refactor: rewrite in just, saner defaults (#218)

* refactor: rewrite in just, saner defaults

I think it makes sense to do this as it is longterm easier to maintain,
locally iterate and extend.

Documents how to rebase to a local image, it pains me greatly when
people iterate on github and wait forever for things to build and then
to download the image for trivial things they could also quickly do
locally.

Rpm-ostree rechunker by default instead of opt-in legacy-rechunker,
chunkah is also available if people want to use it already, if we deem
it ready then we can enable it later on. They can all be opted-out of.

Have a way to copy files to /{usr,etc} by default.

We should sign the digest of the image instead of the tag.

Co-Authored-by: a lot of sugar and bad music

* docs: bump fedora-bootc version

Co-authored-by: Jill Fiore <contact@lumaeris.com>

* fix: formatting inconsistency

Co-authored-by: Jill Fiore <contact@lumaeris.com>

* docs: remove variable mentions from workflows

These are now defined in the image-template.env file

* fix: small nits in labels

Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>

---------

Co-authored-by: Jill Fiore <contact@lumaeris.com>
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>

1 files changed, 142 insertions, 12 deletions

diff --git a/Justfile b/Justfile
index 555cca8..150c89c 100644
--- a/Justfile
+++ b/Justfile
@@ -1,6 +1,13 @@
-export image_name := env("IMAGE_NAME", "image-template") # output image name, usually same as repo name, change as needed
-export default_tag := env("DEFAULT_TAG", "latest")
-export bib_image := env("BIB_IMAGE", "quay.io/centos-bootc/bootc-image-builder:latest")
+set dotenv-filename := "image-template.env"
+set dotenv-load
+
+export image_name := env_var("IMAGE_NAME")
+export repo_organization := env_var("REPO_ORGANIZATION")
+export image_desc := env_var("IMAGE_DESC")
+export image_keywords := env_var("IMAGE_KEYWORDS")
+export image_logo_url := env_var("IMAGE_LOGO_URL")
+export default_tag := env_var("DEFAULT_TAG")
+export bib_image := env_var("BIB_IMAGE")
 
 alias build-vm := build-qcow2
 alias rebuild-vm := rebuild-qcow2
@@ -80,25 +87,149 @@ sudoif command *args:
 # just build $target_image $tag
 #
 # Example usage:
-#   just build aurora lts
+#   just build myimage mytag
 #
-# This will build an image 'aurora:lts' with DX and GDX enabled.
+# This will build an image 'myimage:mytag'
 #
 
 # Build the image using the specified parameters
 build $target_image=image_name $tag=default_tag:
     #!/usr/bin/env bash
 
+    set -euox pipefail
+
     BUILD_ARGS=()
+    LABELS=()
+    if [[ -z "$(git status -s)" ]]; then
+        GIT_SHA=$(git rev-parse --short HEAD)
+        LABELS+=("--label" "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/{{ repo_organization }}/{{ image_name }}/${GIT_SHA}/README.md")
+        LABELS+=("--label" "org.opencontainers.image.documentation=https://raw.githubusercontent.com/{{ repo_organization }}/{{ image_name }}/${GIT_SHA}/README.md")
+        LABELS+=("--label" "org.opencontainers.image.source=https://github.com/{{ repo_organization }}/{{ image_name }}/blob/${GIT_SHA}/Containerfile")
+        LABELS+=("--label" "org.opencontainers.image.url=https://github.com/{{ repo_organization }}/{{ image_name }}/tree/${GIT_SHA}")
+        LABELS+=("--label" "org.opencontainers.image.version={{ default_tag }}.$(date +%Y%m%d)-${GIT_SHA}")
+    fi
+
+    # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
+    # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
+    LABELS+=("--label" "io.artifacthub.package.deprecated=false")
+    LABELS+=("--label" "io.artifacthub.package.keywords={{ image_keywords }}")
+    LABELS+=("--label" "io.artifacthub.package.license=Apache-2.0")
+    LABELS+=("--label" "io.artifacthub.package.logo-url={{ image_logo_url }}")
+    LABELS+=("--label" "io.artifacthub.package.prerelease=false")
+    LABELS+=("--label" "org.opencontainers.image.created=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)")
+    LABELS+=("--label" "org.opencontainers.image.description={{ image_desc }}")
+    LABELS+=("--label" "org.opencontainers.image.title={{ image_name }}")
+    LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}")
+
+    # This actually builds the image!
+    PODMAN_BUILD_ARGS=("${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile)
+
+    podman build "${PODMAN_BUILD_ARGS[@]}" .
+
+# Split the image for smaller updates (New)!
+rechunk $target_image=image_name $tag=default_tag:
+    #!/usr/bin/env bash
+
+    set -xeuo pipefail
+
+    # TODO: pin chunkah image to hash once mature enough
+    # You may run into space issues on github runenrs as we are making a
+    # complete copy of the image
+    export CHUNKAH_CONFIG_STR=$(podman inspect "${target_image}")
+    podman run --rm --mount=type=image,src="${target_image}",target=/chunkah \
+    -e CHUNKAH_CONFIG_STR quay.io/coreos/chunkah:latest \
+    build \
+    --verbose \
+    --compressed \
+    --max-layers 128 \
+    --prune /sysroot/ \
+    --label ostree.commit- --label ostree.final-diffid- \
+    --tag "${target_image}:${tag}" | podman load
+
+# Split the image for smaller updates (Classical)!
+ostree-rechunk $target_image=image_name $tag=default_tag:
+    #!/usr/bin/env bash
+
+    set -xeuo pipefail
+
+    # TODO: This is the only blocker for rootless CI
+    # https://github.com/coreos/rpm-ostree/issues/5346
+    if [[ ! "${UID}" -eq "0" ]]; then
+      echo "This needs to run as root."
+      exit 1
+    fi
+
+    # You can use your own base image here to avoid pulling fedora-bootc
+    RPM_OSTREE_CHUNKER_IMAGE="quay.io/fedora/fedora-bootc:latest"
+
+    podman run --rm \
+      --pull=newer \
+      --privileged \
+      -v "/var/lib/containers:/var/lib/containers" \
+      --entrypoint /usr/bin/rpm-ostree \
+      "${RPM_OSTREE_CHUNKER_IMAGE}" \
+      compose build-chunked-oci \
+      --max-layers 127 \
+      --format-version=2 \
+      --bootc \
+      --from "localhost/${target_image}:${tag}" \
+      --output containers-storage:"localhost/${target_image}:${tag}"
+
+# Generate Default Tag
+[group('Utility')]
+generate-default-tag $tag=default_tag:
+    #!/usr/bin/env bash
+    set -eoux pipefail
+
+    echo "${tag}"
+
+# Generate Tags
+[group('Utility')]
+generate-build-tags $target_image=image_name $tag=default_tag:
+    #!/usr/bin/bash
+    set -eoux pipefail
+
+    DATE=$(date +%Y%m%d)
+    BUILD_TAGS=()
     if [[ -z "$(git status -s)" ]]; then
-        BUILD_ARGS+=("--build-arg" "SHA_HEAD_SHORT=$(git rev-parse --short HEAD)")
+        GIT_SHA=$(git rev-parse --short HEAD)
+        BUILD_TAGS+=("${tag}-${GIT_SHA}")
+        BUILD_TAGS+=("${tag}-${DATE}-${GIT_SHA}")
+        BUILD_TAGS+=("${DATE}-${GIT_SHA}")
     fi
 
-    podman build \
-        "${BUILD_ARGS[@]}" \
-        --pull=newer \
-        --tag "${target_image}:${tag}" \
-        .
+    BUILD_TAGS+=("${DATE}")
+    BUILD_TAGS+=("${tag}")
+    BUILD_TAGS+=("${tag}-${DATE}")
+
+    echo "${BUILD_TAGS[@]}"
+
+# Tag Images
+[group('Utility')]
+tag-images $target_image=image_name $tag=default_tag tags="":
+    #!/usr/bin/env bash
+    set -eoux pipefail
+
+    # Get Image, and untag
+    IMAGE=$(podman inspect ${target_image}:${tag} | jq -r .[].Id)
+    podman untag ${IMAGE}
+
+    # Tag Image
+    for tag in {{ tags }}; do
+        podman tag $IMAGE "${target_image}:${tag}"
+    done
+
+    # Show Images
+    podman images
+
+# Image Name
+[group('Utility')]
+[private]
+image_name $target_image=image_name:
+    #!/usr/bin/env bash
+    set -eoux pipefail
+
+    echo "${image_name}"
 
 # Command: _rootful_load_image
 # Description: This script checks if the current user is root or running under sudo. If not, it attempts to resolve the image tag using podman inspect.
@@ -293,7 +424,6 @@ spawn-vm rebuild="0" type="qcow2" ram="6G":
       --vsock=false --pass-ssh-key=false \
       -i ./output/**/*.{{ type }}
 
-
 # Runs shell check on all Bash scripts
 lint:
     #!/usr/bin/env bash