diff options
Diffstat (limited to '.github/workflows/build.yml')
| -rw-r--r-- | .github/workflows/build.yml | 116 |
1 files changed, 102 insertions, 14 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 78b6dc6..0b6b8df 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,7 @@ on: branches: - main - testing + - testing-candidate #schedule: # - cron: '05 10 * * *' # 10:05am UTC everyday workflow_dispatch: @@ -16,6 +17,18 @@ on: env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit + IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }} + REPO_ORGANIZATION: ${{ vars.REPO_ORGANIZATION || github.repository_owner }} + IMAGE_DESC: ${{ vars.IMAGE_DESC || 'AeroCore customized Bazzite Deck image' }} + IMAGE_KEYWORDS: ${{ vars.IMAGE_KEYWORDS || 'bootc,oci,linux,bazzite,steam-deck,aerocore' }} + IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }} + DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }} + BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} + FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} + HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} + HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} + OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }} @@ -82,25 +95,49 @@ jobs: - name: Generate Version and Tags id: gen-version env: - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} run: | set -euo pipefail sudo podman pull "${BASE_IMAGE}" FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora) - VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)" - - if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + VERSION_BASE="${FEDORA_VERSION}.$(date +%Y%m%d)" + + if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then + DEFAULT_TAG="testing-candidate" + VERSION_TAG="testing-candidate-${VERSION_BASE}" + VERSION_PRETTY_PREFIX="Testing candidate" + IMAGE_BRANCH="testing-candidate" + elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then DEFAULT_TAG="testing" VERSION_TAG="testing-${VERSION_BASE}" - VERSION_PRETTY="Testing (F${VERSION_BASE})" + VERSION_PRETTY_PREFIX="Testing" IMAGE_BRANCH="testing" - ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" else DEFAULT_TAG="stable" VERSION_TAG="${VERSION_BASE}" - VERSION_PRETTY="Stable (F${VERSION_BASE})" + VERSION_PRETTY_PREFIX="Stable" IMAGE_BRANCH="stable" + fi + + mapfile -t existing_tags < <(skopeo list-tags "docker://${IMAGE_REGISTRY,,}/${IMAGE_NAME,,}" 2>/dev/null | jq -r '.Tags[]' || true) + if printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}"; then + build=1 + while printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}.${build}"; do + ((build++)) + done + VERSION_TAG="${VERSION_TAG}.${build}" + fi + + VERSION_BASE_PRETTY="${VERSION_TAG#testing-candidate-}" + VERSION_BASE_PRETTY="${VERSION_BASE_PRETTY#testing-}" + VERSION_PRETTY="${VERSION_PRETTY_PREFIX} (F${VERSION_BASE_PRETTY})" + + if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then + ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}" + elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" + else ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}" fi @@ -124,7 +161,8 @@ jobs: - name: Build Image id: build-image env: - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} @@ -134,7 +172,11 @@ jobs: INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E "$(command -v just)" build \ + GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token" + umask 077 + printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}" + trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT + sudo -E GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" @@ -173,18 +215,42 @@ jobs: "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" + - name: Install Syft + id: setup-syft + if: github.event_name != 'pull_request' + uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + with: + syft-version: v1.44.0 + + - name: Generate RPM SBOM + id: generate-sbom + if: github.event_name != 'pull_request' + env: + SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }} + run: | + set -euo pipefail + sbom="${RUNNER_TEMP}/aerocore-sbom.json" + mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")" + trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT + sudo "${SYFT_CMD}" "dir:${mountpoint}" \ + --select-catalogers rpm \ + --source-name "${IMAGE_NAME}-${VERSION_TAG}" \ + -o "syft-json=${sbom}" + sudo chown "$(id -u):$(id -g)" "${sbom}" + echo "sbom=${sbom}" >> "$GITHUB_OUTPUT" + # These `if` statements keep pull requests from publishing packages. # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} @@ -199,20 +265,40 @@ jobs: echo "digest=${digest}" >> "$GITHUB_OUTPUT" + - name: Install ORAS + if: github.event_name != 'pull_request' + uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1 + + - name: Upload RPM SBOM + if: github.event_name != 'pull_request' + env: + DIGEST: ${{ steps.push-image.outputs.digest }} + GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SBOM: ${{ steps.generate-sbom.outputs.sbom }} + run: | + set -euo pipefail + echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin + cd "$(dirname "${SBOM}")" + oras attach \ + --artifact-type application/vnd.spdx+json \ + --annotation "filename=$(basename "${SBOM}")" \ + "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \ + "$(basename "${SBOM}")" + # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} @@ -226,9 +312,11 @@ jobs: needs: [build_push] if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || - github.ref_name == 'testing') + github.ref_name == 'testing' || + github.ref_name == 'testing-candidate') permissions: contents: write + packages: read secrets: inherit uses: ./.github/workflows/generate_release.yml with: |