From 42a6ff3286804854c1c21a7e62158f09e19a9b09 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sun, 12 Jul 2026 23:33:44 +0800
Subject: Add live installer build workflow

Add a Bazzite-style installer payload, CI workflow, and local\nPodman commands for building and testing the live ISO.\n\nFix stale disk image configuration references and installer targets.
---
 .github/workflows/build-disk.yml           |   7 +-
 .github/workflows/build-live-installer.yml | 116 +++++++++++++++++++++++++++++
 2 files changed, 120 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/build-live-installer.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 1de6c6e..02ef44a 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -20,7 +20,8 @@ on:
       - main
     paths:
       - './disk_config/disk.toml'
-      - './disk_config/iso.toml'
+      - './disk_config/iso-kde.toml'
+      - './disk_config/iso-gnome.toml'
       - './.github/workflows/build-disk.yml'
 
 env:
@@ -36,7 +37,7 @@ concurrency:
 jobs:
   build:
     name: Build disk images
-    runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ inputs.platform == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     strategy:
       fail-fast: false
       matrix:
@@ -82,7 +83,7 @@ jobs:
         uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
-          config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
+          config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso-kde.toml' || './disk_config/disk.toml' }}
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
           types: ${{ matrix.disk-type }}
diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
new file mode 100644
index 0000000..870699e
--- /dev/null
+++ b/.github/workflows/build-live-installer.yml
@@ -0,0 +1,116 @@
+name: Build live installer
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "AeroCore image tag to install"
+        required: false
+        default: latest
+        type: string
+  workflow_call:
+  push:
+    branches:
+      - main
+    paths:
+      - "installer/**"
+      - "just_scripts/build-live-installer.sh"
+      - ".github/workflows/build-live-installer.yml"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-live-installer:
+    name: Build KDE live installer
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      BASE_IMAGE: ghcr.io/ublue-os/bazzite:stable
+      FEDORA_VERSION: "44"
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Mount container storage BTRFS loopback
+        run: |
+          sudo truncate -s 70G /mnt/podman-storage.img
+          sudo mkfs.btrfs -f /mnt/podman-storage.img
+          sudo podman system reset --force
+          sudo systemctl stop podman.service
+          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
+          sudo systemctl start podman.service
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Prepare image references
+        run: |
+          image_name="$(just image_name)"
+          image_registry="${IMAGE_REGISTRY,,}"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        run: |
+          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
+            --username '${{ github.actor }}' --password-stdin
+
+      - name: Pull AeroCore install image
+        run: |
+          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+
+      - name: Build live installer payload
+        run: |
+          sudo podman build \
+            --cap-add sys_admin \
+            --security-opt label=disable \
+            --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            --tag localhost/aerocore-live-payload:latest \
+            --file installer/Containerfile \
+            .
+
+      - name: Build ISO
+        id: build
+        uses: Zeglius/titanoboa@revamp-pr
+        with:
+          arch: x86_64
+          image_name: aerocore-live-payload
+          image_repo: localhost
+          variant: Kinoite
+          version: ${{ env.FEDORA_VERSION }}
+          image_tag: latest
+          iso_name: aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
+          enable_cache_dnf: "false"
+          enable_cache_skopeo: "false"
+          enable_flatpak_dependencies: "false"
+          additional_templates: /github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl
+
+      - name: Display checksum
+        run: |
+          cat "${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM"
+
+      - name: Upload ISO artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: aerocore-os-live-installer-${{ env.IMAGE_TAG }}
+          path: |
+            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}
+            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM
+          if-no-files-found: error
+          compression-level: 0
-- 
cgit v1.2.3


From 78bc16acebffcffcb5e544139cb4c5169f652985 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:17:46 +0800
Subject: Allow env override for image update ref

Pass OSTREE_IMAGE_REF from GitHub repository variables into the image build so image-info.json can point systems at the configured update source.
---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56f8da9..1a7f7d4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -69,6 +69,7 @@ jobs:
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
+          OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
         run: |
           sudo -E $(command -v just) build \
             ${IMAGE_NAME} \
-- 
cgit v1.2.3


From 81027c19c3f10e64d095e74b1e3387e8daf4e15f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:26:39 +0800
Subject: Publish manual testing image tags

Allow manually dispatched testing branch builds to publish and sign both the moving testing tag and a dated testing tag.
---
 .github/workflows/build.yml | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a7f7d4..e542a89 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,7 +51,11 @@ jobs:
       - name: Default Tag
         id: gen-default-tag
         run: |
-          DEFAULT_TAG=$(just generate-default-tag)
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
+            DEFAULT_TAG="testing-$(date -u +%Y%m%d)"
+          else
+            DEFAULT_TAG=$(just generate-default-tag)
+          fi
 
           echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
 
@@ -96,9 +100,13 @@ jobs:
       - name: Generate Build Tags
         id: gen-build-tags
         run: |
-          alias_tags="$(just generate-build-tags \
-                        ${IMAGE_NAME} \
-                        ${DEFAULT_TAG})"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
+            alias_tags="testing ${DEFAULT_TAG}"
+          else
+            alias_tags="$(just generate-build-tags \
+                          ${IMAGE_NAME} \
+                          ${DEFAULT_TAG})"
+          fi
 
           echo "Tags for this Action..."
           echo "${alias_tags}"
@@ -114,18 +122,18 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
-      # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
-      # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
+      # These `if` statements keep pull requests from publishing packages.
+      # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -145,14 +153,14 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-- 
cgit v1.2.3


From 80dc6c0ccafc54d48b862b46261e12b53675b77f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:55:21 +0800
Subject: Use BTRFS storage for image builds

Mount /var/lib/containers on the larger runner disk before building so rpm-ostree rechunk has enough space for bootc images.
---
 .github/workflows/build.yml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e542a89..0b1a54b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,12 +27,31 @@ jobs:
 
     steps:
       # These stage versions are pinned by https://github.com/renovatebot/renovate
+      - name: Show disk space
+        run: sudo df -h
+
+      - name: Check if /mnt is there
+        id: check-mnt
+        run: |
+          if sudo mountpoint /mnt; then
+            echo "mnt_is_there=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "mnt_is_there=0" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Free Disk Space
+        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+
+      - name: Mount BTRFS for podman storage
+        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
+        uses: ublue-os/container-storage-action@main
+        with:
+          target-dir: /var/lib/containers
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-
       - name: Install just
         uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
 
-- 
cgit v1.2.3


From be56c887f55c7a342657c5bd3ccf6cace00d4504 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 01:05:10 +0800
Subject: Free disk space on standard runners

---
 .github/workflows/build.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0b1a54b..1edbe30 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,11 @@ jobs:
       - name: Show disk space
         run: sudo df -h
 
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
+        with:
+          extra-squeeze: true
+
       - name: Check if /mnt is there
         id: check-mnt
         run: |
@@ -39,16 +44,15 @@ jobs:
             echo "mnt_is_there=0" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Free Disk Space
-        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
-        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
-
       - name: Mount BTRFS for podman storage
         if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
         uses: ublue-os/container-storage-action@main
         with:
           target-dir: /var/lib/containers
 
+      - name: Show available build space
+        run: sudo df -h
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-- 
cgit v1.2.3


From 2fdcf15e7266c3eed21d81497180e0521464020c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 08:25:32 +0800
Subject: Pass Cosign password to signing step

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1edbe30..e72f937 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -187,6 +187,7 @@ jobs:
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
-- 
cgit v1.2.3


From 5a41b4c5daf60b45105d0dc552c4d46022c92b04 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 14:04:06 +0800
Subject: Integrate Instruments release seed

Download and verify the selected release during image builds.
Bootstrap it once into the first graphical user's XDG directories.
---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e72f937..49d2f81 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -97,6 +97,10 @@ jobs:
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
           OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
+          INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }}
+          INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }}
+          INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
+          INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
           sudo -E $(command -v just) build \
             ${IMAGE_NAME} \
-- 
cgit v1.2.3


From 6913c30a0e63b96c8af6b1de084ed103a73eaf2b Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 18:43:23 +0800
Subject: Fix ACR promotion environment vars

Bind the manual promotion job to the selected GitHub Environment so
environment-scoped ACR variables and secrets are available. Resolve the
image name from the dispatch override first, then IMAGE_NAME, then
image-template.env through just. Pass the Cosign password during
signing.
---
 .github/workflows/promote-acr.yml | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 99a67f8..890962f 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -4,6 +4,11 @@ name: Promote image to ACR
 on:
   workflow_dispatch:
     inputs:
+      environment:
+        description: "GitHub Environment containing ACR vars/secrets"
+        required: true
+        default: testing
+        type: environment
       source_tag:
         description: "Existing GHCR tag to promote"
         required: true
@@ -13,7 +18,7 @@ on:
         required: false
         type: string
       image_name:
-        description: "Image name override; defaults to image-template.env"
+        description: "Image name override; defaults to IMAGE_NAME var, then image-template.env"
         required: false
         type: string
 
@@ -21,13 +26,14 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
+  group: ${{ github.workflow }}-${{ inputs.environment }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
   cancel-in-progress: false
 
 jobs:
   promote_acr:
     name: Promote GHCR image to ACR
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.environment }}
 
     permissions:
       contents: read
@@ -48,18 +54,21 @@ jobs:
       - name: Prepare image variables
         env:
           IMAGE_NAME_INPUT: ${{ inputs.image_name }}
+          IMAGE_NAME_VAR: ${{ vars.IMAGE_NAME }}
           SOURCE_TAG: ${{ inputs.source_tag }}
           TARGET_TAGS_INPUT: ${{ inputs.target_tags }}
         run: |
           set -euo pipefail
 
-          image_name="${IMAGE_NAME_INPUT:-$(just image_name)}"
+          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-$(just image_name)}}"
           target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}"
 
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
-          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
-          echo "SOURCE_TAG=${SOURCE_TAG}" >> "$GITHUB_ENV"
-          echo "TARGET_TAGS=${target_tags}" >> "$GITHUB_ENV"
+          {
+            echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}"
+            echo "IMAGE_NAME=${image_name,,}"
+            echo "SOURCE_TAG=${SOURCE_TAG}"
+            echo "TARGET_TAGS=${target_tags}"
+          } >> "$GITHUB_ENV"
 
       - name: Validate ACR configuration
         env:
@@ -68,14 +77,16 @@ jobs:
           ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
           ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
         run: |
           set -euo pipefail
 
-          : "${ACR_REGISTRY:?Repository variable ACR_REGISTRY is required.}"
-          : "${ACR_NAMESPACE:?Repository variable ACR_NAMESPACE is required.}"
-          : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}"
-          : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}"
-          : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}"
+          : "${ACR_REGISTRY:?Repository or environment variable ACR_REGISTRY is required.}"
+          : "${ACR_NAMESPACE:?Repository or environment variable ACR_NAMESPACE is required.}"
+          : "${ACR_USERNAME:?Repository or environment secret ACR_USERNAME is required.}"
+          : "${ACR_PASSWORD:?Repository or environment secret ACR_PASSWORD is required.}"
+          : "${COSIGN_PRIVATE_KEY:?Repository or environment secret SIGNING_SECRET is required.}"
+          : "${COSIGN_PASSWORD:?Repository or environment secret COSIGN_PASSWORD is required.}"
 
       - name: Login to GitHub Container Registry
         env:
@@ -140,6 +151,7 @@ jobs:
           ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.promote.outputs.digest }}
         run: |
           set -euo pipefail
-- 
cgit v1.2.3


From e77483dcb6570a003001ea1c81a962c9f45fda74 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 18:50:32 +0800
Subject: Remove ACR environment input

Keep ACR promotion compatible with repositories that do not configure
GitHub Environments by using repository-level variables and secrets.
---
 .github/workflows/promote-acr.yml | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 890962f..6b00e3b 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -4,11 +4,6 @@ name: Promote image to ACR
 on:
   workflow_dispatch:
     inputs:
-      environment:
-        description: "GitHub Environment containing ACR vars/secrets"
-        required: true
-        default: testing
-        type: environment
       source_tag:
         description: "Existing GHCR tag to promote"
         required: true
@@ -26,14 +21,13 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.environment }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
+  group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
   cancel-in-progress: false
 
 jobs:
   promote_acr:
     name: Promote GHCR image to ACR
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.environment }}
 
     permissions:
       contents: read
@@ -81,12 +75,12 @@ jobs:
         run: |
           set -euo pipefail
 
-          : "${ACR_REGISTRY:?Repository or environment variable ACR_REGISTRY is required.}"
-          : "${ACR_NAMESPACE:?Repository or environment variable ACR_NAMESPACE is required.}"
-          : "${ACR_USERNAME:?Repository or environment secret ACR_USERNAME is required.}"
-          : "${ACR_PASSWORD:?Repository or environment secret ACR_PASSWORD is required.}"
-          : "${COSIGN_PRIVATE_KEY:?Repository or environment secret SIGNING_SECRET is required.}"
-          : "${COSIGN_PASSWORD:?Repository or environment secret COSIGN_PASSWORD is required.}"
+          : "${ACR_REGISTRY:?Repository variable ACR_REGISTRY is required.}"
+          : "${ACR_NAMESPACE:?Repository variable ACR_NAMESPACE is required.}"
+          : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}"
+          : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}"
+          : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}"
+          : "${COSIGN_PASSWORD:?Repository secret COSIGN_PASSWORD is required.}"
 
       - name: Login to GitHub Container Registry
         env:
-- 
cgit v1.2.3


From 04b8dcbbc3d5707f488c9b67ba96ce88ccd15181 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 17 Jul 2026 06:56:56 +0800
Subject: Fix live installer ISO build

Build the live installer from the requested local AeroCore image, use a
separate Fedora live base, pass the payload through rootful container
storage, and write reproducible checksum entries without host paths.
---
 .github/workflows/build-live-installer.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 870699e..b5fedb3 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -13,6 +13,7 @@ on:
     branches:
       - main
     paths:
+      - "Justfile"
       - "installer/**"
       - "just_scripts/build-live-installer.sh"
       - ".github/workflows/build-live-installer.yml"
@@ -34,7 +35,7 @@ jobs:
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
-      BASE_IMAGE: ghcr.io/ublue-os/bazzite:stable
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "44"
 
     steps:
@@ -76,11 +77,21 @@ jobs:
 
       - name: Build live installer payload
         run: |
+          mkdir -p output
+          sudo podman tag \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            localhost/aerocore-live-payload:latest
+          sudo podman save \
+            --format oci-archive \
+            --output output/install-payload.oci \
+            localhost/aerocore-live-payload:latest
+
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
-            --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-live-payload:latest \
             --file installer/Containerfile \
             .
-- 
cgit v1.2.3


From fc07365cdc27a2e78a57cdf673fa19a99d7cf57f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 08:40:43 +0800
Subject: Constrain builds to bazzite-deck

Keep the live installer Fedora version aligned with the deck base image and fail early if BASE_IMAGE is overridden to a non-deck variant.
---
 .github/workflows/build-live-installer.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index b5fedb3..98441df 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -35,8 +35,9 @@ jobs:
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "44"
+      FEDORA_VERSION: "43"
 
     steps:
       - name: Maximize build space
-- 
cgit v1.2.3


From 1f05e893325979375ab53c4bd6999af826bc62d8 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:08:54 +0800
Subject: ci: pin Titanoboa live installer action

---
 .github/workflows/build-live-installer.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 98441df..059c3e9 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -99,7 +99,7 @@ jobs:
 
       - name: Build ISO
         id: build
-        uses: Zeglius/titanoboa@revamp-pr
+        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
           arch: x86_64
           image_name: aerocore-live-payload
-- 
cgit v1.2.3


From dd3cd9c9d8d8830bc1d05267c16c30de8758474d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:21:37 +0800
Subject: ci: fix workflow inputs and paths

---
 .github/workflows/build-disk.yml | 7 +++----
 .github/workflows/build.yml      | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 02ef44a..869277d 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -19,10 +19,9 @@ on:
     branches:
       - main
     paths:
-      - './disk_config/disk.toml'
-      - './disk_config/iso-kde.toml'
-      - './disk_config/iso-gnome.toml'
-      - './.github/workflows/build-disk.yml'
+      - 'disk_config/disk.toml'
+      - 'disk_config/iso-kde.toml'
+      - '.github/workflows/build-disk.yml'
 
 env:
   IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 49d2f81..3182eff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-- 
cgit v1.2.3


From 2794877cbd7d5480a66da1592bc000c1eec8b620 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:31:49 +0800
Subject: ci: add live installer PR validation

---
 .github/workflows/validate-live-installer.yml | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/validate-live-installer.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/validate-live-installer.yml b/.github/workflows/validate-live-installer.yml
new file mode 100644
index 0000000..3d35a5d
--- /dev/null
+++ b/.github/workflows/validate-live-installer.yml
@@ -0,0 +1,40 @@
+name: Validate live installer
+
+on:
+  pull_request:
+    paths:
+      - "Justfile"
+      - "installer/**"
+      - "just_scripts/build-live-installer.sh"
+      - ".github/workflows/build-live-installer.yml"
+      - ".github/workflows/validate-live-installer.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-live-installer:
+    name: Validate live installer inputs
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Validate workflow YAML
+        run: |
+          ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
+
+      - name: Validate Justfile formatting
+        run: |
+          just --unstable --fmt --check -f Justfile
+
+      - name: Validate build scripts
+        run: |
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+            bash -n "$script"
+          done
+          bash -n system_files/usr/libexec/aerocore-instruments-setup
-- 
cgit v1.2.3


From 5198f735cf5a8c9e8390c2fa2156252c79be72ab Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:40:16 +0800
Subject: ci: quote workflow shell variables

---
 .github/workflows/build-disk.yml | 14 ++++++++------
 .github/workflows/build.yml      | 35 ++++++++++++++++++-----------------
 2 files changed, 26 insertions(+), 23 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 869277d..cef58be 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -54,11 +54,13 @@ jobs:
           # Concatenate the types with a hyphen
           DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-')
           # Lowercase the image uri
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
-          echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV}
-          echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV}
-          echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV}
+          {
+            echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}"
+            echo "IMAGE_NAME=${IMAGE_NAME,,}"
+            echo "DISK_TYPE=${DISK_TYPE}"
+            echo "USER_UID=${USER_UID}"
+            echo "USER_GID=${USER_GID}"
+          } >> "$GITHUB_ENV"
 
       - name: Install dependencies
         if: inputs.platform == 'arm64'
@@ -112,4 +114,4 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y rclone
-          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
+          rclone copy "$SOURCE_DIR" "S3:${{ secrets.S3_BUCKET_NAME }}"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3182eff..a4661fb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -69,7 +69,7 @@ jobs:
         run: |
           IMAGE_NAME=$(just image_name)
 
-          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
 
       - name: Default Tag
         id: gen-default-tag
@@ -80,13 +80,13 @@ jobs:
             DEFAULT_TAG=$(just generate-default-tag)
           fi
 
-          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
+          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV"
 
       - name: Prepare environment
         run: |
           # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
 
       # This actually builds the container image
       - name: Build Image
@@ -102,17 +102,17 @@ jobs:
           INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
           INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
-          sudo -E $(command -v just) build \
-            ${IMAGE_NAME} \
-            ${DEFAULT_TAG}
+          sudo -E "$(command -v just)" build \
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}"
 
       # This is optional, this provides smaller delta updates
       - name: Rechunk with rpm-ostree
         id: rechunk
         run: |
-          sudo -E $(command -v just) ostree-rechunk \
-            ${IMAGE_NAME} \
-            ${DEFAULT_TAG}
+          sudo -E "$(command -v just)" ostree-rechunk \
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}"
 
       # If you are feeling adventurous, use the new distro agnostic rechunker
       # https://github.com/coreos/chunkah
@@ -131,20 +131,20 @@ jobs:
             alias_tags="testing ${DEFAULT_TAG}"
           else
             alias_tags="$(just generate-build-tags \
-                          ${IMAGE_NAME} \
-                          ${DEFAULT_TAG})"
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}")"
           fi
 
           echo "Tags for this Action..."
           echo "${alias_tags}"
-          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
+          echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT"
 
       - name: Tag Image
         id: tag-images
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
         run: |
-          sudo -E $(command -v just) tag-images \
+          sudo -E "$(command -v just)" tag-images \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
@@ -167,12 +167,13 @@ jobs:
         run: |
           set -euox pipefail
           for tag in ${ALIAS_TAGS}; do
-            sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
+            sudo -E podman push --digestfile=/tmp/digestfile \
+              "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}"
           done
 
           digest=$(< /tmp/digestfile)
 
-          echo "digest=${digest}" >> $GITHUB_OUTPUT
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
@@ -194,4 +195,4 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}"
-- 
cgit v1.2.3