Merge pull request #11 from AeroCore-IO/testing

Add branch-aware versioned image tags

4 files changed, 50 insertions, 35 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d057db..b9d12cf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,9 +4,7 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
+      - testing
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
@@ -74,16 +72,38 @@ jobs:
 
           echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
 
-      - name: Default Tag
-        id: gen-default-tag
+      - name: Generate Version and Tags
+        id: gen-version
+        env:
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
-            DEFAULT_TAG="testing-$(date -u +%Y%m%d)"
+          set -euo pipefail
+
+          sudo podman pull "${BASE_IMAGE}"
+          FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
+          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            DEFAULT_TAG="testing"
+            VERSION_TAG="testing-${VERSION_BASE}"
+            VERSION_PRETTY="Testing (F${VERSION_BASE})"
+            IMAGE_BRANCH="testing"
+            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
-            DEFAULT_TAG=$(just generate-default-tag)
+            DEFAULT_TAG="stable"
+            VERSION_TAG="${VERSION_BASE}"
+            VERSION_PRETTY="Stable (F${VERSION_BASE})"
+            IMAGE_BRANCH="stable"
+            ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
           fi
 
-          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV"
+          {
+            echo "DEFAULT_TAG=${DEFAULT_TAG}"
+            echo "IMAGE_BRANCH=${IMAGE_BRANCH}"
+            echo "VERSION_TAG=${VERSION_TAG}"
+            echo "VERSION_PRETTY=${VERSION_PRETTY}"
+            echo "ALIAS_TAGS=${ALIAS_TAGS}"
+          } >> "$GITHUB_ENV"
 
       - name: Prepare environment
         run: |
@@ -130,17 +150,9 @@ jobs:
       - name: Generate Build Tags
         id: gen-build-tags
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
-            alias_tags="testing ${DEFAULT_TAG}"
-          else
-            alias_tags="$(just generate-build-tags \
-            "${IMAGE_NAME}" \
-            "${DEFAULT_TAG}")"
-          fi
-
           echo "Tags for this Action..."
-          echo "${alias_tags}"
-          echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT"
+          echo "${ALIAS_TAGS}"
+          echo "alias_tags=${ALIAS_TAGS}" >> "$GITHUB_OUTPUT"
 
       - name: Tag Image
         id: tag-images
@@ -156,14 +168,14 @@ jobs:
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -184,14 +196,14 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 37f5496..131ad5b 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -1,20 +1,17 @@
-name: Validate installer ISO
+name: Validate pull request
 
 on:
   pull_request:
-    paths:
-      - "Justfile"
-      - "installer/**"
-      - "just_scripts/build-installer-iso.sh"
-      - ".github/workflows/build-installer-iso.yml"
-      - ".github/workflows/validate-installer-iso.yml"
+    branches:
+      - main
+      - testing
 
 permissions:
   contents: read
 
 jobs:
-  validate-installer-iso:
-    name: Validate installer ISO inputs
+  validate:
+    name: Run lightweight checks
     runs-on: ubuntu-24.04
 
     steps:
@@ -28,6 +25,9 @@ jobs:
         run: |
           ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
 
+      - name: Validate Just syntax
+        run: just check
+
       - name: Validate Justfile formatting
         run: |
           just --unstable --fmt --check -f Justfile
diff --git a/Justfile b/Justfile
index 257ec46..af61316 100644
--- a/Justfile
+++ b/Justfile
@@ -8,6 +8,9 @@ export image_keywords := env_var("IMAGE_KEYWORDS")
 export image_logo_url := env_var("IMAGE_LOGO_URL")
 export default_tag := env_var("DEFAULT_TAG")
 export bib_image := env_var("BIB_IMAGE")
+export IMAGE_BRANCH := env_var_or_default("IMAGE_BRANCH", "stable")
+export VERSION_TAG := env_var_or_default("VERSION_TAG", default_tag)
+export VERSION_PRETTY := env_var_or_default("VERSION_PRETTY", VERSION_TAG)
 export BASE_IMAGE := env_var_or_default("BASE_IMAGE", "ghcr.io/ublue-os/bazzite-deck:stable")
 export OSTREE_IMAGE_REF := env_var_or_default("OSTREE_IMAGE_REF", "ostree-image-signed:docker://ghcr.io/" + repo_organization + "/" + image_name)
 export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:43")
@@ -126,7 +129,7 @@ build $target_image=image_name $tag=default_tag:
 
     BUILD_ARGS=()
     LABELS=()
-    for arg in BASE_IMAGE FLATPAK_REMOTE_URL HOMEBREW_BOTTLE_DOMAIN HOMEBREW_API_DOMAIN OSTREE_IMAGE_REF INSTRUMENTS_ENABLED INSTRUMENTS_RELEASE_REPOSITORY INSTRUMENTS_VERSION INSTRUMENTS_RELEASE_API_BASE; do
+    for arg in BASE_IMAGE IMAGE_BRANCH VERSION_TAG VERSION_PRETTY FLATPAK_REMOTE_URL HOMEBREW_BOTTLE_DOMAIN HOMEBREW_API_DOMAIN OSTREE_IMAGE_REF INSTRUMENTS_ENABLED INSTRUMENTS_RELEASE_REPOSITORY INSTRUMENTS_VERSION INSTRUMENTS_RELEASE_API_BASE; do
         if [[ -n "${!arg:-}" ]]; then
             BUILD_ARGS+=("--build-arg" "${arg}=${!arg}")
         fi
@@ -138,7 +141,7 @@ build $target_image=image_name $tag=default_tag:
         LABELS+=("--label" "org.opencontainers.image.documentation=https://raw.githubusercontent.com/{{ repo_organization }}/{{ image_name }}/${GIT_SHA}/README.md")
         LABELS+=("--label" "org.opencontainers.image.source=https://github.com/{{ repo_organization }}/{{ image_name }}/blob/${GIT_SHA}/Containerfile")
         LABELS+=("--label" "org.opencontainers.image.url=https://github.com/{{ repo_organization }}/{{ image_name }}/tree/${GIT_SHA}")
-        LABELS+=("--label" "org.opencontainers.image.version={{ default_tag }}.$(date +%Y%m%d)-${GIT_SHA}")
+        LABELS+=("--label" "org.opencontainers.image.version={{ VERSION_TAG }}.$(date +%Y%m%d)-${GIT_SHA}")
     fi
 
     # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
diff --git a/image-template.env b/image-template.env
index 3035db5..22a387b 100644
--- a/image-template.env
+++ b/image-template.env
@@ -11,7 +11,7 @@ IMAGE_KEYWORDS="bootc,oci,linux,bazzite,steam-deck,aerocore"
 
 # Put your own image here for a fancy profile on https://artifacthub.io/!
 IMAGE_LOGO_URL="https://avatars.githubusercontent.com/u/120078124?s=200&v=4"
-DEFAULT_TAG="latest"
+DEFAULT_TAG="stable"
 BIB_IMAGE="quay.io/centos-bootc/bootc-image-builder:latest"
 
 # Keep this on bazzite-deck for Steam Deck, game mode, and handheld customizations.