From 78bc16acebffcffcb5e544139cb4c5169f652985 Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:17:46 +0800 Subject: Allow env override for image update ref Pass OSTREE_IMAGE_REF from GitHub repository variables into the image build so image-info.json can point systems at the configured update source. --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 56f8da9..1a7f7d4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -69,6 +69,7 @@ jobs: FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} + OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} run: | sudo -E $(command -v just) build \ ${IMAGE_NAME} \ -- cgit v1.2.3 From 81027c19c3f10e64d095e74b1e3387e8daf4e15f Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:26:39 +0800 Subject: Publish manual testing image tags Allow manually dispatched testing branch builds to publish and sign both the moving testing tag and a dated testing tag. --- .github/workflows/build.yml | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1a7f7d4..e542a89 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -51,7 +51,11 @@ jobs: - name: Default Tag id: gen-default-tag run: | - DEFAULT_TAG=$(just generate-default-tag) + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + DEFAULT_TAG="testing-$(date -u +%Y%m%d)" + else + DEFAULT_TAG=$(just generate-default-tag) + fi echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV @@ -96,9 +100,13 @@ jobs: - name: Generate Build Tags id: gen-build-tags run: | - alias_tags="$(just generate-build-tags \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG})" + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + alias_tags="testing ${DEFAULT_TAG}" + else + alias_tags="$(just generate-build-tags \ + ${IMAGE_NAME} \ + ${DEFAULT_TAG})" + fi echo "Tags for this Action..." echo "${alias_tags}" @@ -114,18 +122,18 @@ jobs: "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" - # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing - # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work + # These `if` statements keep pull requests from publishing packages. + # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} @@ -145,14 +153,14 @@ jobs: # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} -- cgit v1.2.3 From 80dc6c0ccafc54d48b862b46261e12b53675b77f Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:55:21 +0800 Subject: Use BTRFS storage for image builds Mount /var/lib/containers on the larger runner disk before building so rpm-ostree rechunk has enough space for bootc images. --- .github/workflows/build.yml | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e542a89..0b1a54b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,12 +27,31 @@ jobs: steps: # These stage versions are pinned by https://github.com/renovatebot/renovate + - name: Show disk space + run: sudo df -h + + - name: Check if /mnt is there + id: check-mnt + run: | + if sudo mountpoint /mnt; then + echo "mnt_is_there=1" >> "$GITHUB_OUTPUT" + else + echo "mnt_is_there=0" >> "$GITHUB_OUTPUT" + fi + + - name: Free Disk Space + if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 + + - name: Mount BTRFS for podman storage + if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} + uses: ublue-os/container-storage-action@main + with: + target-dir: /var/lib/containers + - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - name: Maximize build space - uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 -- cgit v1.2.3 From be56c887f55c7a342657c5bd3ccf6cace00d4504 Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 01:05:10 +0800 Subject: Free disk space on standard runners --- .github/workflows/build.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0b1a54b..1edbe30 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -30,6 +30,11 @@ jobs: - name: Show disk space run: sudo df -h + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 + with: + extra-squeeze: true + - name: Check if /mnt is there id: check-mnt run: | @@ -39,16 +44,15 @@ jobs: echo "mnt_is_there=0" >> "$GITHUB_OUTPUT" fi - - name: Free Disk Space - if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 - - name: Mount BTRFS for podman storage if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} uses: ublue-os/container-storage-action@main with: target-dir: /var/lib/containers + - name: Show available build space + run: sudo df -h + - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 -- cgit v1.2.3 From 2fdcf15e7266c3eed21d81497180e0521464020c Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 08:25:32 +0800 Subject: Pass Cosign password to signing step --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1edbe30..e72f937 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -187,6 +187,7 @@ jobs: env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} -- cgit v1.2.3 From 5a41b4c5daf60b45105d0dc552c4d46022c92b04 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 15 Jul 2026 14:04:06 +0800 Subject: Integrate Instruments release seed Download and verify the selected release during image builds. Bootstrap it once into the first graphical user's XDG directories. --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e72f937..49d2f81 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -97,6 +97,10 @@ jobs: HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} + INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }} + INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }} + INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} + INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | sudo -E $(command -v just) build \ ${IMAGE_NAME} \ -- cgit v1.2.3 From dd3cd9c9d8d8830bc1d05267c16c30de8758474d Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 22 Jul 2026 16:21:37 +0800 Subject: ci: fix workflow inputs and paths --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 49d2f81..3182eff 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} cancel-in-progress: true jobs: -- cgit v1.2.3 From 5198f735cf5a8c9e8390c2fa2156252c79be72ab Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 22 Jul 2026 16:40:16 +0800 Subject: ci: quote workflow shell variables --- .github/workflows/build.yml | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3182eff..a4661fb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -69,7 +69,7 @@ jobs: run: | IMAGE_NAME=$(just image_name) - echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV + echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV" - name: Default Tag id: gen-default-tag @@ -80,13 +80,13 @@ jobs: DEFAULT_TAG=$(just generate-default-tag) fi - echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV + echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV" - name: Prepare environment run: | # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV" + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV" # This actually builds the container image - name: Build Image @@ -102,17 +102,17 @@ jobs: INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E $(command -v just) build \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" build \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # This is optional, this provides smaller delta updates - name: Rechunk with rpm-ostree id: rechunk run: | - sudo -E $(command -v just) ostree-rechunk \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" ostree-rechunk \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # If you are feeling adventurous, use the new distro agnostic rechunker # https://github.com/coreos/chunkah @@ -131,20 +131,20 @@ jobs: alias_tags="testing ${DEFAULT_TAG}" else alias_tags="$(just generate-build-tags \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG})" + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}")" fi echo "Tags for this Action..." echo "${alias_tags}" - echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT + echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT" - name: Tag Image id: tag-images env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} run: | - sudo -E $(command -v just) tag-images \ + sudo -E "$(command -v just)" tag-images \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" @@ -167,12 +167,13 @@ jobs: run: | set -euox pipefail for tag in ${ALIAS_TAGS}; do - sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} + sudo -E podman push --digestfile=/tmp/digestfile \ + "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}" done digest=$(< /tmp/digestfile) - echo "digest=${digest}" >> $GITHUB_OUTPUT + echo "digest=${digest}" >> "$GITHUB_OUTPUT" # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key @@ -194,4 +195,4 @@ jobs: COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.push-image.outputs.digest }} run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" -- cgit v1.2.3