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        if: github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'testing')
         shell: bash
         env:
           RCLONE_CONFIG_R2_TYPE: s3
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 78b6dc6..0b6b8df 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - testing
+      - testing-candidate
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
@@ -16,6 +17,18 @@ on:
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
+  REPO_ORGANIZATION: ${{ vars.REPO_ORGANIZATION || github.repository_owner }}
+  IMAGE_DESC: ${{ vars.IMAGE_DESC || 'AeroCore customized Bazzite Deck image' }}
+  IMAGE_KEYWORDS: ${{ vars.IMAGE_KEYWORDS || 'bootc,oci,linux,bazzite,steam-deck,aerocore' }}
+  IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }}
+  DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }}
+  BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }}
+  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
+  FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
+  HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
+  HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
+  OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
@@ -82,25 +95,49 @@ jobs:
       - name: Generate Version and Tags
         id: gen-version
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
         run: |
           set -euo pipefail
 
           sudo podman pull "${BASE_IMAGE}"
           FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
-          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
-
-          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+          VERSION_BASE="${FEDORA_VERSION}.$(date +%Y%m%d)"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            DEFAULT_TAG="testing-candidate"
+            VERSION_TAG="testing-candidate-${VERSION_BASE}"
+            VERSION_PRETTY_PREFIX="Testing candidate"
+            IMAGE_BRANCH="testing-candidate"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
             DEFAULT_TAG="testing"
             VERSION_TAG="testing-${VERSION_BASE}"
-            VERSION_PRETTY="Testing (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Testing"
             IMAGE_BRANCH="testing"
-            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
             DEFAULT_TAG="stable"
             VERSION_TAG="${VERSION_BASE}"
-            VERSION_PRETTY="Stable (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Stable"
             IMAGE_BRANCH="stable"
+          fi
+
+          mapfile -t existing_tags < <(skopeo list-tags "docker://${IMAGE_REGISTRY,,}/${IMAGE_NAME,,}" 2>/dev/null | jq -r '.Tags[]' || true)
+          if printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}"; then
+            build=1
+            while printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}.${build}"; do
+              ((build++))
+            done
+            VERSION_TAG="${VERSION_TAG}.${build}"
+          fi
+
+          VERSION_BASE_PRETTY="${VERSION_TAG#testing-candidate-}"
+          VERSION_BASE_PRETTY="${VERSION_BASE_PRETTY#testing-}"
+          VERSION_PRETTY="${VERSION_PRETTY_PREFIX} (F${VERSION_BASE_PRETTY})"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
+          else
             ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
           fi
 
@@ -124,7 +161,8 @@ jobs:
       - name: Build Image
         id: build-image
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
@@ -134,7 +172,11 @@ jobs:
           INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
           INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
-          sudo -E "$(command -v just)" build \
+          GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token"
+          umask 077
+          printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}"
+          trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT
+          sudo -E GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
@@ -173,18 +215,42 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
+      - name: Install Syft
+        id: setup-syft
+        if: github.event_name != 'pull_request'
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          syft-version: v1.44.0
+
+      - name: Generate RPM SBOM
+        id: generate-sbom
+        if: github.event_name != 'pull_request'
+        env:
+          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+        run: |
+          set -euo pipefail
+          sbom="${RUNNER_TEMP}/aerocore-sbom.json"
+          mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")"
+          trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT
+          sudo "${SYFT_CMD}" "dir:${mountpoint}" \
+            --select-catalogers rpm \
+            --source-name "${IMAGE_NAME}-${VERSION_TAG}" \
+            -o "syft-json=${sbom}"
+          sudo chown "$(id -u):$(id -g)" "${sbom}"
+          echo "sbom=${sbom}" >> "$GITHUB_OUTPUT"
+
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -199,20 +265,40 @@ jobs:
 
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
+      - name: Install ORAS
+        if: github.event_name != 'pull_request'
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Upload RPM SBOM
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.push-image.outputs.digest }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM: ${{ steps.generate-sbom.outputs.sbom }}
+        run: |
+          set -euo pipefail
+          echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+          cd "$(dirname "${SBOM}")"
+          oras attach \
+            --artifact-type application/vnd.spdx+json \
+            --annotation "filename=$(basename "${SBOM}")" \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \
+            "$(basename "${SBOM}")"
+
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
@@ -226,9 +312,11 @@ jobs:
     needs: [build_push]
     if: github.event_name != 'pull_request' &&
         (github.ref_name == github.event.repository.default_branch ||
-         github.ref_name == 'testing')
+         github.ref_name == 'testing' ||
+         github.ref_name == 'testing-candidate')
     permissions:
       contents: write
+      packages: read
     secrets: inherit
     uses: ./.github/workflows/generate_release.yml
     with:
diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index f741c83..bcdd948 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -26,12 +26,38 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: write
+      packages: read
 
 
     steps:
       - uses: actions/checkout@v7.0.1
         with:
-          fetch-depth: 50
+          fetch-depth: 0
+
+      - name: Install ORAS
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to GHCR with ORAS
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+
+      - name: Align release tag with build commit
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+
+          git tag --force "${RELEASE_TAG}" "${GITHUB_SHA}"
+          git push --force origin "refs/tags/${RELEASE_TAG}"
+          echo "Release tag ${RELEASE_TAG} now points to ${GITHUB_SHA}."
 
       - name: Determine release channel
         id: target
@@ -40,12 +66,25 @@ jobs:
           [[ "${target}" == "main" ]] && target="stable"
           echo "target=${target}" >> "$GITHUB_OUTPUT"
 
+      - name: Generate package and commit changelog
+        env:
+          IMAGE: ghcr.io/${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          HANDWRITTEN: ${{ inputs.handwritten }}
+        run: |
+          python3 .github/scripts/generate_changelog.py \
+            --image "${IMAGE,,}" \
+            --repository "${GITHUB_REPOSITORY}" \
+            --current "${RELEASE_TAG}" \
+            --channel "${{ steps.target.outputs.target }}" \
+            --handwritten "${HANDWRITTEN}" \
+            --output release-notes.md
+
       - name: Generate release
-        uses: softprops/action-gh-release@v3.0.2
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: "${{ inputs.release_tag }}"
           name: "${{ inputs.release_tag }}"
-          body: |
-            ${{ inputs.handwritten }}
+          body_path: release-notes.md
           prerelease: ${{ steps.target.outputs.target != 'stable' }}
           make_latest: ${{ steps.target.outputs.target == 'stable' }}
diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 6b00e3b..ceb5c0f 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -13,12 +13,13 @@ on:
         required: false
         type: string
       image_name:
-        description: "Image name override; defaults to IMAGE_NAME var, then image-template.env"
+        description: "Image name override; defaults to the runtime IMAGE_NAME variable"
         required: false
         type: string
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
@@ -37,9 +38,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
-
       - name: Install skopeo
         run: |
           sudo apt-get update
@@ -54,7 +52,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-$(just image_name)}}"
+          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-${IMAGE_NAME}}}"
           target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}"
 
           {
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index a93e9cd..3f02a76 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -13,6 +13,18 @@ jobs:
   validate:
     name: Run lightweight checks
     runs-on: ubuntu-24.04
+    # `just check` parses the whole Justfile, so provide the non-secret
+    # variables required by its top-level metadata declarations. This job
+    # does not build or publish an image; production builds use repository
+    # runtime variables in their respective workflows.
+    env:
+      IMAGE_NAME: aerocore-os
+      REPO_ORGANIZATION: aerocore-io
+      IMAGE_DESC: AeroCore customized Bazzite Deck image
+      IMAGE_KEYWORDS: bootc,oci,linux,bazzite,steam-deck,aerocore
+      IMAGE_LOGO_URL: https://avatars.githubusercontent.com/u/120078124?s=200&v=4
+      DEFAULT_TAG: testing
+      BIB_IMAGE: quay.io/centos-bootc/bootc-image-builder:latest
 
     steps:
       - name: Checkout
@@ -32,12 +44,29 @@ jobs:
         run: |
           just --unstable --fmt --check -f Justfile
 
+      - name: Test dotenv precedence
+        run: tests/test-dotenv-precedence.sh
+
       - name: Validate build scripts
         run: |
-          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+          bash -n system_files/usr/libexec/aerocore-desktop-branding
+          bash -n system_files/usr/libexec/aerocore-desktop-branding-privileged
+
+      - name: Test Bazzite Deck identity patch
+        run: tests/test-patch-bazzite-deck-identity.sh
+
+      - name: Test desktop branding migration
+        run: tests/test-desktop-branding-migration.sh
+
+      - name: Test GPT root configuration
+        run: tests/test-configure-target-gpt-root.sh
+
+      - name: Validate AeroCore Anaconda profile
+        run: tests/test-aerocore-anaconda-profile.sh
 
       - name: Validate Anaconda WebUI patch
         run: |