From 288294e0995a900ddf273fafa20cfc34d2736f6e Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 19:55:59 -0500 Subject: feat: add github actions build workflow --- .github/workflows/build.yml | 158 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 158 insertions(+) create mode 100644 .github/workflows/build.yml (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..381ec83 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,158 @@ +--- +name: build-ublue-custom +on: + pull_request: + branches: + - main + schedule: + - cron: '05 10 * * *' # 10:05am UTC everyday + push: + branches: + - main + paths-ignore: + - '**/README.md' + workflow_dispatch: + +# The env variables starting with "ARG_" are described in the Containerfile of this repo. +# Look there for options and explanations for their usage. +# The values here are defaults and should be modified if using a different image, needing +# nvidia, a specific nvidia driver, or a different Fedora version. +env: + ARG_IMAGE_NAME: "silverblue" + ARG_IMAGE_SUFFIX: "main" + ARG_FEDORA_MAJOR_VERSION: "38" + ARG_NVIDIA_MAJOR_VERSION: "" + IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + +jobs: + push-ghcr: + name: Build and push image + runs-on: ubuntu-22.04 + + permissions: + contents: read + packages: write + id-token: write + + steps: + # Checkout push-to-registry action GitHub repository + - name: Checkout Push to Registry action + uses: actions/checkout@v3 + + - name: Generate tags + id: generate-tags + shell: bash + run: | + # Generate a timestamp for creating an image version history + TIMESTAMP="$(date +%Y%m%d)" + VARIANT="${{ env.ARG_FEDORA_MAJOR_VERSION }}" + + COMMIT_TAGS=() + BUILD_TAGS=() + + # Have tags for tracking builds during pull request + SHA_SHORT="${GITHUB_SHA::7}" + COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}") + COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}") + + COMMIT_TAGS+=("pr-${{ github.event.number }}") + COMMIT_TAGS+=("${SHA_SHORT}") + + BUILD_TAGS=("${VARIANT}") + + # Append matching timestamp tags to keep a version history + for TAG in "${BUILD_TAGS[@]}"; do + BUILD_TAGS+=("${TAG}-${TIMESTAMP}") + done + + BUILD_TAGS+=("${TIMESTAMP}") + BUILD_TAGS+=("latest") + + if [[ "${{ github.event_name }}" == "pull_request" ]]; then + echo "Generated the following commit tags: " + for TAG in "${COMMIT_TAGS[@]}"; do + echo "${TAG}" + done + + alias_tags=("${COMMIT_TAGS[@]}") + else + alias_tags=("${BUILD_TAGS[@]}") + fi + + echo "Generated the following build tags: " + for TAG in "${BUILD_TAGS[@]}"; do + echo "${TAG}" + done + + echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT + + - name: Get current version + id: labels + run: | + ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}:${{ env.FEDORA_MAJOR_VERSION}}${{ env.NVIDIA_MAJOR_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') + echo "VERSION=$ver" >> $GITHUB_OUTPUT + + # Build metadata + - name: Image Metadata + uses: docker/metadata-action@v4 + id: meta + with: + images: | + ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom + + labels: | + io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md + org.opencontainers.image.description=Customized ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} image. + org.opencontainers.image.title=${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} + org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} + + # Build image using Buildah action + - name: Build Image + id: build_image + uses: redhat-actions/buildah-build@v2 + with: + containerfiles: | + ./Containerfile + # Postfix image name with -custom to make it a little more descriptive + # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format + image: ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom + tags: | + ${{ steps.generate-tags.outputs.alias_tags }} + build-args: | + IMAGE_NAME=${{ env.ARG_IMAGE_NAME }} + IMAGE_SUFFIX=${{ env.ARG_IMAGE_SUFFIX }} + FEDORA_MAJOR_VERSION=${{ env.ARG_FEDORA_MAJOR_VERSION }} + NVIDIA_MAJOR_VERSION=${{ env.ARG_NVIDIA_MAJOR_VERSION }} + labels: ${{ steps.meta.outputs.labels }} + oci: false + + # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. + # https://github.com/macbre/push-to-ghcr/issues/12 + - name: Lowercase Registry + id: registry_case + uses: ASzc/change-string-case-action@v5 + with: + string: ${{ env.IMAGE_REGISTRY }} + + - name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Push the image to GHCR (Image Registry) + - name: Push To GHCR + uses: redhat-actions/push-to-registry@v2 + id: push + env: + REGISTRY_USER: ${{ github.actor }} + REGISTRY_PASSWORD: ${{ github.token }} + with: + image: ${{ steps.build_image.outputs.image }} + tags: ${{ steps.build_image.outputs.tags }} + registry: ${{ steps.registry_case.outputs.lowercase }} + username: ${{ env.REGISTRY_USER }} + password: ${{ env.REGISTRY_PASSWORD }} + extra-args: | + --disable-content-trust -- cgit v1.2.3 From 9135f2ddeb003cf96a2b711c89ffae657ac3cf5f Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 20:09:48 -0500 Subject: refactor: simplify some variable names --- .github/workflows/build.yml | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 381ec83..ced7a05 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,11 +18,12 @@ on: # The values here are defaults and should be modified if using a different image, needing # nvidia, a specific nvidia driver, or a different Fedora version. env: - ARG_IMAGE_NAME: "silverblue" - ARG_IMAGE_SUFFIX: "main" - ARG_FEDORA_MAJOR_VERSION: "38" - ARG_NVIDIA_MAJOR_VERSION: "" - IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + ARG_SOURCE_IMAGE: "silverblue" + ARG_SOURCE_SUFFIX: "main" + ARG_FEDORA_VERSION: "38" + ARG_NVIDIA_VERSION: "" + IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" + MY_IMAGE_NAME: "customzed-ublue" jobs: push-ghcr: @@ -45,7 +46,7 @@ jobs: run: | # Generate a timestamp for creating an image version history TIMESTAMP="$(date +%Y%m%d)" - VARIANT="${{ env.ARG_FEDORA_MAJOR_VERSION }}" + VARIANT="${{ env.ARG_FEDORA_VERSION }}" COMMIT_TAGS=() BUILD_TAGS=() @@ -89,7 +90,7 @@ jobs: - name: Get current version id: labels run: | - ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}:${{ env.FEDORA_MAJOR_VERSION}}${{ env.NVIDIA_MAJOR_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') + ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') echo "VERSION=$ver" >> $GITHUB_OUTPUT # Build metadata @@ -98,12 +99,12 @@ jobs: id: meta with: images: | - ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom + ${{ env.MY_IMAGE_NAME }} labels: | io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md - org.opencontainers.image.description=Customized ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} image. - org.opencontainers.image.title=${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} + org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image. + org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }} org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} # Build image using Buildah action @@ -115,14 +116,14 @@ jobs: ./Containerfile # Postfix image name with -custom to make it a little more descriptive # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format - image: ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom + image: ${{ env.MY_IMAGE_NAME }} tags: | ${{ steps.generate-tags.outputs.alias_tags }} build-args: | - IMAGE_NAME=${{ env.ARG_IMAGE_NAME }} - IMAGE_SUFFIX=${{ env.ARG_IMAGE_SUFFIX }} - FEDORA_MAJOR_VERSION=${{ env.ARG_FEDORA_MAJOR_VERSION }} - NVIDIA_MAJOR_VERSION=${{ env.ARG_NVIDIA_MAJOR_VERSION }} + SOURCE_IMAGE=${{ env.ARG_SOURCE_IMAGE }} + SOURCE_SUFFIX=${{ env.ARG_SOURCE_SUFFIX }} + FEDORA_VERSION=${{ env.ARG_FEDORA_VERSION }} + NVIDIA_VERSION=${{ env.ARG_NVIDIA_VERSION }} labels: ${{ steps.meta.outputs.labels }} oci: false -- cgit v1.2.3 From b4acc15fcf20d8d3fdff85becc4170d3f9f7acfa Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 20:16:41 -0500 Subject: refactor: fixing typo and cleanup comments --- .github/workflows/build.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ced7a05..7811bf7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,16 +14,15 @@ on: workflow_dispatch: # The env variables starting with "ARG_" are described in the Containerfile of this repo. -# Look there for options and explanations for their usage. # The values here are defaults and should be modified if using a different image, needing # nvidia, a specific nvidia driver, or a different Fedora version. env: - ARG_SOURCE_IMAGE: "silverblue" - ARG_SOURCE_SUFFIX: "main" - ARG_FEDORA_VERSION: "38" - ARG_NVIDIA_VERSION: "" - IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" - MY_IMAGE_NAME: "customzed-ublue" + MY_IMAGE_NAME: "custom-silverblue" # the name of the image produced by this build + ARG_SOURCE_IMAGE: "silverblue" # see Containerfile for list of possible upstream images + ARG_SOURCE_SUFFIX: "main" # see Containerfile + ARG_FEDORA_VERSION: "38" # see Containerfile + ARG_NVIDIA_VERSION: "" # see Containerfile + IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit jobs: push-ghcr: @@ -102,7 +101,7 @@ jobs: ${{ env.MY_IMAGE_NAME }} labels: | - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md + io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository }}/main/README.md org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image. org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }} org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} -- cgit v1.2.3 From 86057f3f8fd309cc780886907d8f1268af787f13 Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 20:26:38 -0500 Subject: chore(ci): fixing urls in build --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7811bf7..480ae9d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -89,7 +89,7 @@ jobs: - name: Get current version id: labels run: | - ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') + ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]') echo "VERSION=$ver" >> $GITHUB_OUTPUT # Build metadata @@ -101,8 +101,8 @@ jobs: ${{ env.MY_IMAGE_NAME }} labels: | - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository }}/main/README.md - org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image. + io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md + org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }} org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} -- cgit v1.2.3 From f1174061a3be3cf983ce7d018e72eb29bba908ea Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 20:30:49 -0500 Subject: chore(ci): fix version query --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 480ae9d..745b0c2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -89,7 +89,7 @@ jobs: - name: Get current version id: labels run: | - ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]') + ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') echo "VERSION=$ver" >> $GITHUB_OUTPUT # Build metadata -- cgit v1.2.3 From c15c1169de2a4ce82615101c53eb262237bd099e Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Sat, 26 Aug 2023 20:32:04 -0500 Subject: chore(ci): the ARG_ was missing from the env var in version lookup --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 745b0c2..fdd54f0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -89,7 +89,7 @@ jobs: - name: Get current version id: labels run: | - ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]') + ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.ARG_FEDORA_VERSION }}${{ env.ARG_NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]') echo "VERSION=$ver" >> $GITHUB_OUTPUT # Build metadata -- cgit v1.2.3 From 533cc8df68168466dcba65c667d09884f3817c98 Mon Sep 17 00:00:00 2001 From: Noel Miller Date: Sun, 3 Mar 2024 11:39:58 -0600 Subject: feat: Updated build.yml to include container signing section --- .github/workflows/build.yml | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index fdd54f0..96547dc 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,7 +20,7 @@ env: MY_IMAGE_NAME: "custom-silverblue" # the name of the image produced by this build ARG_SOURCE_IMAGE: "silverblue" # see Containerfile for list of possible upstream images ARG_SOURCE_SUFFIX: "main" # see Containerfile - ARG_FEDORA_VERSION: "38" # see Containerfile + ARG_FEDORA_VERSION: "39" # see Containerfile ARG_NVIDIA_VERSION: "" # see Containerfile IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit @@ -156,3 +156,22 @@ jobs: password: ${{ env.REGISTRY_PASSWORD }} extra-args: | --disable-content-trust + + # This section is optional and only needs to be enabled in you plan on distributing + # your project to others to consume. You will need to create a public and private key + # using Cosign and save the private key as a repository secret in Github for this workflow + # to consume. For more details, review the image signing section of the README. + + # Sign container + + #- uses: sigstore/cosign-installer@v3.4.0 + # if: github.event_name != 'pull_request' + + #- name: Sign container image + # if: github.event_name != 'pull_request' + # run: | + # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} + # env: + # TAGS: ${{ steps.push.outputs.digest }} + # COSIGN_EXPERIMENTAL: false + # COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} -- cgit v1.2.3 From c3c55d367f9ad889c5ee89ea08d4f8f27c9cf920 Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Fri, 12 Apr 2024 15:20:45 -0500 Subject: chore: simplify workflow even more --- .github/workflows/build.yml | 41 ++++++++--------------------------------- 1 file changed, 8 insertions(+), 33 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 96547dc..9154ca4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -13,21 +13,15 @@ on: - '**/README.md' workflow_dispatch: -# The env variables starting with "ARG_" are described in the Containerfile of this repo. -# The values here are defaults and should be modified if using a different image, needing -# nvidia, a specific nvidia driver, or a different Fedora version. env: - MY_IMAGE_NAME: "custom-silverblue" # the name of the image produced by this build - ARG_SOURCE_IMAGE: "silverblue" # see Containerfile for list of possible upstream images - ARG_SOURCE_SUFFIX: "main" # see Containerfile - ARG_FEDORA_VERSION: "39" # see Containerfile - ARG_NVIDIA_VERSION: "" # see Containerfile + MY_IMAGE_NAME: "ublue-custom" # the name of the image produced by this build + MY_IMAGE_DESC: "My Customized Universal Blue System Image" IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit jobs: - push-ghcr: + build_push: name: Build and push image - runs-on: ubuntu-22.04 + runs-on: ubuntu-latest permissions: contents: read @@ -45,21 +39,14 @@ jobs: run: | # Generate a timestamp for creating an image version history TIMESTAMP="$(date +%Y%m%d)" - VARIANT="${{ env.ARG_FEDORA_VERSION }}" - COMMIT_TAGS=() BUILD_TAGS=() # Have tags for tracking builds during pull request SHA_SHORT="${GITHUB_SHA::7}" - COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}") - COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}") - COMMIT_TAGS+=("pr-${{ github.event.number }}") COMMIT_TAGS+=("${SHA_SHORT}") - BUILD_TAGS=("${VARIANT}") - # Append matching timestamp tags to keep a version history for TAG in "${BUILD_TAGS[@]}"; do BUILD_TAGS+=("${TAG}-${TIMESTAMP}") @@ -86,12 +73,6 @@ jobs: echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT - - name: Get current version - id: labels - run: | - ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.ARG_FEDORA_VERSION }}${{ env.ARG_NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]') - echo "VERSION=$ver" >> $GITHUB_OUTPUT - # Build metadata - name: Image Metadata uses: docker/metadata-action@v4 @@ -102,9 +83,8 @@ jobs: labels: | io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md - org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} + org.opencontainers.image.description=${{ env.MY_IMAGE_DESC }} org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }} - org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} # Build image using Buildah action - name: Build Image @@ -118,11 +98,6 @@ jobs: image: ${{ env.MY_IMAGE_NAME }} tags: | ${{ steps.generate-tags.outputs.alias_tags }} - build-args: | - SOURCE_IMAGE=${{ env.ARG_SOURCE_IMAGE }} - SOURCE_SUFFIX=${{ env.ARG_SOURCE_SUFFIX }} - FEDORA_VERSION=${{ env.ARG_FEDORA_VERSION }} - NVIDIA_VERSION=${{ env.ARG_NVIDIA_VERSION }} labels: ${{ steps.meta.outputs.labels }} oci: false @@ -141,8 +116,7 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Push the image to GHCR (Image Registry) - - name: Push To GHCR + - name: Push Image to GHCR uses: redhat-actions/push-to-registry@v2 id: push env: @@ -170,7 +144,8 @@ jobs: #- name: Sign container image # if: github.event_name != 'pull_request' # run: | - # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} + # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/$ +{{ steps.build_image.outputs.image }}@${TAGS} # env: # TAGS: ${{ steps.push.outputs.digest }} # COSIGN_EXPERIMENTAL: false -- cgit v1.2.3 From bcbb4d46263bf335f27b9a4a5ecc901e97aa6d96 Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Fri, 12 Apr 2024 15:37:55 -0500 Subject: docs: add cosign and cleanup other info --- .github/workflows/build.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9154ca4..8840974 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -144,8 +144,7 @@ jobs: #- name: Sign container image # if: github.event_name != 'pull_request' # run: | - # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/$ -{{ steps.build_image.outputs.image }}@${TAGS} + # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} # env: # TAGS: ${{ steps.push.outputs.digest }} # COSIGN_EXPERIMENTAL: false -- cgit v1.2.3 From 7e17e593a36f3b32760567cf9e35d3c73df76342 Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Fri, 12 Apr 2024 17:02:33 -0500 Subject: chore(ci): expect signing by default --- .github/workflows/build.yml | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8840974..d5be3bc 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -138,14 +138,12 @@ jobs: # Sign container - #- uses: sigstore/cosign-installer@v3.4.0 - # if: github.event_name != 'pull_request' - - #- name: Sign container image - # if: github.event_name != 'pull_request' - # run: | - # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} - # env: - # TAGS: ${{ steps.push.outputs.digest }} - # COSIGN_EXPERIMENTAL: false - # COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + - name: Sign container image + uses: sigstore/cosign-installer@v3.4.0 + if: github.event_name != 'pull_request' + run: | + cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} + env: + TAGS: ${{ steps.push.outputs.digest }} + COSIGN_EXPERIMENTAL: false + COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} -- cgit v1.2.3 From 24a1c643c8f298d0e5facd5e151e0e6b92e03ae5 Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Mon, 22 Apr 2024 13:48:20 -0500 Subject: fix(ci): split cosign steps (#6) A step can't have both "uses" and "run" so the cosign step needed to be split. --- .github/workflows/build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d5be3bc..d41d98d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -137,9 +137,10 @@ jobs: # to consume. For more details, review the image signing section of the README. # Sign container + - uses: sigstore/cosign-installer@v3.4.0 + if: github.event_name != 'pull_request' - name: Sign container image - uses: sigstore/cosign-installer@v3.4.0 if: github.event_name != 'pull_request' run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} -- cgit v1.2.3 From 97069176d8f800786f038b9b161677e976925f3b Mon Sep 17 00:00:00 2001 From: Benjamin Sherman Date: Mon, 22 Apr 2024 23:05:49 -0500 Subject: refactor: use repo name as default image name (#7) Also makes the source image's tag easier to understand in the Containerfile. --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d41d98d..f7cc31b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,8 +14,8 @@ on: workflow_dispatch: env: - MY_IMAGE_NAME: "ublue-custom" # the name of the image produced by this build - MY_IMAGE_DESC: "My Customized Universal Blue System Image" + MY_IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names + MY_IMAGE_DESC: "My Customized Universal Blue Image" IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit jobs: -- cgit v1.2.3 From 83cb8be06c80c2b5cffe675f8e2edddb97d480bc Mon Sep 17 00:00:00 2001 From: Marcin Jahn <10273406+marcinjahn@users.noreply.github.com> Date: Tue, 23 Apr 2024 20:58:01 +0200 Subject: chore: update Node 16 actions to latest versions (#11) Co-authored-by: Benjamin Sherman Co-authored-by: Noel Miller <4983138+noelmiller@users.noreply.github.com> --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f7cc31b..5daee78 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,7 +31,7 @@ jobs: steps: # Checkout push-to-registry action GitHub repository - name: Checkout Push to Registry action - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Generate tags id: generate-tags @@ -75,7 +75,7 @@ jobs: # Build metadata - name: Image Metadata - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v5 id: meta with: images: | -- cgit v1.2.3 From 1b792e51606226d288cb53eda620f79df558533b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 19:00:30 -0500 Subject: chore(deps): bump ASzc/change-string-case-action from 5 to 6 (#17) Bumps [ASzc/change-string-case-action](https://github.com/aszc/change-string-case-action) from 5 to 6. - [Release notes](https://github.com/aszc/change-string-case-action/releases) - [Commits](https://github.com/aszc/change-string-case-action/compare/v5...v6) --- updated-dependencies: - dependency-name: ASzc/change-string-case-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5daee78..55e56a1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -105,7 +105,7 @@ jobs: # https://github.com/macbre/push-to-ghcr/issues/12 - name: Lowercase Registry id: registry_case - uses: ASzc/change-string-case-action@v5 + uses: ASzc/change-string-case-action@v6 with: string: ${{ env.IMAGE_REGISTRY }} -- cgit v1.2.3 From c38aa17113f30aa318df390d99bec16dc2e6ceca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 19:00:41 -0500 Subject: chore(deps): bump docker/login-action from 2 to 3 (#16) Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v2...v3) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 55e56a1..888926c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -110,7 +110,7 @@ jobs: string: ${{ env.IMAGE_REGISTRY }} - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} -- cgit v1.2.3 From 92734d961fd6cb96ae69c283fdc947fe67fbac47 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 19:02:52 -0500 Subject: chore(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (#15) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 888926c..8ea733a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -137,7 +137,7 @@ jobs: # to consume. For more details, review the image signing section of the README. # Sign container - - uses: sigstore/cosign-installer@v3.4.0 + - uses: sigstore/cosign-installer@v3.5.0 if: github.event_name != 'pull_request' - name: Sign container image -- cgit v1.2.3 From 56254fb5918995238bc7d10464f4c6f496ac1e2e Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Wed, 26 Jun 2024 19:28:49 -0700 Subject: feat: Maximize build space (#22) Required to build Bazzite images --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8ea733a..4f8e6d5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,6 +33,9 @@ jobs: - name: Checkout Push to Registry action uses: actions/checkout@v4 + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@v7 + - name: Generate tags id: generate-tags shell: bash -- cgit v1.2.3 From eef1bd332732f5ce732fa4e83b571e59418e7357 Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Mon, 12 Aug 2024 17:29:11 -0400 Subject: chore(ci): explicitly use ubuntu 24.04 (#28) Avoids the tar bug --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4f8e6d5..73acdd1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,7 +21,7 @@ env: jobs: build_push: name: Build and push image - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 permissions: contents: read -- cgit v1.2.3 From 20771a4d6bed98e77054e139e6747f21a98685b7 Mon Sep 17 00:00:00 2001 From: Robin Avery Date: Sun, 1 Sep 2024 07:12:39 -0400 Subject: style: fix wording in build.yml comment (#29) --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 73acdd1..3a979f3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -134,8 +134,8 @@ jobs: extra-args: | --disable-content-trust - # This section is optional and only needs to be enabled in you plan on distributing - # your project to others to consume. You will need to create a public and private key + # This section is optional and only needs to be enabled if you plan on distributing + # your project for others to consume. You will need to create a public and private key # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. -- cgit v1.2.3 From 5267feaaea8fb23561c5e5ca640e4ca614a34b91 Mon Sep 17 00:00:00 2001 From: XLion Date: Wed, 27 Nov 2024 03:18:22 +0800 Subject: feat(ci): buildah: del `disable-content-trust`, enable zstd compression; bump sigstore/cosign-installer to 3.7.0 (#39) --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3a979f3..a61ef2d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -132,7 +132,7 @@ jobs: username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} extra-args: | - --disable-content-trust + --compression-format=zstd # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key @@ -140,7 +140,7 @@ jobs: # to consume. For more details, review the image signing section of the README. # Sign container - - uses: sigstore/cosign-installer@v3.5.0 + - uses: sigstore/cosign-installer@v3.7.0 if: github.event_name != 'pull_request' - name: Sign container image -- cgit v1.2.3 From 484c6aa0019d481f5673fb3289d24d3be9cd2658 Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Mon, 2 Dec 2024 22:52:48 -0500 Subject: feat(ci): add concurrency (#38) This makes it so that inprogress builds are cancelled when you make a new push. Matches the rest of ublue. --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a61ef2d..b6d3598 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,6 +18,10 @@ env: MY_IMAGE_DESC: "My Customized Universal Blue Image" IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit +concurrency: + group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} + cancel-in-progress: true + jobs: build_push: name: Build and push image -- cgit v1.2.3 From d251964f09d872d46313aefcdde1c2e4db0fe4fe Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Sun, 5 Jan 2025 12:33:03 -0300 Subject: feat: add artifacthub metadata by default and WIP README (#48) --- .github/workflows/build.yml | 152 +++++++++++++++++++------------------------- 1 file changed, 64 insertions(+), 88 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b6d3598..e4c7ea1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ --- -name: build-ublue-custom +name: Build Custom Image on: pull_request: branches: @@ -17,6 +17,7 @@ env: MY_IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names MY_IMAGE_DESC: "My Customized Universal Blue Image" IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit + ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/! concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} @@ -33,67 +34,52 @@ jobs: id-token: write steps: - # Checkout push-to-registry action GitHub repository - - name: Checkout Push to Registry action - uses: actions/checkout@v4 - - - name: Maximize build space - uses: ublue-os/remove-unwanted-software@v7 - - - name: Generate tags - id: generate-tags - shell: bash + # These stage versions are pinned by https://github.com/renovatebot/renovate + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + + - name: Get current date + id: date run: | - # Generate a timestamp for creating an image version history - TIMESTAMP="$(date +%Y%m%d)" - COMMIT_TAGS=() - BUILD_TAGS=() - - # Have tags for tracking builds during pull request - SHA_SHORT="${GITHUB_SHA::7}" - COMMIT_TAGS+=("pr-${{ github.event.number }}") - COMMIT_TAGS+=("${SHA_SHORT}") - - # Append matching timestamp tags to keep a version history - for TAG in "${BUILD_TAGS[@]}"; do - BUILD_TAGS+=("${TAG}-${TIMESTAMP}") - done - - BUILD_TAGS+=("${TIMESTAMP}") - BUILD_TAGS+=("latest") - - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "Generated the following commit tags: " - for TAG in "${COMMIT_TAGS[@]}"; do - echo "${TAG}" - done - - alias_tags=("${COMMIT_TAGS[@]}") - else - alias_tags=("${BUILD_TAGS[@]}") - fi - - echo "Generated the following build tags: " - for TAG in "${BUILD_TAGS[@]}"; do - echo "${TAG}" - done - - echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT - - # Build metadata + # This generates a timestamp like what is defined on the ArtifactHub documentation + # E.G: 2022-02-08T15:38:15Z' + # https://artifacthub.io/docs/topics/repositories/container-images/ + # https://linux.die.net/man/1/date + echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT + + # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images + # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@v5 - id: meta + uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5 + id: metadata with: - images: | - ${{ env.MY_IMAGE_NAME }} - + # This generates all the tags for your image, you can add custom tags here too! + # By default, it should generate "latest" and "latest.(date here)". + tags: | + type=raw,value=latest + type=raw,value=latest.{{date 'YYYYMMDD'}} + type=raw,value={{date 'YYYYMMDD'}} + type=sha,enable=${{ github.event_name == 'pull_request' }} + type=ref,event=pr labels: | - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md - org.opencontainers.image.description=${{ env.MY_IMAGE_DESC }} - org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }} + io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md + org.opencontainers.image.created=${{ steps.date.outputs.date }} + org.opencontainers.image.description=${{ env.IMAGE_DESC }} + org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md + org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile + org.opencontainers.image.title=${{ env.IMAGE_NAME }} + org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }} + org.opencontainers.image.vendor=${{ github.repository_owner }} + org.opencontainers.image.version=latest + io.artifacthub.package.deprecated=false + io.artifacthub.package.keywords=bootc,ublue,universal-blue + io.artifacthub.package.license=Apache-2.0 + io.artifacthub.package.logo-url=${{ env.ARTIFACTHUB_LOGO_URL }} + io.artifacthub.package.prerelease=false + containers.bootc=1 + sep-tags: " " + sep-annotations: " " - # Build image using Buildah action - name: Build Image id: build_image uses: redhat-actions/buildah-build@v2 @@ -102,55 +88,45 @@ jobs: ./Containerfile # Postfix image name with -custom to make it a little more descriptive # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format - image: ${{ env.MY_IMAGE_NAME }} - tags: | - ${{ steps.generate-tags.outputs.alias_tags }} - labels: ${{ steps.meta.outputs.labels }} + image: ${{ env.IMAGE_NAME }} + tags: ${{ steps.metadata.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} oci: false - # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. - # https://github.com/macbre/push-to-ghcr/issues/12 - - name: Lowercase Registry - id: registry_case - uses: ASzc/change-string-case-action@v6 - with: - string: ${{ env.IMAGE_REGISTRY }} - + # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing + # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3 + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Push Image to GHCR - uses: redhat-actions/push-to-registry@v2 + - name: Push To GHCR + uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) id: push - env: - REGISTRY_USER: ${{ github.actor }} - REGISTRY_PASSWORD: ${{ github.token }} with: - image: ${{ steps.build_image.outputs.image }} - tags: ${{ steps.build_image.outputs.tags }} - registry: ${{ steps.registry_case.outputs.lowercase }} - username: ${{ env.REGISTRY_USER }} - password: ${{ env.REGISTRY_PASSWORD }} - extra-args: | - --compression-format=zstd + registry: ${{ env.IMAGE_REGISTRY }} + image: ${{ env.IMAGE_NAME }} + tags: ${{ steps.metadata.outputs.tags }} # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - - # Sign container - - uses: sigstore/cosign-installer@v3.7.0 - if: github.event_name != 'pull_request' + - name: Install Cosign + uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image - if: github.event_name != 'pull_request' + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} + IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${IMAGE_NAME}" + for tag in ${{ steps.metadata.outputs.tags }}; do + cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag + done env: TAGS: ${{ steps.push.outputs.digest }} COSIGN_EXPERIMENTAL: false -- cgit v1.2.3 From 57b12ce08ab9c447bdb80d750726b1434af406bb Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Wed, 8 Jan 2025 21:14:57 -0300 Subject: chore: add rechunk and maximize-build-storage examples on the build workflow (#52) I believe these should be enabled by default, since they make builds a lot slower, but it is nice having some docs about it --- .github/workflows/build.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e4c7ea1..c12fb00 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -37,6 +37,12 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + + # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: + # - name: Maximize build space + # uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7 + # with: + # remove-codeql: true - name: Get current date id: date @@ -93,6 +99,30 @@ jobs: labels: ${{ steps.metadata.outputs.labels }} oci: false + # Rechunk is a script that we use on Universal Blue to make sure there isnt a single huge layer when your image gets published. + # This does not make your image faster to download, just provides better resumability and fixes a few errors. + # Documentation for Rechunk is provided on their github repository at https://github.com/hhd-dev/rechunk + # You can enable it by uncommenting the following lines: + # - name: Run Rechunker + # id: rechunk + # uses: hhd-dev/rechunk@f153348d8100c1f504dec435460a0d7baf11a9d2 # v1.1.1 + # with: + # rechunk: 'ghcr.io/hhd-dev/rechunk:v1.0.1' + # ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" + # prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" + # skip_compression: true + # version: ${{ env.CENTOS_VERSION }} + # labels: ${{ steps.metadata.outputs.labels }} # Rechunk strips out all the labels during build, this needs to be reapplied here with newline separator + + # This is necessary so that the podman socket can find the rechunked image on its storage + # - name: Load in podman and tag + # run: | + # IMAGE=$(podman pull ${{ steps.rechunk.outputs.ref }}) + # sudo rm -rf ${{ steps.rechunk.outputs.output }} + # for tag in ${{ steps.metadata.outputs.tags }}; do + # podman tag $IMAGE ${{ env.IMAGE_NAME }}:$tag + # done + # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry -- cgit v1.2.3 From fdb05d7df8058a6db4cb1032be52242cc5a15f48 Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Wed, 8 Jan 2025 21:15:28 -0300 Subject: fix: use IMAGE_NAME and IMAGE_DESC for variables + fix typo in containerfile (#51) --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c12fb00..85eaf26 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,8 +14,8 @@ on: workflow_dispatch: env: - MY_IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names - MY_IMAGE_DESC: "My Customized Universal Blue Image" + IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names + IMAGE_DESC: "My Customized Universal Blue Image" IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/! -- cgit v1.2.3 From 91d82ba7ed11e9333135683088233b85c5825cb1 Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Wed, 8 Jan 2025 21:15:48 -0300 Subject: feat: (re)add registry login to push to GHCR (#53) --- .github/workflows/build.yml | 5 +++++ 1 file changed, 5 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 85eaf26..1fcf523 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -137,10 +137,15 @@ jobs: uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) id: push + env: + REGISTRY_USER: ${{ github.actor }} + REGISTRY_PASSWORD: ${{ github.token }} with: registry: ${{ env.IMAGE_REGISTRY }} image: ${{ env.IMAGE_NAME }} tags: ${{ steps.metadata.outputs.tags }} + username: ${{ env.REGISTRY_USER }} + password: ${{ env.REGISTRY_PASSWORD }} # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key -- cgit v1.2.3 From 49a464cd27047246c9b6858f9edb0bbb37e514c1 Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Sat, 11 Jan 2025 17:50:43 -0300 Subject: fix: registry-case action is still necessary (#56) --- .github/workflows/build.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1fcf523..0d2f144 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -133,6 +133,14 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. + # https://github.com/macbre/push-to-ghcr/issues/12 + - name: Lowercase Registry + id: registry_case + uses: ASzc/change-string-case-action@v6 + with: + string: ${{ env.IMAGE_REGISTRY }} + - name: Push To GHCR uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) @@ -141,7 +149,7 @@ jobs: REGISTRY_USER: ${{ github.actor }} REGISTRY_PASSWORD: ${{ github.token }} with: - registry: ${{ env.IMAGE_REGISTRY }} + registry: ${{ steps.registry_case.outputs.lowercase }} image: ${{ env.IMAGE_NAME }} tags: ${{ steps.metadata.outputs.tags }} username: ${{ env.REGISTRY_USER }} -- cgit v1.2.3 From 3afaa3ddc3b3e32a3247d97038f6703a6387848c Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Sat, 11 Jan 2025 18:00:36 -0300 Subject: fix: signing also needs to be lowercase :sob: (#57) --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0d2f144..51d396d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -166,7 +166,7 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${IMAGE_NAME}" + IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${IMAGE_NAME}" for tag in ${{ steps.metadata.outputs.tags }}; do cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag done -- cgit v1.2.3 From 270005cec27f141e2b4071077be13f6f557ac52f Mon Sep 17 00:00:00 2001 From: Cristian Torres <18661121+PrototypeActual@users.noreply.github.com> Date: Thu, 23 Jan 2025 22:46:11 -0500 Subject: Update build.yml (#61) Added lowering casing of image name should it be uppercased.Switched variables to grab lowercased image name. --- .github/workflows/build.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 51d396d..a8d7325 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -141,6 +141,12 @@ jobs: with: string: ${{ env.IMAGE_REGISTRY }} + - name: Lowercase Image + id: image_case + uses: ASzc/change-string-case-action@v6 + with: + string: ${{ env.IMAGE_NAME }} + - name: Push To GHCR uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) @@ -150,7 +156,7 @@ jobs: REGISTRY_PASSWORD: ${{ github.token }} with: registry: ${{ steps.registry_case.outputs.lowercase }} - image: ${{ env.IMAGE_NAME }} + image: ${{ steps.image_case.outputs.lowercase }} tags: ${{ steps.metadata.outputs.tags }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} @@ -166,7 +172,7 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${IMAGE_NAME}" + IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}" for tag in ${{ steps.metadata.outputs.tags }}; do cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag done -- cgit v1.2.3 From 0489a006f3d782e53e7531c9c8c8499e1e36cbcb Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 11 Feb 2025 00:16:26 -0500 Subject: chore(deps): update sigstore/cosign-installer action to v3.8.0 (#66) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a8d7325..eea69bc 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -166,7 +166,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 + uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From 409b244e27cae726b8603a4b3d006baf6f2459a2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 21 Feb 2025 09:03:51 -0500 Subject: chore(deps): update sigstore/cosign-installer action to v3.8.1 (#69) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index eea69bc..591560c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -166,7 +166,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0 + uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From ec6838e770600548e31473cf0f030abb726fc57c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 28 Feb 2025 16:56:23 -0500 Subject: chore(deps): update docker/metadata-action digest to 902fa8e (#70) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 591560c..2be4bdf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -56,7 +56,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5 + uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 5bdea6ca89365bf05459ffc249d73116871dbbb9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 15 Mar 2025 14:32:51 -0400 Subject: chore(deps): pin dependencies (#85) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2be4bdf..ac6e188 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -88,7 +88,7 @@ jobs: - name: Build Image id: build_image - uses: redhat-actions/buildah-build@v2 + uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 with: containerfiles: | ./Containerfile @@ -137,13 +137,13 @@ jobs: # https://github.com/macbre/push-to-ghcr/issues/12 - name: Lowercase Registry id: registry_case - uses: ASzc/change-string-case-action@v6 + uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 with: string: ${{ env.IMAGE_REGISTRY }} - name: Lowercase Image id: image_case - uses: ASzc/change-string-case-action@v6 + uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 with: string: ${{ env.IMAGE_NAME }} -- cgit v1.2.3 From 8f6f85b3686f81306d310f4fff5e244c20bf3181 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 15 Mar 2025 15:03:09 -0400 Subject: chore(deps): update docker/login-action digest to 74a5d14 (#80) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ac6e188..8457604 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -126,7 +126,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3 + uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From eddcdc6cf421fa663ecc5670f4fc9f5fb54499ae Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 24 Apr 2025 08:42:53 +0100 Subject: chore(deps): update sigstore/cosign-installer action to v3.8.2 (#98) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8457604..ad0d565 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -166,7 +166,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1 + uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From 3e88d8228dc12c32c316d8be1b638e17ccbdeeed Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Tue, 10 Jun 2025 02:15:44 +0200 Subject: chore: simplify (#111) --- .github/workflows/build.yml | 46 ++++++++++++++++++++------------------------- 1 file changed, 20 insertions(+), 26 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ad0d565..8e6e384 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ --- -name: Build Custom Image +name: Build container image on: pull_request: branches: @@ -14,10 +14,12 @@ on: workflow_dispatch: env: - IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names IMAGE_DESC: "My Customized Universal Blue Image" + IMAGE_KEYWORDS: "bootc,ublue,universal-blue" + IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # Put your own image here for a fancy profile on https://artifacthub.io/! + IMAGE_NAME: "${{ github.event.repository.name }}" # output image name, usually same as repo name IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit - ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/! + DEFAULT_TAG: "latest" concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} @@ -34,6 +36,12 @@ jobs: id-token: write steps: + - name: Prepare environment + run: | + # Lowercase the image uri + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -60,10 +68,10 @@ jobs: id: metadata with: # This generates all the tags for your image, you can add custom tags here too! - # By default, it should generate "latest" and "latest.(date here)". + # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date". tags: | - type=raw,value=latest - type=raw,value=latest.{{date 'YYYYMMDD'}} + type=raw,value=${{ env.DEFAULT_TAG }} + type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} type=raw,value={{date 'YYYYMMDD'}} type=sha,enable=${{ github.event_name == 'pull_request' }} type=ref,event=pr @@ -76,11 +84,11 @@ jobs: org.opencontainers.image.title=${{ env.IMAGE_NAME }} org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }} org.opencontainers.image.vendor=${{ github.repository_owner }} - org.opencontainers.image.version=latest + org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} io.artifacthub.package.deprecated=false - io.artifacthub.package.keywords=bootc,ublue,universal-blue + io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }} io.artifacthub.package.license=Apache-2.0 - io.artifacthub.package.logo-url=${{ env.ARTIFACTHUB_LOGO_URL }} + io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }} io.artifacthub.package.prerelease=false containers.bootc=1 sep-tags: " " @@ -133,20 +141,6 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. - # https://github.com/macbre/push-to-ghcr/issues/12 - - name: Lowercase Registry - id: registry_case - uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 - with: - string: ${{ env.IMAGE_REGISTRY }} - - - name: Lowercase Image - id: image_case - uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 - with: - string: ${{ env.IMAGE_NAME }} - - name: Push To GHCR uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) @@ -155,8 +149,8 @@ jobs: REGISTRY_USER: ${{ github.actor }} REGISTRY_PASSWORD: ${{ github.token }} with: - registry: ${{ steps.registry_case.outputs.lowercase }} - image: ${{ steps.image_case.outputs.lowercase }} + registry: ${{ env.IMAGE_REGISTRY }} + image: ${{ env.IMAGE_NAME }} tags: ${{ steps.metadata.outputs.tags }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} @@ -172,7 +166,7 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}" + IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" for tag in ${{ steps.metadata.outputs.tags }}; do cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag done -- cgit v1.2.3 From 101137c7b79b04bcb9d7d23d54d00cb8d4dc8d60 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 18 Jun 2025 13:54:32 +0300 Subject: chore(deps): update sigstore/cosign-installer action to v3.9.0 (#112) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8e6e384..db95edd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -160,7 +160,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 + uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From 523b7a05d5a6d9a28a515ea98e64536926f39948 Mon Sep 17 00:00:00 2001 From: Zeglius <33781398+Zeglius@users.noreply.github.com> Date: Tue, 24 Jun 2025 06:09:43 +0200 Subject: feat: Bind mount podman container storage to btrfs loopback (#115) --- .github/workflows/build.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index db95edd..17f3bcd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -51,7 +51,10 @@ jobs: # uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7 # with: # remove-codeql: true - + + - name: Mount BTRFS for podman storage + uses: ublue-os/container-storage-action@main + - name: Get current date id: date run: | -- cgit v1.2.3 From b78fa9686712dc75234ee4eea7d2e59fff34bc8b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 30 Jun 2025 11:53:32 +0300 Subject: chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1 (#118) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 17f3bcd..9a6b4b1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,7 +163,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0 + uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From cb2d192abeab7b762ad22a4703eb6016cfbc5de6 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 16:45:28 -0400 Subject: chore(deps): update sigstore/cosign-installer action to v3.9.2 (#119) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9a6b4b1..9776ec9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,7 +163,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 + uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From 32b7fd241722cf405e430b6cc962d22862f49730 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 1 Aug 2025 08:59:22 -0400 Subject: chore(deps): update docker/metadata-action digest to c1e5197 (#122) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9776ec9..02d560f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -67,7 +67,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5 + uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 2963d059eb1d8cca3ad8c6d0e3836c3330cc88ff Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 8 Aug 2025 08:43:00 -0400 Subject: chore(deps): update docker/login-action digest to 184bdaa (#124) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 02d560f..8c99d08 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -137,7 +137,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3 + uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From a55a2e58c5e212751fd8952273b3b36e143e3ef4 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 11 Aug 2025 14:25:02 +0100 Subject: chore(deps): update actions/checkout action to v5 (#130) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8c99d08..8470597 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: # - name: Maximize build space -- cgit v1.2.3 From ae071dc75017ada7a51496c3f989a03b9d394609 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 12 Sep 2025 18:55:45 -0400 Subject: chore(deps): update sigstore/cosign-installer action to v3.10.0 (#135) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8470597..f2d3691 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,7 +163,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2 + uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From bf2fe0f31addbad5520041b35f640e06bf1292cc Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 28 Sep 2025 14:23:33 +0200 Subject: feat(ci): add fallback condition for btrfs bind mount (#134) --- .github/workflows/build.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f2d3691..4d867be 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -53,7 +53,15 @@ jobs: # remove-codeql: true - name: Mount BTRFS for podman storage - uses: ublue-os/container-storage-action@main + id: container-storage-action + uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 + + # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space + # See: https://github.com/ublue-os/container-storage-action/pull/11 + continue-on-error: true + with: + target-dir: /var/lib/containers + mount-opts: compress-force=zstd:2 - name: Get current date id: date -- cgit v1.2.3 From 396fd4efda2effd0044cd8199f13b06b440b65ce Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 30 Sep 2025 07:04:09 +0300 Subject: chore(deps): update docker/login-action digest to 5e57cd1 (#138) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4d867be..ecd3ffa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -145,7 +145,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From dc912bc7eaa87d1ec9bb0bc690cc18a6ccddb63c Mon Sep 17 00:00:00 2001 From: Ondra Pelech Date: Tue, 28 Oct 2025 09:23:39 +0100 Subject: Container image labels point to specific commit (#153) --- .github/workflows/build.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ecd3ffa..b7d99af 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -87,13 +87,13 @@ jobs: type=sha,enable=${{ github.event_name == 'pull_request' }} type=ref,event=pr labels: | - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md + io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md org.opencontainers.image.created=${{ steps.date.outputs.date }} org.opencontainers.image.description=${{ env.IMAGE_DESC }} - org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md - org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile + org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md + org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile org.opencontainers.image.title=${{ env.IMAGE_NAME }} - org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }} + org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }} org.opencontainers.image.vendor=${{ github.repository_owner }} org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} io.artifacthub.package.deprecated=false -- cgit v1.2.3 From 1f42991aa3c70d92a6ae1947a74986caf9e098d1 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 4 Nov 2025 09:35:36 +0100 Subject: docs: clarify usage of space saving actions (#163) --- .github/workflows/build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b7d99af..61e75bb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,9 +46,10 @@ jobs: - name: Checkout uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: # - name: Maximize build space - # uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7 + # uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 # with: # remove-codeql: true -- cgit v1.2.3 From 268e63453deba72c6098ca406226cb70b327dc41 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 14 Nov 2025 10:48:45 +0200 Subject: chore(deps): bump docker/metadata-action from 5.8.0 to 5.9.0 (#167) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 61e75bb..944dbb5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -76,7 +76,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5 + uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 3d25bebc48b2c6418233d4cd27a505bf947c2f9a Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 19 Nov 2025 21:42:35 +0200 Subject: chore(deps): update actions/checkout digest to 93cb6ef (#168) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 944dbb5..66ca0b3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: -- cgit v1.2.3 From de726feb9a9221820f71834395b3065f73bbf8b5 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 21 Nov 2025 11:17:43 +0200 Subject: chore(deps): update actions/checkout action to v6 (#169) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 66ca0b3..041f96d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6 # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: -- cgit v1.2.3 From 5e40e0c14f51b891c747924493899ead4bb705b3 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 28 Nov 2025 08:22:30 +0200 Subject: chore(deps): update docker/metadata-action digest to c299e40 (#170) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 041f96d..6b93b96 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -76,7 +76,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 1b96722e1fd9e79af74f9584f931c5da9670c1d3 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 19:35:31 +0200 Subject: chore(deps): update actions/checkout digest to 8e8c483 (#171) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6b93b96..543a05d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: -- cgit v1.2.3 From 849ed7bc52a62124bc58515ad6afa99e8a5d33b0 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Wed, 17 Dec 2025 12:51:18 -0800 Subject: fix: Maximize build space by default and use legacy rechunker in-org --- .github/workflows/build.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 543a05d..00d23dd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -48,10 +48,10 @@ jobs: # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - # - name: Maximize build space - # uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - # with: - # remove-codeql: true + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 + with: + remove-codeql: true - name: Mount BTRFS for podman storage id: container-storage-action @@ -125,9 +125,9 @@ jobs: # You can enable it by uncommenting the following lines: # - name: Run Rechunker # id: rechunk - # uses: hhd-dev/rechunk@f153348d8100c1f504dec435460a0d7baf11a9d2 # v1.1.1 + # uses: ublue-os/legacy-rechunk@a925083d9af7cb04b3e2a6e8c01bfa495f38b710 # v1.0.0 # with: - # rechunk: 'ghcr.io/hhd-dev/rechunk:v1.0.1' + # rechunk: 'ghcr.io/ublue-os/legacy-rechunk:v1.0.0-x86_64' # ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" # prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" # skip_compression: true -- cgit v1.2.3 From e5b72dbbd2cd3ec00c26c735834df62d20143ee3 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 17 Dec 2025 12:53:43 -0800 Subject: chore(deps): update sigstore/cosign-installer action to v3.10.1 (#146) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 00d23dd..85769c2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -172,7 +172,7 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - name: Sign container image -- cgit v1.2.3 From cf8c622d95744509dbffccbfb11083fcd4e84c74 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Wed, 17 Dec 2025 12:55:52 -0800 Subject: fix: Update cosign-installer to v4.0.0 --- .github/workflows/build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 85769c2..5e18e01 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -172,8 +172,10 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1 + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + with: + cosign-release: 'v2.6.1' - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) -- cgit v1.2.3 From 72c4fa0f72f9ba8a7fd46b4ac619d35d9fe3a070 Mon Sep 17 00:00:00 2001 From: Kyle Gospodnetich Date: Wed, 17 Dec 2025 12:57:17 -0800 Subject: fix: Drop unneeded remove-codeql flag --- .github/workflows/build.yml | 2 -- 1 file changed, 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5e18e01..217689a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -50,8 +50,6 @@ jobs: # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - with: - remove-codeql: true - name: Mount BTRFS for podman storage id: container-storage-action -- cgit v1.2.3 From db28befef166ed5c065c4398165e429bf9be7391 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Jan 2026 08:14:58 +0200 Subject: chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#189) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 217689a..06b483f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: -- cgit v1.2.3 From c273c05c27aae30d4e63ac929697353b89d56ca8 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 1 Feb 2026 13:29:49 +0100 Subject: chore: remove btrfs-action (#192) --- .github/workflows/build.yml | 12 ------------ 1 file changed, 12 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 06b483f..1d2dd90 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,22 +46,10 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - - name: Mount BTRFS for podman storage - id: container-storage-action - uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 - - # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space - # See: https://github.com/ublue-os/container-storage-action/pull/11 - continue-on-error: true - with: - target-dir: /var/lib/containers - mount-opts: compress-force=zstd:2 - - name: Get current date id: date run: | -- cgit v1.2.3 From 61c16bbefe8d591e59d0f9075bbf325f30079773 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Feb 2026 06:49:29 +0200 Subject: chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#193) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1d2dd90..6cb85db 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -132,7 +132,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From 7f5bf0d292d9609187c8feca253602dd59693ed1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 23 Mar 2026 21:24:59 +0100 Subject: chore(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 (#202) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.0.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...030e881283bb7a6894de51c315a6bfe6a94e05cf) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6cb85db..1a08988 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -62,7 +62,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 04d003befdf7defe76fe4f79e26ddd9ce07ccedc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 24 Mar 2026 16:59:43 +0100 Subject: chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#203) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1a08988..16fbf15 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -132,7 +132,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From 7357a44510f052cfbf77fb65b447c6ccea52e2da Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 22:51:14 +0200 Subject: chore(deps): update docker/login-action action to v4.1.0 (#208) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 16fbf15..85d3532 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -132,7 +132,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From 483d45225f0614243a43caa4937a7a0dc4e02291 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 3 Apr 2026 09:13:07 +0200 Subject: chore(ci): remove remove-unwanted-software-action (#209) --- .github/workflows/build.yml | 4 ---- 1 file changed, 4 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 85d3532..fbaf527 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,10 +46,6 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - - name: Maximize build space - uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - - name: Get current date id: date run: | -- cgit v1.2.3 From 2a321c0fa74238cf98f3bd953aba96a66705dc4c Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 3 Apr 2026 21:17:21 +0200 Subject: Revert "chore(ci): remove remove-unwanted-software-action (#209)" (#210) This reverts commit 483d45225f0614243a43caa4937a7a0dc4e02291. This only got rarer but this is still needed sometimes :( --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index fbaf527..85d3532 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,6 +46,10 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 + - name: Get current date id: date run: | -- cgit v1.2.3 From 9db41a20a2b721b6760e883c5e9acc39e7face39 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 02:15:48 +0200 Subject: chore(deps): update sigstore/cosign-installer action to v4.1.0 (#204) * chore(deps): update sigstore/cosign-installer action to v4.1.0 * chore: bump cosign-release to v.2.6.3 --------- Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> Co-authored-by: renner <80410025+renner0e@users.noreply.github.com> --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 85d3532..d8469ad 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -158,10 +158,10 @@ jobs: # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 + uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: - cosign-release: 'v2.6.1' + cosign-release: 'v2.6.3' - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) -- cgit v1.2.3 From ebf38108c08fe17d146b309caeeac106bae990e4 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 23 May 2026 12:10:04 +0300 Subject: chore(deps): update docker/metadata-action action to v6.1.0 (#224) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d8469ad..d794606 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -62,7 +62,7 @@ jobs: # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 id: metadata with: # This generates all the tags for your image, you can add custom tags here too! -- cgit v1.2.3 From 241dce59e1ad900b8870a309f9458be57d76037a Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 06:41:45 +0300 Subject: chore(deps): update actions/checkout digest to df4cb1c (#226) --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d794606..c1fd45b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,7 +44,7 @@ jobs: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - name: Maximize build space -- cgit v1.2.3 From aa3ba96095417c41d02cf14b2c8d8778ceb6f502 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 06:42:07 +0300 Subject: chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#225) Signed-off-by: dependabot[bot] --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c1fd45b..85a8c97 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -132,7 +132,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From a65bb3da1f7c5ed04ac3d8b5f69878c5ecee14ea Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 17 Jun 2026 16:16:34 +0200 Subject: refactor: rewrite in just, saner defaults (#218) * refactor: rewrite in just, saner defaults I think it makes sense to do this as it is longterm easier to maintain, locally iterate and extend. Documents how to rebase to a local image, it pains me greatly when people iterate on github and wait forever for things to build and then to download the image for trivial things they could also quickly do locally. Rpm-ostree rechunker by default instead of opt-in legacy-rechunker, chunkah is also available if people want to use it already, if we deem it ready then we can enable it later on. They can all be opted-out of. Have a way to copy files to /{usr,etc} by default. We should sign the digest of the image instead of the tag. Co-Authored-by: a lot of sugar and bad music * docs: bump fedora-bootc version Co-authored-by: Jill Fiore * fix: formatting inconsistency Co-authored-by: Jill Fiore * docs: remove variable mentions from workflows These are now defined in the image-template.env file * fix: small nits in labels Co-authored-by: Adam Fidel --------- Co-authored-by: Jill Fiore Co-authored-by: Adam Fidel --- .github/workflows/build.yml | 193 ++++++++++++++++++++------------------------ 1 file changed, 89 insertions(+), 104 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 85a8c97..e355434 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,12 +14,7 @@ on: workflow_dispatch: env: - IMAGE_DESC: "My Customized Universal Blue Image" - IMAGE_KEYWORDS: "bootc,ublue,universal-blue" - IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # Put your own image here for a fancy profile on https://artifacthub.io/! - IMAGE_NAME: "${{ github.event.repository.name }}" # output image name, usually same as repo name IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit - DEFAULT_TAG: "latest" concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} @@ -36,98 +31,87 @@ jobs: id-token: write steps: - - name: Prepare environment - run: | - # Lowercase the image uri - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} - # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - - name: Get current date - id: date + - name: Install just + uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 + + - name: Check Just Syntax + shell: bash run: | - # This generates a timestamp like what is defined on the ArtifactHub documentation - # E.G: 2022-02-08T15:38:15Z' - # https://artifacthub.io/docs/topics/repositories/container-images/ - # https://linux.die.net/man/1/date - echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT - - # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images - # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - - name: Image Metadata - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 - id: metadata - with: - # This generates all the tags for your image, you can add custom tags here too! - # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date". - tags: | - type=raw,value=${{ env.DEFAULT_TAG }} - type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} - type=raw,value={{date 'YYYYMMDD'}} - type=sha,enable=${{ github.event_name == 'pull_request' }} - type=ref,event=pr - labels: | - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md - org.opencontainers.image.created=${{ steps.date.outputs.date }} - org.opencontainers.image.description=${{ env.IMAGE_DESC }} - org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md - org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile - org.opencontainers.image.title=${{ env.IMAGE_NAME }} - org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }} - org.opencontainers.image.vendor=${{ github.repository_owner }} - org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} - io.artifacthub.package.deprecated=false - io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }} - io.artifacthub.package.license=Apache-2.0 - io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }} - io.artifacthub.package.prerelease=false - containers.bootc=1 - sep-tags: " " - sep-annotations: " " + just check + + - name: Image Name + id: image-name + run: | + IMAGE_NAME=$(just image_name) + + echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV + + - name: Default Tag + id: gen-default-tag + run: | + DEFAULT_TAG=$(just generate-default-tag) + + echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV + + - name: Prepare environment + run: | + # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + # This actually builds the container image - name: Build Image - id: build_image - uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 - with: - containerfiles: | - ./Containerfile - # Postfix image name with -custom to make it a little more descriptive - # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format - image: ${{ env.IMAGE_NAME }} - tags: ${{ steps.metadata.outputs.tags }} - labels: ${{ steps.metadata.outputs.labels }} - oci: false - - # Rechunk is a script that we use on Universal Blue to make sure there isnt a single huge layer when your image gets published. - # This does not make your image faster to download, just provides better resumability and fixes a few errors. - # Documentation for Rechunk is provided on their github repository at https://github.com/hhd-dev/rechunk - # You can enable it by uncommenting the following lines: - # - name: Run Rechunker - # id: rechunk - # uses: ublue-os/legacy-rechunk@a925083d9af7cb04b3e2a6e8c01bfa495f38b710 # v1.0.0 - # with: - # rechunk: 'ghcr.io/ublue-os/legacy-rechunk:v1.0.0-x86_64' - # ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" - # prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" - # skip_compression: true - # version: ${{ env.CENTOS_VERSION }} - # labels: ${{ steps.metadata.outputs.labels }} # Rechunk strips out all the labels during build, this needs to be reapplied here with newline separator - - # This is necessary so that the podman socket can find the rechunked image on its storage - # - name: Load in podman and tag - # run: | - # IMAGE=$(podman pull ${{ steps.rechunk.outputs.ref }}) - # sudo rm -rf ${{ steps.rechunk.outputs.output }} - # for tag in ${{ steps.metadata.outputs.tags }}; do - # podman tag $IMAGE ${{ env.IMAGE_NAME }}:$tag - # done + id: build-image + run: | + sudo -E $(command -v just) build \ + ${IMAGE_NAME} \ + ${DEFAULT_TAG} + + # This is optional, this provides smaller delta updates + - name: Rechunk with rpm-ostree + id: rechunk + run: | + sudo -E $(command -v just) ostree-rechunk \ + ${IMAGE_NAME} \ + ${DEFAULT_TAG} + + # If you are feeling adventurous, use the new distro agnostic rechunker + # https://github.com/coreos/chunkah + # You can delete the Rechunk with rpm-ostree portion then if you use this + #- name: Rechunk with Chunkah + # id: rechunk + # run: | + # sudo -E $(command -v just) rechunk \ + # ${IMAGE_NAME} \ + # ${DEFAULT_TAG} + + - name: Generate Build Tags + id: gen-build-tags + run: | + alias_tags="$(just generate-build-tags \ + ${IMAGE_NAME} \ + ${DEFAULT_TAG})" + + echo "Tags for this Action..." + echo "${alias_tags}" + echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT + + - name: Tag Image + id: tag-images + env: + ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} + run: | + sudo -E $(command -v just) tag-images \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" \ + "${ALIAS_TAGS}" # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work @@ -140,37 +124,38 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - id: push + id: push-image env: - REGISTRY_USER: ${{ github.actor }} - REGISTRY_PASSWORD: ${{ github.token }} - with: - registry: ${{ env.IMAGE_REGISTRY }} - image: ${{ env.IMAGE_NAME }} - tags: ${{ steps.metadata.outputs.tags }} - username: ${{ env.REGISTRY_USER }} - password: ${{ env.REGISTRY_PASSWORD }} + ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} + run: | + set -euox pipefail + for tag in ${ALIAS_TAGS}; do + sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} + done + + digest=$(< /tmp/digestfile) + + echo "digest=${digest}" >> $GITHUB_OUTPUT # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key # using Cosign and save the private key as a repository secret in Github for this workflow # to consume. For more details, review the image signing section of the README. - name: Install Cosign - uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image + id: sign-image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - run: | - IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" - for tag in ${{ steps.metadata.outputs.tags }}; do - cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag - done env: - TAGS: ${{ steps.push.outputs.digest }} COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + DIGEST: ${{ steps.push-image.outputs.digest }} + run: | + cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} + -- cgit v1.2.3 From 9bbbf9370f9e5c00df5181adad7c8f7b30a4c6b4 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 21:40:59 +0200 Subject: chore(deps): update actions/checkout action to v7 (#228) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e355434..8278947 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,7 +33,7 @@ jobs: steps: # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 -- cgit v1.2.3 From 4a99dd73617e0cd5784929b5007a0aa5e92c7dd5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 07:24:46 +0200 Subject: chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#235) Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8278947..de2882d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -116,7 +116,7 @@ jobs: # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io -- cgit v1.2.3 From ed40e44b610cac878f17fa4233d8e3d19b8d67bb Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 9 Jul 2026 16:53:52 +0800 Subject: Configure AeroCore image mirrors Add build-time mirror configuration for Flatpak and Homebrew, expose the related build args, and install an AeroCore-owned profile script to load mirror environment files. Rename the mirror configuration files from the Bazzite-prefixed names to AeroCore-prefixed names while keeping the upstream Bazzite helper reference intact. Verification: bash -n system_files/etc/profile.d/aerocore-mirrors.sh && bash -n build_files/build.sh --- .github/workflows/build.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index de2882d..90371c8 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -69,6 +69,11 @@ jobs: # This actually builds the container image - name: Build Image id: build-image + env: + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} + HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} + HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} run: | sudo -E $(command -v just) build \ ${IMAGE_NAME} \ @@ -158,4 +163,3 @@ jobs: DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} - -- cgit v1.2.3 From 61a3dd784f1bb36b89644e158c4e9d75da736935 Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 9 Jul 2026 17:21:21 +0800 Subject: Push build images to ACR Add an ACR publish step after the existing GHCR publish and signing flow. The step is gated to non-PR default-branch runs and only executes when ACR_REGISTRY and ACR_NAMESPACE repository variables are set. Verification: ruby YAML parser loaded .github/workflows/build.yml successfully. --- .github/workflows/build.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 90371c8..b822ac6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,3 +163,23 @@ jobs: DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} + + - name: Push To ACR + if: | + github.event_name != 'pull_request' && + github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && + vars.ACR_REGISTRY != '' && + vars.ACR_NAMESPACE != '' + env: + ACR_REGISTRY: ${{ vars.ACR_REGISTRY }} + ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }} + ACR_USERNAME: ${{ secrets.ACR_USERNAME }} + ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }} + ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} + run: | + set -euo pipefail + echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin + + for tag in ${ALIAS_TAGS}; do + sudo -E podman push "${IMAGE_NAME}:${tag}" "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}" + done -- cgit v1.2.3 From 75f30511833eb72dfe24fb4e2946aab65571173c Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 9 Jul 2026 18:21:37 +0800 Subject: Promote ACR images manually Remove push-triggered builds and split ACR publishing out of the build workflow. Add a manual promote-acr workflow that copies an existing GHCR tag to ACR, supports explicit target tags, validates the required ACR configuration, and signs the promoted ACR digest. Verification: parsed both workflow YAML files and checked embedded run blocks with bash -n. --- .github/workflows/build.yml | 25 ------------------------- 1 file changed, 25 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b822ac6..56f8da9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -6,11 +6,6 @@ on: - main schedule: - cron: '05 10 * * *' # 10:05am UTC everyday - push: - branches: - - main - paths-ignore: - - '**/README.md' workflow_dispatch: env: @@ -163,23 +158,3 @@ jobs: DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} - - - name: Push To ACR - if: | - github.event_name != 'pull_request' && - github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && - vars.ACR_REGISTRY != '' && - vars.ACR_NAMESPACE != '' - env: - ACR_REGISTRY: ${{ vars.ACR_REGISTRY }} - ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }} - ACR_USERNAME: ${{ secrets.ACR_USERNAME }} - ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }} - ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} - run: | - set -euo pipefail - echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin - - for tag in ${ALIAS_TAGS}; do - sudo -E podman push "${IMAGE_NAME}:${tag}" "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}" - done -- cgit v1.2.3 From 78bc16acebffcffcb5e544139cb4c5169f652985 Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:17:46 +0800 Subject: Allow env override for image update ref Pass OSTREE_IMAGE_REF from GitHub repository variables into the image build so image-info.json can point systems at the configured update source. --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 56f8da9..1a7f7d4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -69,6 +69,7 @@ jobs: FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} + OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} run: | sudo -E $(command -v just) build \ ${IMAGE_NAME} \ -- cgit v1.2.3 From 81027c19c3f10e64d095e74b1e3387e8daf4e15f Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:26:39 +0800 Subject: Publish manual testing image tags Allow manually dispatched testing branch builds to publish and sign both the moving testing tag and a dated testing tag. --- .github/workflows/build.yml | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1a7f7d4..e542a89 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -51,7 +51,11 @@ jobs: - name: Default Tag id: gen-default-tag run: | - DEFAULT_TAG=$(just generate-default-tag) + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + DEFAULT_TAG="testing-$(date -u +%Y%m%d)" + else + DEFAULT_TAG=$(just generate-default-tag) + fi echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV @@ -96,9 +100,13 @@ jobs: - name: Generate Build Tags id: gen-build-tags run: | - alias_tags="$(just generate-build-tags \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG})" + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then + alias_tags="testing ${DEFAULT_TAG}" + else + alias_tags="$(just generate-build-tags \ + ${IMAGE_NAME} \ + ${DEFAULT_TAG})" + fi echo "Tags for this Action..." echo "${alias_tags}" @@ -114,18 +122,18 @@ jobs: "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" - # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing - # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work + # These `if` statements keep pull requests from publishing packages. + # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} @@ -145,14 +153,14 @@ jobs: # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} -- cgit v1.2.3 From 80dc6c0ccafc54d48b862b46261e12b53675b77f Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 00:55:21 +0800 Subject: Use BTRFS storage for image builds Mount /var/lib/containers on the larger runner disk before building so rpm-ostree rechunk has enough space for bootc images. --- .github/workflows/build.yml | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e542a89..0b1a54b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,12 +27,31 @@ jobs: steps: # These stage versions are pinned by https://github.com/renovatebot/renovate + - name: Show disk space + run: sudo df -h + + - name: Check if /mnt is there + id: check-mnt + run: | + if sudo mountpoint /mnt; then + echo "mnt_is_there=1" >> "$GITHUB_OUTPUT" + else + echo "mnt_is_there=0" >> "$GITHUB_OUTPUT" + fi + + - name: Free Disk Space + if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 + + - name: Mount BTRFS for podman storage + if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} + uses: ublue-os/container-storage-action@main + with: + target-dir: /var/lib/containers + - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - name: Maximize build space - uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 - - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 -- cgit v1.2.3 From be56c887f55c7a342657c5bd3ccf6cace00d4504 Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 01:05:10 +0800 Subject: Free disk space on standard runners --- .github/workflows/build.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0b1a54b..1edbe30 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -30,6 +30,11 @@ jobs: - name: Show disk space run: sudo df -h + - name: Maximize build space + uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 + with: + extra-squeeze: true + - name: Check if /mnt is there id: check-mnt run: | @@ -39,16 +44,15 @@ jobs: echo "mnt_is_there=0" >> "$GITHUB_OUTPUT" fi - - name: Free Disk Space - if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 - - name: Mount BTRFS for podman storage if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }} uses: ublue-os/container-storage-action@main with: target-dir: /var/lib/containers + - name: Show available build space + run: sudo df -h + - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 -- cgit v1.2.3 From 2fdcf15e7266c3eed21d81497180e0521464020c Mon Sep 17 00:00:00 2001 From: tranch Date: Mon, 13 Jul 2026 08:25:32 +0800 Subject: Pass Cosign password to signing step --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1edbe30..e72f937 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -187,6 +187,7 @@ jobs: env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} -- cgit v1.2.3 From 5a41b4c5daf60b45105d0dc552c4d46022c92b04 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 15 Jul 2026 14:04:06 +0800 Subject: Integrate Instruments release seed Download and verify the selected release during image builds. Bootstrap it once into the first graphical user's XDG directories. --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e72f937..49d2f81 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -97,6 +97,10 @@ jobs: HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} + INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }} + INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }} + INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} + INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | sudo -E $(command -v just) build \ ${IMAGE_NAME} \ -- cgit v1.2.3 From dd3cd9c9d8d8830bc1d05267c16c30de8758474d Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 22 Jul 2026 16:21:37 +0800 Subject: ci: fix workflow inputs and paths --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 49d2f81..3182eff 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} cancel-in-progress: true jobs: -- cgit v1.2.3 From 5198f735cf5a8c9e8390c2fa2156252c79be72ab Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 22 Jul 2026 16:40:16 +0800 Subject: ci: quote workflow shell variables --- .github/workflows/build.yml | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3182eff..a4661fb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -69,7 +69,7 @@ jobs: run: | IMAGE_NAME=$(just image_name) - echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV + echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV" - name: Default Tag id: gen-default-tag @@ -80,13 +80,13 @@ jobs: DEFAULT_TAG=$(just generate-default-tag) fi - echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV + echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV" - name: Prepare environment run: | # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV" + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV" # This actually builds the container image - name: Build Image @@ -102,17 +102,17 @@ jobs: INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E $(command -v just) build \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" build \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # This is optional, this provides smaller delta updates - name: Rechunk with rpm-ostree id: rechunk run: | - sudo -E $(command -v just) ostree-rechunk \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG} + sudo -E "$(command -v just)" ostree-rechunk \ + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}" # If you are feeling adventurous, use the new distro agnostic rechunker # https://github.com/coreos/chunkah @@ -131,20 +131,20 @@ jobs: alias_tags="testing ${DEFAULT_TAG}" else alias_tags="$(just generate-build-tags \ - ${IMAGE_NAME} \ - ${DEFAULT_TAG})" + "${IMAGE_NAME}" \ + "${DEFAULT_TAG}")" fi echo "Tags for this Action..." echo "${alias_tags}" - echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT + echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT" - name: Tag Image id: tag-images env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} run: | - sudo -E $(command -v just) tag-images \ + sudo -E "$(command -v just)" tag-images \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" @@ -167,12 +167,13 @@ jobs: run: | set -euox pipefail for tag in ${ALIAS_TAGS}; do - sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} + sudo -E podman push --digestfile=/tmp/digestfile \ + "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}" done digest=$(< /tmp/digestfile) - echo "digest=${digest}" >> $GITHUB_OUTPUT + echo "digest=${digest}" >> "$GITHUB_OUTPUT" # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key @@ -194,4 +195,4 @@ jobs: COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} DIGEST: ${{ steps.push-image.outputs.digest }} run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" -- cgit v1.2.3 From 50ba1fad553bc4a0c01f4e600e190a10c92fb944 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 22 Jul 2026 17:47:04 +0800 Subject: ci: order image and installer builds --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a4661fb..221c735 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,6 +1,9 @@ --- name: Build container image on: + push: + branches: + - main pull_request: branches: - main -- cgit v1.2.3 From 05c9b9bd017e8e20b70bd791e1f04cabd6664cd4 Mon Sep 17 00:00:00 2001 From: tranch Date: Sat, 25 Jul 2026 23:28:23 +0800 Subject: Add branch-aware versioned image tags Generate Fedora/date version tags and publish stable or testing aliases from the corresponding Git branch. --- .github/workflows/build.yml | 58 ++++++++++++++++++++++++++++----------------- 1 file changed, 36 insertions(+), 22 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 221c735..6a59b2a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,11 +4,13 @@ on: push: branches: - main + - testing pull_request: branches: - main - schedule: - - cron: '05 10 * * *' # 10:05am UTC everyday + - testing + #schedule: + # - cron: '05 10 * * *' # 10:05am UTC everyday workflow_dispatch: env: @@ -74,16 +76,36 @@ jobs: echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV" - - name: Default Tag - id: gen-default-tag + - name: Generate Version and Tags + id: gen-version + env: + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} run: | - if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then - DEFAULT_TAG="testing-$(date -u +%Y%m%d)" + set -euo pipefail + + sudo podman pull "${BASE_IMAGE}" + FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora) + VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)" + + if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + VERSION_TAG="testing-${VERSION_BASE}" + VERSION_PRETTY="Testing (F${VERSION_BASE})" + IMAGE_BRANCH="testing" + ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" else - DEFAULT_TAG=$(just generate-default-tag) + VERSION_TAG="${VERSION_BASE}" + VERSION_PRETTY="Stable (F${VERSION_BASE})" + IMAGE_BRANCH="stable" + ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}" fi - echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV" + { + echo "DEFAULT_TAG=${VERSION_TAG}" + echo "IMAGE_BRANCH=${IMAGE_BRANCH}" + echo "VERSION_TAG=${VERSION_TAG}" + echo "VERSION_PRETTY=${VERSION_PRETTY}" + echo "ALIAS_TAGS=${ALIAS_TAGS}" + } >> "$GITHUB_ENV" - name: Prepare environment run: | @@ -130,17 +152,9 @@ jobs: - name: Generate Build Tags id: gen-build-tags run: | - if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then - alias_tags="testing ${DEFAULT_TAG}" - else - alias_tags="$(just generate-build-tags \ - "${IMAGE_NAME}" \ - "${DEFAULT_TAG}")" - fi - echo "Tags for this Action..." - echo "${alias_tags}" - echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT" + echo "${ALIAS_TAGS}" + echo "alias_tags=${ALIAS_TAGS}" >> "$GITHUB_OUTPUT" - name: Tag Image id: tag-images @@ -156,14 +170,14 @@ jobs: # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} @@ -184,14 +198,14 @@ jobs: # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing')) + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} -- cgit v1.2.3 From 21c68e32f7a8d77876ba782016a8063c42167963 Mon Sep 17 00:00:00 2001 From: tranch Date: Sun, 26 Jul 2026 01:23:31 +0800 Subject: Make stable the default image channel Keep latest as a main-branch alias while using Fedora/date versions for image metadata and release tags. --- .github/workflows/build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6a59b2a..97bfd91 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -88,11 +88,13 @@ jobs: VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)" if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + DEFAULT_TAG="testing" VERSION_TAG="testing-${VERSION_BASE}" VERSION_PRETTY="Testing (F${VERSION_BASE})" IMAGE_BRANCH="testing" ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" else + DEFAULT_TAG="stable" VERSION_TAG="${VERSION_BASE}" VERSION_PRETTY="Stable (F${VERSION_BASE})" IMAGE_BRANCH="stable" @@ -100,7 +102,7 @@ jobs: fi { - echo "DEFAULT_TAG=${VERSION_TAG}" + echo "DEFAULT_TAG=${DEFAULT_TAG}" echo "IMAGE_BRANCH=${IMAGE_BRANCH}" echo "VERSION_TAG=${VERSION_TAG}" echo "VERSION_PRETTY=${VERSION_PRETTY}" -- cgit v1.2.3 From 02f76b85f9ebcb198184599a6b18f5c885280a43 Mon Sep 17 00:00:00 2001 From: tranch Date: Sun, 26 Jul 2026 01:32:34 +0800 Subject: Run lightweight checks for pull requests --- .github/workflows/build.yml | 4 ---- 1 file changed, 4 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 97bfd91..b9d12cf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,10 +5,6 @@ on: branches: - main - testing - pull_request: - branches: - - main - - testing #schedule: # - cron: '05 10 * * *' # 10:05am UTC everyday workflow_dispatch: -- cgit v1.2.3 From 2d40be3f0106c2768dcec28a3144a959a3592cd7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 17:58:37 +0000 Subject: chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 Bumps [docker/login-action](https://github.com/docker/login-action) from 4.4.0 to 4.5.1. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...abd2ef45e78c5afb21d64d4ca52ee8550d9572c7) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b9d12cf..3c8cc06 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -167,7 +167,7 @@ jobs: # These `if` statements keep pull requests from publishing packages. # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') with: registry: ghcr.io -- cgit v1.2.3 From 23fc544482f0fd97cb3fd1870c00fbc3b10636ea Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 19:54:24 +0000 Subject: chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.1 to 4.5.2. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7...371161bbe7024a29a25c5e19bfcbc0804fe9ad2c) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3c8cc06..832b9fa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -167,7 +167,7 @@ jobs: # These `if` statements keep pull requests from publishing packages. # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 + uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') with: registry: ghcr.io -- cgit v1.2.3 From f9c48dc987bc8b56bc32c24ce0e0f352db8dd421 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 6 Aug 2026 19:54:44 +0000 Subject: chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.2 to 4.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 832b9fa..0596fab 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -167,7 +167,7 @@ jobs: # These `if` statements keep pull requests from publishing packages. # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') with: registry: ghcr.io -- cgit v1.2.3 From a66fc38e29a79e92cb73fc26626a482fbfc4ec41 Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 20 Aug 2026 07:20:09 +0800 Subject: ci: create GitHub release after image build --- .github/workflows/build.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 832b9fa..6ff5963 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -8,6 +8,11 @@ on: #schedule: # - cron: '05 10 * * *' # 10:05am UTC everyday workflow_dispatch: + inputs: + handwritten: + description: "Small changelog about changes in this build" + required: false + type: string env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit @@ -20,6 +25,8 @@ jobs: build_push: name: Build and push image runs-on: ubuntu-24.04 + outputs: + release_tag: ${{ steps.gen-version.outputs.release_tag }} permissions: contents: read @@ -105,6 +112,8 @@ jobs: echo "ALIAS_TAGS=${ALIAS_TAGS}" } >> "$GITHUB_ENV" + echo "release_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT" + - name: Prepare environment run: | # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 @@ -211,3 +220,15 @@ jobs: DIGEST: ${{ steps.push-image.outputs.digest }} run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" + + generate_release: + name: Generate Release + needs: [build_push] + if: github.event_name != 'pull_request' + permissions: + contents: write + secrets: inherit + uses: ./.github/workflows/generate_release.yml + with: + release_tag: ${{ needs.build_push.outputs.release_tag }} + handwritten: ${{ inputs.handwritten }} -- cgit v1.2.3 From 94493f8e11f6c4549258e73d20fa6803ace750c8 Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 20 Aug 2026 07:23:32 +0800 Subject: ci: restrict release creation branches --- .github/workflows/build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6ff5963..b42fd60 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -224,7 +224,9 @@ jobs: generate_release: name: Generate Release needs: [build_push] - if: github.event_name != 'pull_request' + if: github.event_name != 'pull_request' && + (github.ref_name == github.event.repository.default_branch || + github.ref_name == 'testing') permissions: contents: write secrets: inherit -- cgit v1.2.3 From 10411b5e32b78f57b6ad995c434cfc4fc390d689 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 26 Aug 2026 10:59:21 +0800 Subject: fix(config): make local dotenv optional Load a private .env when present, but keep CI configuration in GitHub runtime variables and retain the tracked template as a guide. --- .github/workflows/build.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 78b6dc6..908a18f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -16,6 +16,18 @@ on: env: IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit + IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }} + REPO_ORGANIZATION: ${{ vars.REPO_ORGANIZATION || github.repository_owner }} + IMAGE_DESC: ${{ vars.IMAGE_DESC || 'AeroCore customized Bazzite Deck image' }} + IMAGE_KEYWORDS: ${{ vars.IMAGE_KEYWORDS || 'bootc,oci,linux,bazzite,steam-deck,aerocore' }} + IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }} + DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }} + BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} + HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} + HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} + OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }} concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }} -- cgit v1.2.3 From 8774e3cf7db1f8ad37e659017f6b363f54f9d79d Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 27 Aug 2026 04:37:18 +0800 Subject: fix: authenticate Booster release downloads Mount the CI token as a build secret for release asset requests. --- .github/workflows/build.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 908a18f..98f9c15 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -136,6 +136,7 @@ jobs: - name: Build Image id: build-image env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} @@ -146,7 +147,11 @@ jobs: INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E "$(command -v just)" build \ + GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token" + umask 077 + printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}" + trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT + sudo GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" -- cgit v1.2.3 From 31ee20282a23dfc1244c003a97a2656afffdd4a2 Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 27 Aug 2026 04:49:28 +0800 Subject: fix: preserve build environment under sudo Keep the CI variables available while passing the GitHub token file. --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 98f9c15..02a6055 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -151,7 +151,7 @@ jobs: umask 077 printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}" trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT - sudo GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \ + sudo -E GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" -- cgit v1.2.3 From 90c5e5ad9754825b7fbfb419f80a6816ec416e85 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 28 Aug 2026 12:16:30 +0800 Subject: fix: avoid corrupted system-release in ISO --- .github/workflows/build.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 02a6055..f27a1bb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,6 +163,26 @@ jobs: "${IMAGE_NAME}" \ "${DEFAULT_TAG}" + - name: Verify image metadata before publishing + run: | + sudo podman run --rm --entrypoint /usr/bin/bash \ + "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu ' + system_release=/etc/system-release + if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then + echo "NUL byte in ${system_release}" >&2 + exit 1 + fi + case "$(<"$system_release")" in + "AeroCore OS release $(rpm -E %fedora) ("*) ;; + *) + echo "Unexpected system-release: $(<"$system_release")" >&2 + exit 1 + ;; + esac + jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \ + /usr/share/ublue-os/image-info.json >/dev/null + ' + # If you are feeling adventurous, use the new distro agnostic rechunker # https://github.com/coreos/chunkah # You can delete the Rechunk with rpm-ostree portion then if you use this -- cgit v1.2.3 From 589ad97b642f779d036500a253d587f403c0678e Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 28 Aug 2026 17:44:13 +0800 Subject: fix: validate image Fedora version --- .github/workflows/build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f27a1bb..60104ea 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -168,12 +168,13 @@ jobs: sudo podman run --rm --entrypoint /usr/bin/bash \ "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu ' system_release=/etc/system-release + fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json) if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then echo "NUL byte in ${system_release}" >&2 exit 1 fi case "$(<"$system_release")" in - "AeroCore OS release $(rpm -E %fedora) ("*) ;; + "AeroCore OS release ${fedora_version} ("*) ;; *) echo "Unexpected system-release: $(<"$system_release")" >&2 exit 1 -- cgit v1.2.3 From 0143bb98938a94179e296b44bc7f6b72f3f4fda4 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 28 Aug 2026 19:53:13 +0800 Subject: fix: escape jq filter in metadata check --- .github/workflows/build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 60104ea..f2a2b07 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -168,7 +168,8 @@ jobs: sudo podman run --rm --entrypoint /usr/bin/bash \ "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu ' system_release=/etc/system-release - fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json) + fedora_version=$(jq -er '\''."fedora-version" | strings'\'' \ + /usr/share/ublue-os/image-info.json) if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then echo "NUL byte in ${system_release}" >&2 exit 1 -- cgit v1.2.3 From 7b97d7e6edca94508368bafd2f5f08ce3df4affb Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 28 Aug 2026 23:17:18 +0800 Subject: ci: skip image metadata verification --- .github/workflows/build.yml | 22 ---------------------- 1 file changed, 22 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f2a2b07..02a6055 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -163,28 +163,6 @@ jobs: "${IMAGE_NAME}" \ "${DEFAULT_TAG}" - - name: Verify image metadata before publishing - run: | - sudo podman run --rm --entrypoint /usr/bin/bash \ - "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu ' - system_release=/etc/system-release - fedora_version=$(jq -er '\''."fedora-version" | strings'\'' \ - /usr/share/ublue-os/image-info.json) - if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then - echo "NUL byte in ${system_release}" >&2 - exit 1 - fi - case "$(<"$system_release")" in - "AeroCore OS release ${fedora_version} ("*) ;; - *) - echo "Unexpected system-release: $(<"$system_release")" >&2 - exit 1 - ;; - esac - jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \ - /usr/share/ublue-os/image-info.json >/dev/null - ' - # If you are feeling adventurous, use the new distro agnostic rechunker # https://github.com/coreos/chunkah # You can delete the Rechunk with rpm-ostree portion then if you use this -- cgit v1.2.3 From 61db44fb679bb3d2606cca0dcadac309edff0475 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 9 Sep 2026 14:15:56 +0800 Subject: chore: add Bazzite 44 testing candidate flow --- .github/workflows/build.yml | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 02a6055..7a73347 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,7 @@ on: branches: - main - testing + - testing-candidate #schedule: # - cron: '05 10 * * *' # 10:05am UTC everyday workflow_dispatch: @@ -23,7 +24,7 @@ env: IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }} DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }} BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }} - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} @@ -94,7 +95,7 @@ jobs: - name: Generate Version and Tags id: gen-version env: - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} run: | set -euo pipefail @@ -102,7 +103,13 @@ jobs: FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora) VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)" - if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then + DEFAULT_TAG="testing-candidate" + VERSION_TAG="testing-candidate-${VERSION_BASE}" + VERSION_PRETTY="Testing candidate (F${VERSION_BASE})" + IMAGE_BRANCH="testing-candidate" + ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}" + elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then DEFAULT_TAG="testing" VERSION_TAG="testing-${VERSION_BASE}" VERSION_PRETTY="Testing (F${VERSION_BASE})" @@ -137,7 +144,7 @@ jobs: id: build-image env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} @@ -194,14 +201,14 @@ jobs: # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push To GHCR - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') id: push-image env: ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} @@ -222,14 +229,14 @@ jobs: # to consume. For more details, review the image signing section of the README. - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') # https://github.com/containers/container-libs/issues/388 with: cosign-release: 'v2.6.3' - name: Sign container image id: sign-image - if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing') + if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate') env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} @@ -243,7 +250,8 @@ jobs: needs: [build_push] if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || - github.ref_name == 'testing') + github.ref_name == 'testing' || + github.ref_name == 'testing-candidate') permissions: contents: write secrets: inherit -- cgit v1.2.3 From 740a8e2cfce7579ddc0068413490b6ad8ea3fcc7 Mon Sep 17 00:00:00 2001 From: tranch Date: Thu, 10 Sep 2026 22:24:31 +0800 Subject: Align image versions with Bazzite date tags Generate date-based image versions in CI and preserve VERSION_TAG through the Justfile build. --- .github/workflows/build.yml | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7a73347..d1b3246 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -101,25 +101,43 @@ jobs: sudo podman pull "${BASE_IMAGE}" FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora) - VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)" + VERSION_BASE="${FEDORA_VERSION}.$(date +%Y%m%d)" if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then DEFAULT_TAG="testing-candidate" VERSION_TAG="testing-candidate-${VERSION_BASE}" - VERSION_PRETTY="Testing candidate (F${VERSION_BASE})" + VERSION_PRETTY_PREFIX="Testing candidate" IMAGE_BRANCH="testing-candidate" - ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}" elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then DEFAULT_TAG="testing" VERSION_TAG="testing-${VERSION_BASE}" - VERSION_PRETTY="Testing (F${VERSION_BASE})" + VERSION_PRETTY_PREFIX="Testing" IMAGE_BRANCH="testing" - ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" else DEFAULT_TAG="stable" VERSION_TAG="${VERSION_BASE}" - VERSION_PRETTY="Stable (F${VERSION_BASE})" + VERSION_PRETTY_PREFIX="Stable" IMAGE_BRANCH="stable" + fi + + mapfile -t existing_tags < <(skopeo list-tags "docker://${IMAGE_REGISTRY,,}/${IMAGE_NAME,,}" 2>/dev/null | jq -r '.Tags[]' || true) + if printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}"; then + build=1 + while printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}.${build}"; do + ((build++)) + done + VERSION_TAG="${VERSION_TAG}.${build}" + fi + + VERSION_BASE_PRETTY="${VERSION_TAG#testing-candidate-}" + VERSION_BASE_PRETTY="${VERSION_BASE_PRETTY#testing-}" + VERSION_PRETTY="${VERSION_PRETTY_PREFIX} (F${VERSION_BASE_PRETTY})" + + if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then + ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}" + elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then + ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}" + else ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}" fi -- cgit v1.2.3 From d209ea6aa515d7e356cfb4ae32f612459e36dafe Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 11 Sep 2026 02:34:45 +0800 Subject: =?UTF-8?q?=E4=BB=A5=20Bazzite=20stable-44.20260908=20=E4=B8=BA=20?= =?UTF-8?q?testing=20=E9=AA=8C=E8=AF=81=E5=9F=BA=E7=BA=BF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d1b3246..e9a4a95 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ env: IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }} DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }} BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }} - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} @@ -95,7 +95,7 @@ jobs: - name: Generate Version and Tags id: gen-version env: - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} run: | set -euo pipefail @@ -162,7 +162,7 @@ jobs: id: build-image env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }} + BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }} -- cgit v1.2.3 From 621e87de23348a337d45643b3682b7b3cb00000c Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 11 Sep 2026 13:46:58 +0800 Subject: Generate release package changelogs Attach RPM SBOMs to published image digests and build release notes by comparing the current and previous SBOM artifacts. --- .github/workflows/build.yml | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) (limited to '.github/workflows/build.yml') diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e9a4a95..0b6b8df 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -215,6 +215,30 @@ jobs: "${DEFAULT_TAG}" \ "${ALIAS_TAGS}" + - name: Install Syft + id: setup-syft + if: github.event_name != 'pull_request' + uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + with: + syft-version: v1.44.0 + + - name: Generate RPM SBOM + id: generate-sbom + if: github.event_name != 'pull_request' + env: + SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }} + run: | + set -euo pipefail + sbom="${RUNNER_TEMP}/aerocore-sbom.json" + mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")" + trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT + sudo "${SYFT_CMD}" "dir:${mountpoint}" \ + --select-catalogers rpm \ + --source-name "${IMAGE_NAME}-${VERSION_TAG}" \ + -o "syft-json=${sbom}" + sudo chown "$(id -u):$(id -g)" "${sbom}" + echo "sbom=${sbom}" >> "$GITHUB_OUTPUT" + # These `if` statements keep pull requests from publishing packages. # They publish default-branch builds and manual testing branch builds. - name: Login to GitHub Container Registry @@ -241,6 +265,26 @@ jobs: echo "digest=${digest}" >> "$GITHUB_OUTPUT" + - name: Install ORAS + if: github.event_name != 'pull_request' + uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1 + + - name: Upload RPM SBOM + if: github.event_name != 'pull_request' + env: + DIGEST: ${{ steps.push-image.outputs.digest }} + GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SBOM: ${{ steps.generate-sbom.outputs.sbom }} + run: | + set -euo pipefail + echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin + cd "$(dirname "${SBOM}")" + oras attach \ + --artifact-type application/vnd.spdx+json \ + --annotation "filename=$(basename "${SBOM}")" \ + "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \ + "$(basename "${SBOM}")" + # This section is optional and only needs to be enabled if you plan on distributing # your project for others to consume. You will need to create a public and private key # using Cosign and save the private key as a repository secret in Github for this workflow @@ -272,6 +316,7 @@ jobs: github.ref_name == 'testing-candidate') permissions: contents: write + packages: read secrets: inherit uses: ./.github/workflows/generate_release.yml with: -- cgit v1.2.3