From 299c8e0e2f9054c07dfc2d26cadcc3164f7510cb Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Tue, 10 Jun 2025 02:15:44 +0200 Subject: chore: simplify (#111) --- .github/workflows/build-disk.yml | 115 +++++++++++++++++++++++++++++++++++++++ .github/workflows/build-iso.yml | 103 ----------------------------------- .github/workflows/build.yml | 46 +++++++--------- 3 files changed, 135 insertions(+), 129 deletions(-) create mode 100644 .github/workflows/build-disk.yml delete mode 100644 .github/workflows/build-iso.yml (limited to '.github/workflows') diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml new file mode 100644 index 0000000..e0d0cac --- /dev/null +++ b/.github/workflows/build-disk.yml @@ -0,0 +1,115 @@ +--- +name: Build disk images + +on: + workflow_dispatch: + inputs: + upload-to-s3: + description: "Upload to S3" + required: false + default: false + type: boolean + platform: + required: true + type: choice + options: + - amd64 + - arm64 + pull_request: + branches: + - main + paths: + - './disk_config/disk.toml' + - './disk_config/iso.toml' + - './.github/workflows/build-disk.yml' + +env: + IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync + IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit + DEFAULT_TAG: "latest" + BIB_IMAGE: "ghcr.io/lorbuschris/bootc-image-builder:20250608" # "quay.io/centos-bootc/bootc-image-builder:latest" - see https://github.com/osbuild/bootc-image-builder/pull/954 + +concurrency: + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} + cancel-in-progress: true + +jobs: + build: + name: Build disk images + runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} + strategy: + fail-fast: false + matrix: + disk-type: ["qcow2", "anaconda-iso"] + permissions: + contents: read + packages: read + id-token: write + + steps: + - name: Prepare environment + run: | + USER_UID=$(id -u) + USER_GID=$(id -g) + # Concatenate the types with a hyphen + DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-') + # Lowercase the image uri + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV} + echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV} + echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV} + + - name: Install dependencies + if: inputs.platform == 'arm64' + run: | + set -x + sudo apt update -y + sudo apt install -y \ + podman + + - name: Maximize build space + if: inputs.platform != 'arm64' + uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9 + with: + remove-codeql: true + + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + + - name: Build disk images + id: build + uses: osbuild/bootc-image-builder-action@main + with: + builder-image: ${{ env.BIB_IMAGE }} + config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }} + image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} + chown: ${{ env.USER_UID }}:${{ env.USER_GID }} + types: ${{ matrix.disk-type }} + additional-args: --use-librepo=True + + - name: Upload disk images and Checksum to Job Artifacts + if: inputs.upload-to-s3 != true && github.event_name != 'pull_request' + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + path: ${{ steps.build.outputs.output-directory }} + if-no-files-found: error + retention-days: 0 + compression-level: 0 + overwrite: true + + - name: Upload to S3 + if: inputs.upload-to-s3 == true && github.event_name != 'pull_request' + shell: bash + env: + RCLONE_CONFIG_S3_TYPE: s3 + RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }} + RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} + RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} + RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }} + RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }} + SOURCE_DIR: ${{ steps.build.outputs.output-directory }} + run: | + sudo apt-get update + sudo apt-get install -y rclone + rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }} \ No newline at end of file diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml deleted file mode 100644 index b8aa38e..0000000 --- a/.github/workflows/build-iso.yml +++ /dev/null @@ -1,103 +0,0 @@ ---- -name: Build ISOs - -on: - workflow_dispatch: - inputs: - upload-to-s3: - description: "Upload to S3" - required: false - default: false - type: boolean - platform: - required: true - type: choice - options: - - amd64 - - arm64 - pull_request: - branches: - - main - paths: - - './iso.toml' - - './.github/workflows/build-iso.yml' - - './Justfile' - -env: - IMAGE_REGISTRY: "ghcr.io/${{ github.repository }}" - DEFAULT_TAG: "latest" - -concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }} - cancel-in-progress: true - -jobs: - build: - name: Build ISOs - runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} - strategy: - fail-fast: false - permissions: - contents: read - packages: read - id-token: write - - steps: - - name: lower case the image registry in case of any capitalization - run: | - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - - - name: Install dependencies - if: inputs.platform == 'arm64' - run: | - set -x - sudo apt update -y - sudo apt install -y \ - podman - - - name: Maximize build space - if: inputs.platform != 'arm64' - uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9 - with: - remove-codeql: true - - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - - name: Setup Just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - - - name: Build ISO - id: build - uses: ublue-os/bootc-image-builder-action@main - with: - bootc-image-builder-image: ghcr.io/centos-workstation/bootc-image-builder:latest - use-librepo: true - config-file: ./iso.toml - image: ${{ env.IMAGE_REGISTRY }}:${{ env.DEFAULT_TAG }} - - - name: Upload ISOs and Checksum to Job Artifacts - if: inputs.upload-to-s3 != true && github.event_name != 'pull_request' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - path: ${{ steps.build.outputs.output-directory }} - if-no-files-found: error - retention-days: 0 - compression-level: 0 - overwrite: true - - - name: Upload to S3 - if: inputs.upload-to-s3 == true && github.event_name != 'pull_request' - shell: bash - env: - RCLONE_CONFIG_S3_TYPE: s3 - RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }} - RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} - RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }} - RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }} - SOURCE_DIR: ${{ steps.build.outputs.output-directory }} - run: | - sudo apt-get update - sudo apt-get install -y rclone - rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }} \ No newline at end of file diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ad0d565..8e6e384 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ --- -name: Build Custom Image +name: Build container image on: pull_request: branches: @@ -14,10 +14,12 @@ on: workflow_dispatch: env: - IMAGE_NAME: "${{ github.event.repository.name }}" # the name of the image produced by this build, matches repo names IMAGE_DESC: "My Customized Universal Blue Image" + IMAGE_KEYWORDS: "bootc,ublue,universal-blue" + IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # Put your own image here for a fancy profile on https://artifacthub.io/! + IMAGE_NAME: "${{ github.event.repository.name }}" # output image name, usually same as repo name IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit - ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/! + DEFAULT_TAG: "latest" concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} @@ -34,6 +36,12 @@ jobs: id-token: write steps: + - name: Prepare environment + run: | + # Lowercase the image uri + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + # These stage versions are pinned by https://github.com/renovatebot/renovate - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -60,10 +68,10 @@ jobs: id: metadata with: # This generates all the tags for your image, you can add custom tags here too! - # By default, it should generate "latest" and "latest.(date here)". + # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date". tags: | - type=raw,value=latest - type=raw,value=latest.{{date 'YYYYMMDD'}} + type=raw,value=${{ env.DEFAULT_TAG }} + type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} type=raw,value={{date 'YYYYMMDD'}} type=sha,enable=${{ github.event_name == 'pull_request' }} type=ref,event=pr @@ -76,11 +84,11 @@ jobs: org.opencontainers.image.title=${{ env.IMAGE_NAME }} org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }} org.opencontainers.image.vendor=${{ github.repository_owner }} - org.opencontainers.image.version=latest + org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} io.artifacthub.package.deprecated=false - io.artifacthub.package.keywords=bootc,ublue,universal-blue + io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }} io.artifacthub.package.license=Apache-2.0 - io.artifacthub.package.logo-url=${{ env.ARTIFACTHUB_LOGO_URL }} + io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }} io.artifacthub.package.prerelease=false containers.bootc=1 sep-tags: " " @@ -133,20 +141,6 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. - # https://github.com/macbre/push-to-ghcr/issues/12 - - name: Lowercase Registry - id: registry_case - uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 - with: - string: ${{ env.IMAGE_REGISTRY }} - - - name: Lowercase Image - id: image_case - uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6 - with: - string: ${{ env.IMAGE_NAME }} - - name: Push To GHCR uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) @@ -155,8 +149,8 @@ jobs: REGISTRY_USER: ${{ github.actor }} REGISTRY_PASSWORD: ${{ github.token }} with: - registry: ${{ steps.registry_case.outputs.lowercase }} - image: ${{ steps.image_case.outputs.lowercase }} + registry: ${{ env.IMAGE_REGISTRY }} + image: ${{ env.IMAGE_NAME }} tags: ${{ steps.metadata.outputs.tags }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} @@ -172,7 +166,7 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}" + IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" for tag in ${{ steps.metadata.outputs.tags }}; do cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag done -- cgit v1.2.3