Route installer updates through OSTREE_IMAGE_REF

Use the configured ref for ISO boot origins and derive GHCR fallbacks
from the current repository instead of hardcoding the image path.

4 files changed, 24 insertions, 5 deletions

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index f7897b9..a6348aa 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -31,6 +31,7 @@ jobs:
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "43"
+      OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
       - name: Maximize build space
@@ -72,19 +73,23 @@ jobs:
       - name: Build installer ISO payload
         run: |
           mkdir -p output
+          ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://${IMAGE_REGISTRY}/${IMAGE_NAME}}"
+          install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
+          install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
+          install_image_ref="${install_image_ref#docker://}"
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
diff --git a/Justfile b/Justfile
index f77828b..257ec46 100644
--- a/Justfile
+++ b/Justfile
@@ -9,6 +9,7 @@ export image_logo_url := env_var("IMAGE_LOGO_URL")
 export default_tag := env_var("DEFAULT_TAG")
 export bib_image := env_var("BIB_IMAGE")
 export BASE_IMAGE := env_var_or_default("BASE_IMAGE", "ghcr.io/ublue-os/bazzite-deck:stable")
+export OSTREE_IMAGE_REF := env_var_or_default("OSTREE_IMAGE_REF", "ostree-image-signed:docker://ghcr.io/" + repo_organization + "/" + image_name)
 export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:43")
 export INSTALLER_BUILDER_IMAGE := env_var_or_default("INSTALLER_BUILDER_IMAGE", "ghcr.io/jasonn3/build-container-installer:v1.5.0")
 export FLATPAK_REMOTE_URL := env_var_or_default("FLATPAK_REMOTE_URL", "")
diff --git a/installer/Containerfile b/installer/Containerfile
index fa5d731..cf20e4f 100644
--- a/installer/Containerfile
+++ b/installer/Containerfile
@@ -2,12 +2,16 @@
 # The image installed to disk is supplied separately as INSTALL_IMAGE_PAYLOAD.
 
 ARG BASE_IMAGE=ghcr.io/ublue-os/bazzite:stable
-ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/AeroCore-IO/aerocore-os:stable
+ARG IMAGE_VENDOR=AeroCore-IO
+ARG IMAGE_NAME=aerocore-os
+ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME}:stable
 ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci
 
 FROM ${BASE_IMAGE}
 
 ARG BASE_IMAGE
+ARG IMAGE_VENDOR
+ARG IMAGE_NAME
 ARG INSTALL_IMAGE_PAYLOAD
 ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE
 
diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 38e1718..abd668f 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -10,7 +10,16 @@ image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
 installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
 source_image="${image_name}:${image_tag}"
-payload="localhost/aerocore-os-installer:latest"
+# Keep the payload in local container storage, but use the public update
+# reference as its local tag so Anaconda writes that reference as the boot
+# origin instead of persisting the temporary localhost name. OSTREE_IMAGE_REF
+# is intentionally tagless, matching the image-info contract.
+image_basename="${image_name##*/}"
+ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://ghcr.io/${REPO_ORGANIZATION:-AeroCore-IO}/${image_basename}}"
+install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
+install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
+install_image_ref="${install_image_ref#docker://}"
+payload="${install_image_ref}:${image_tag}"
 output_dir="${project_root}/output"
 payload_archive="${output_dir}/install-payload.oci"
 iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"