diff options
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/build-disk.yml | 24 | ||||
| -rw-r--r-- | .github/workflows/build-live-installer.yml | 128 | ||||
| -rw-r--r-- | .github/workflows/build.yml | 94 | ||||
| -rw-r--r-- | .github/workflows/promote-acr.yml | 18 | ||||
| -rw-r--r-- | .github/workflows/validate-live-installer.yml | 40 |
5 files changed, 259 insertions, 45 deletions
diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml index 1de6c6e..cef58be 100644 --- a/.github/workflows/build-disk.yml +++ b/.github/workflows/build-disk.yml @@ -19,9 +19,9 @@ on: branches: - main paths: - - './disk_config/disk.toml' - - './disk_config/iso.toml' - - './.github/workflows/build-disk.yml' + - 'disk_config/disk.toml' + - 'disk_config/iso-kde.toml' + - '.github/workflows/build-disk.yml' env: IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync @@ -36,7 +36,7 @@ concurrency: jobs: build: name: Build disk images - runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} + runs-on: ${{ inputs.platform == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }} strategy: fail-fast: false matrix: @@ -54,11 +54,13 @@ jobs: # Concatenate the types with a hyphen DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-') # Lowercase the image uri - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} - echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV} - echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV} - echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV} + { + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" + echo "IMAGE_NAME=${IMAGE_NAME,,}" + echo "DISK_TYPE=${DISK_TYPE}" + echo "USER_UID=${USER_UID}" + echo "USER_GID=${USER_GID}" + } >> "$GITHUB_ENV" - name: Install dependencies if: inputs.platform == 'arm64' @@ -82,7 +84,7 @@ jobs: uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main with: builder-image: ${{ env.BIB_IMAGE }} - config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }} + config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso-kde.toml' || './disk_config/disk.toml' }} image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} chown: ${{ env.USER_UID }}:${{ env.USER_GID }} types: ${{ matrix.disk-type }} @@ -112,4 +114,4 @@ jobs: run: | sudo apt-get update sudo apt-get install -y rclone - rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }} + rclone copy "$SOURCE_DIR" "S3:${{ secrets.S3_BUCKET_NAME }}" diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml new file mode 100644 index 0000000..059c3e9 --- /dev/null +++ b/.github/workflows/build-live-installer.yml @@ -0,0 +1,128 @@ +name: Build live installer + +on: + workflow_dispatch: + inputs: + image_tag: + description: "AeroCore image tag to install" + required: false + default: latest + type: string + workflow_call: + push: + branches: + - main + paths: + - "Justfile" + - "installer/**" + - "just_scripts/build-live-installer.sh" + - ".github/workflows/build-live-installer.yml" + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} + cancel-in-progress: true + +jobs: + build-live-installer: + name: Build KDE live installer + runs-on: ubuntu-24.04 + permissions: + contents: read + packages: read + + env: + IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + IMAGE_TAG: ${{ inputs.image_tag || 'latest' }} + # Keep these aligned with the Fedora major used by the target bazzite-deck base image. + LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43 + FEDORA_VERSION: "43" + + steps: + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9 + with: + remove-codeql: true + + - name: Mount container storage BTRFS loopback + run: | + sudo truncate -s 70G /mnt/podman-storage.img + sudo mkfs.btrfs -f /mnt/podman-storage.img + sudo podman system reset --force + sudo systemctl stop podman.service + sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage + sudo systemctl start podman.service + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + + - name: Install just + uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + + - name: Prepare image references + run: | + image_name="$(just image_name)" + image_registry="${IMAGE_REGISTRY,,}" + echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV" + echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV" + + - name: Login to GHCR + run: | + echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \ + --username '${{ github.actor }}' --password-stdin + + - name: Pull AeroCore install image + run: | + sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" + + - name: Build live installer payload + run: | + mkdir -p output + sudo podman tag \ + "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \ + localhost/aerocore-live-payload:latest + sudo podman save \ + --format oci-archive \ + --output output/install-payload.oci \ + localhost/aerocore-live-payload:latest + + sudo podman build \ + --cap-add sys_admin \ + --security-opt label=disable \ + --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \ + --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \ + --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \ + --tag localhost/aerocore-live-payload:latest \ + --file installer/Containerfile \ + . + + - name: Build ISO + id: build + uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr + with: + arch: x86_64 + image_name: aerocore-live-payload + image_repo: localhost + variant: Kinoite + version: ${{ env.FEDORA_VERSION }} + image_tag: latest + iso_name: aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso + enable_cache_dnf: "false" + enable_cache_skopeo: "false" + enable_flatpak_dependencies: "false" + additional_templates: /github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl + + - name: Display checksum + run: | + cat "${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM" + + - name: Upload ISO artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: aerocore-os-live-installer-${{ env.IMAGE_TAG }} + path: | + ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }} + ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM + if-no-files-found: error + compression-level: 0 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 95f2f1c..b4b9d89 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} cancel-in-progress: true jobs: @@ -27,11 +27,34 @@ jobs: steps: # These stage versions are pinned by https://github.com/renovatebot/renovate - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - name: Show disk space + run: sudo df -h - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 + with: + extra-squeeze: true + + - name: Check if /mnt is there + id: check-mnt + run: | + if sudo mountpoint /mnt; then + echo "mnt_is_there=1" >> "$GITHUB_OUTPUT" + else + echo "mnt_is_there=0" >> "$GITHUB_OUTPUT" + fi + + - name: Mount BTRFS for podman storage + if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} + uses: ublue-os/container-storage-action@main + with: + target-dir: /var/lib/containers + + - name: Show available build space + run: sudo df -h + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 @@ -46,20 +69,24 @@ jobs: run: | IMAGE_NAME=$(just image_name) - echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV + echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV" - name: Default Tag id: gen-default-tag run: | - DEFAULT_TAG=$(just generate-default-tag) + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + DEFAULT_TAG="testing-$(date -u +%Y%m%d)" + else + DEFAULT_TAG=$(just generate-default-tag) + fi - echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV + echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV" - name: Prepare environment run: | # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV" + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV" # This actually builds the container image - name: Build Image @@ -69,18 +96,23 @@ jobs: FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} + OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} + INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }} + INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }} + INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} + INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E $(command -v just) build \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" build \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # This is optional, this provides smaller delta updates - name: Rechunk with rpm-ostree id: rechunk run: | - sudo -E $(command -v just) ostree-rechunk \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" ostree-rechunk \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # If you are feeling adventurous, use the new distro agnostic rechunker # https://github.com/coreos/chunkah @@ -95,48 +127,53 @@ jobs: - name: Generate Build Tags id: gen-build-tags run: | - alias_tags="$(just generate-build-tags \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG})" + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + alias_tags="testing ${DEFAULT_TAG}" + else + alias_tags="$(just generate-build-tags \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}")" + fi echo "Tags for this Action..." echo "${alias_tags}" - echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT + echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT" - name: Tag Image id: tag-images env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} run: | - sudo -E $(command -v just) tag-images \ + sudo -E "$(command -v just)" tag-images \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" - # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing - # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work + # These `if` statements keep pull requests from publishing packages. + # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} run: | set -euox pipefail for tag in ${ALIAS_TAGS}; do - sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} + sudo -E podman push --digestfile=/tmp/digestfile \ + "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}" done digest=$(< /tmp/digestfile) - echo "digest=${digest}" >> $GITHUB_OUTPUT + echo "digest=${digest}" >> "$GITHUB_OUTPUT" # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key @@ -144,17 +181,18 @@ jobs: # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.push-image.outputs.digest }} run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml index 99a67f8..6b00e3b 100644 --- a/.github/workflows/promote-acr.yml +++ b/.github/workflows/promote-acr.yml @@ -13,7 +13,7 @@ on: required: false type: string image_name: - description: "Image name override; defaults to image-template.env" + description: "Image name override; defaults to IMAGE_NAME var, then image-template.env" required: false type: string @@ -48,18 +48,21 @@ jobs: - name: Prepare image variables env: IMAGE_NAME_INPUT: ${{ inputs.image_name }} + IMAGE_NAME_VAR: ${{ vars.IMAGE_NAME }} SOURCE_TAG: ${{ inputs.source_tag }} TARGET_TAGS_INPUT: ${{ inputs.target_tags }} run: | set -euo pipefail - image_name="${IMAGE_NAME_INPUT:-$(just image_name)}" + image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-$(just image_name)}}" target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}" - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV" - echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV" - echo "SOURCE_TAG=${SOURCE_TAG}" >> "$GITHUB_ENV" - echo "TARGET_TAGS=${target_tags}" >> "$GITHUB_ENV" + { + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" + echo "IMAGE_NAME=${image_name,,}" + echo "SOURCE_TAG=${SOURCE_TAG}" + echo "TARGET_TAGS=${target_tags}" + } >> "$GITHUB_ENV" - name: Validate ACR configuration env: @@ -68,6 +71,7 @@ jobs: ACR_USERNAME: ${{ secrets.ACR_USERNAME }} ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }} COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | set -euo pipefail @@ -76,6 +80,7 @@ jobs: : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}" : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}" : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}" + : "${COSIGN_PASSWORD:?Repository secret COSIGN_PASSWORD is required.}" - name: Login to GitHub Container Registry env: @@ -140,6 +145,7 @@ jobs: ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }} COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.promote.outputs.digest }} run: | set -euo pipefail diff --git a/.github/workflows/validate-live-installer.yml b/.github/workflows/validate-live-installer.yml new file mode 100644 index 0000000..3d35a5d --- /dev/null +++ b/.github/workflows/validate-live-installer.yml @@ -0,0 +1,40 @@ +name: Validate live installer + +on: + pull_request: + paths: + - "Justfile" + - "installer/**" + - "just_scripts/build-live-installer.sh" + - ".github/workflows/build-live-installer.yml" + - ".github/workflows/validate-live-installer.yml" + +permissions: + contents: read + +jobs: + validate-live-installer: + name: Validate live installer inputs + runs-on: ubuntu-24.04 + + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + + - name: Install just + uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + + - name: Validate workflow YAML + run: | + ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }' + + - name: Validate Justfile formatting + run: | + just --unstable --fmt --check -f Justfile + + - name: Validate build scripts + run: | + for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do + bash -n "$script" + done + bash -n system_files/usr/libexec/aerocore-instruments-setup |