From 288294e0995a900ddf273fafa20cfc34d2736f6e Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 19:55:59 -0500
Subject: feat: add github actions build workflow

---
 .github/workflows/build.yml | 158 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)
 create mode 100644 .github/workflows/build.yml

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..381ec83
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,158 @@
+---
+name: build-ublue-custom
+on:
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '05 10 * * *'  # 10:05am UTC everyday
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**/README.md'
+  workflow_dispatch:
+
+# The env variables starting with "ARG_" are described in the Containerfile of this repo.
+# Look there for options and explanations for their usage.
+# The values here are defaults and should be modified if using a different image, needing
+# nvidia, a specific nvidia driver, or a different Fedora version.
+env:
+  ARG_IMAGE_NAME: "silverblue"
+  ARG_IMAGE_SUFFIX: "main"
+  ARG_FEDORA_MAJOR_VERSION: "38"
+  ARG_NVIDIA_MAJOR_VERSION: ""
+  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+
+jobs:
+  push-ghcr:
+    name: Build and push image
+    runs-on: ubuntu-22.04
+
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      # Checkout push-to-registry action GitHub repository
+      - name: Checkout Push to Registry action
+        uses: actions/checkout@v3
+
+      - name: Generate tags
+        id: generate-tags
+        shell: bash
+        run: |
+          # Generate a timestamp for creating an image version history
+          TIMESTAMP="$(date +%Y%m%d)"
+          VARIANT="${{ env.ARG_FEDORA_MAJOR_VERSION }}"
+
+          COMMIT_TAGS=()
+          BUILD_TAGS=()
+
+          # Have tags for tracking builds during pull request
+          SHA_SHORT="${GITHUB_SHA::7}"
+          COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}")
+          COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}")
+
+          COMMIT_TAGS+=("pr-${{ github.event.number }}")
+          COMMIT_TAGS+=("${SHA_SHORT}")
+
+          BUILD_TAGS=("${VARIANT}")
+
+          # Append matching timestamp tags to keep a version history
+          for TAG in "${BUILD_TAGS[@]}"; do
+              BUILD_TAGS+=("${TAG}-${TIMESTAMP}")
+          done
+
+          BUILD_TAGS+=("${TIMESTAMP}")
+          BUILD_TAGS+=("latest")
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+              echo "Generated the following commit tags: "
+              for TAG in "${COMMIT_TAGS[@]}"; do
+                  echo "${TAG}"
+              done
+
+              alias_tags=("${COMMIT_TAGS[@]}")
+          else
+              alias_tags=("${BUILD_TAGS[@]}")
+          fi
+
+          echo "Generated the following build tags: "
+          for TAG in "${BUILD_TAGS[@]}"; do
+              echo "${TAG}"
+          done
+
+          echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
+
+      - name: Get current version
+        id: labels
+        run: |
+          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}:${{ env.FEDORA_MAJOR_VERSION}}${{ env.NVIDIA_MAJOR_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
+          echo "VERSION=$ver" >> $GITHUB_OUTPUT
+
+      # Build metadata
+      - name: Image Metadata
+        uses: docker/metadata-action@v4
+        id: meta
+        with:
+          images: |
+            ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom
+
+          labels: |
+            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md
+            org.opencontainers.image.description=Customized ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} image.
+            org.opencontainers.image.title=${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}
+            org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
+
+      # Build image using Buildah action
+      - name: Build Image
+        id: build_image
+        uses: redhat-actions/buildah-build@v2
+        with:
+          containerfiles: |
+            ./Containerfile
+          # Postfix image name with -custom to make it a little more descriptive
+          # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
+          image: ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom
+          tags: |
+            ${{ steps.generate-tags.outputs.alias_tags }}
+          build-args: |
+            IMAGE_NAME=${{ env.ARG_IMAGE_NAME }}
+            IMAGE_SUFFIX=${{ env.ARG_IMAGE_SUFFIX }}
+            FEDORA_MAJOR_VERSION=${{ env.ARG_FEDORA_MAJOR_VERSION }}
+            NVIDIA_MAJOR_VERSION=${{ env.ARG_NVIDIA_MAJOR_VERSION }}
+          labels: ${{ steps.meta.outputs.labels }}
+          oci: false
+
+      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
+      # https://github.com/macbre/push-to-ghcr/issues/12
+      - name: Lowercase Registry
+        id: registry_case
+        uses: ASzc/change-string-case-action@v5
+        with:
+          string: ${{ env.IMAGE_REGISTRY }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Push the image to GHCR (Image Registry)
+      - name: Push To GHCR
+        uses: redhat-actions/push-to-registry@v2
+        id: push
+        env:
+          REGISTRY_USER: ${{ github.actor }}
+          REGISTRY_PASSWORD: ${{ github.token }}
+        with:
+          image: ${{ steps.build_image.outputs.image }}
+          tags: ${{ steps.build_image.outputs.tags }}
+          registry: ${{ steps.registry_case.outputs.lowercase }}
+          username: ${{ env.REGISTRY_USER }}
+          password: ${{ env.REGISTRY_PASSWORD }}
+          extra-args: |
+            --disable-content-trust
-- 
cgit v1.2.3


From 9135f2ddeb003cf96a2b711c89ffae657ac3cf5f Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 20:09:48 -0500
Subject: refactor: simplify some variable names

---
 .github/workflows/build.yml | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 381ec83..ced7a05 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,11 +18,12 @@ on:
 # The values here are defaults and should be modified if using a different image, needing
 # nvidia, a specific nvidia driver, or a different Fedora version.
 env:
-  ARG_IMAGE_NAME: "silverblue"
-  ARG_IMAGE_SUFFIX: "main"
-  ARG_FEDORA_MAJOR_VERSION: "38"
-  ARG_NVIDIA_MAJOR_VERSION: ""
-  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  ARG_SOURCE_IMAGE: "silverblue"
+  ARG_SOURCE_SUFFIX: "main"
+  ARG_FEDORA_VERSION: "38"
+  ARG_NVIDIA_VERSION: ""
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  MY_IMAGE_NAME: "customzed-ublue"
 
 jobs:
   push-ghcr:
@@ -45,7 +46,7 @@ jobs:
         run: |
           # Generate a timestamp for creating an image version history
           TIMESTAMP="$(date +%Y%m%d)"
-          VARIANT="${{ env.ARG_FEDORA_MAJOR_VERSION }}"
+          VARIANT="${{ env.ARG_FEDORA_VERSION }}"
 
           COMMIT_TAGS=()
           BUILD_TAGS=()
@@ -89,7 +90,7 @@ jobs:
       - name: Get current version
         id: labels
         run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}:${{ env.FEDORA_MAJOR_VERSION}}${{ env.NVIDIA_MAJOR_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
+          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
           echo "VERSION=$ver" >> $GITHUB_OUTPUT
 
       # Build metadata
@@ -98,12 +99,12 @@ jobs:
         id: meta
         with:
           images: |
-            ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom
+            ${{ env.MY_IMAGE_NAME }}
 
           labels: |
             io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md
-            org.opencontainers.image.description=Customized ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }} image.
-            org.opencontainers.image.title=${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}
+            org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image.
+            org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }}
             org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
 
       # Build image using Buildah action
@@ -115,14 +116,14 @@ jobs:
             ./Containerfile
           # Postfix image name with -custom to make it a little more descriptive
           # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
-          image: ${{ env.ARG_IMAGE_NAME }}-${{ env.ARG_IMAGE_SUFFIX }}-custom
+          image: ${{ env.MY_IMAGE_NAME }}
           tags: |
             ${{ steps.generate-tags.outputs.alias_tags }}
           build-args: |
-            IMAGE_NAME=${{ env.ARG_IMAGE_NAME }}
-            IMAGE_SUFFIX=${{ env.ARG_IMAGE_SUFFIX }}
-            FEDORA_MAJOR_VERSION=${{ env.ARG_FEDORA_MAJOR_VERSION }}
-            NVIDIA_MAJOR_VERSION=${{ env.ARG_NVIDIA_MAJOR_VERSION }}
+            SOURCE_IMAGE=${{ env.ARG_SOURCE_IMAGE }}
+            SOURCE_SUFFIX=${{ env.ARG_SOURCE_SUFFIX }}
+            FEDORA_VERSION=${{ env.ARG_FEDORA_VERSION }}
+            NVIDIA_VERSION=${{ env.ARG_NVIDIA_VERSION }}
           labels: ${{ steps.meta.outputs.labels }}
           oci: false
 
-- 
cgit v1.2.3


From b4acc15fcf20d8d3fdff85becc4170d3f9f7acfa Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 20:16:41 -0500
Subject: refactor: fixing typo and cleanup comments

---
 .github/workflows/build.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ced7a05..7811bf7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,16 +14,15 @@ on:
   workflow_dispatch:
 
 # The env variables starting with "ARG_" are described in the Containerfile of this repo.
-# Look there for options and explanations for their usage.
 # The values here are defaults and should be modified if using a different image, needing
 # nvidia, a specific nvidia driver, or a different Fedora version.
 env:
-  ARG_SOURCE_IMAGE: "silverblue"
-  ARG_SOURCE_SUFFIX: "main"
-  ARG_FEDORA_VERSION: "38"
-  ARG_NVIDIA_VERSION: ""
-  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
-  MY_IMAGE_NAME: "customzed-ublue"
+  MY_IMAGE_NAME: "custom-silverblue"  # the name of the image produced by this build
+  ARG_SOURCE_IMAGE: "silverblue"  # see Containerfile for list of possible upstream images
+  ARG_SOURCE_SUFFIX: "main"  # see Containerfile
+  ARG_FEDORA_VERSION: "38"  # see Containerfile
+  ARG_NVIDIA_VERSION: ""  # see Containerfile
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
 jobs:
   push-ghcr:
@@ -102,7 +101,7 @@ jobs:
             ${{ env.MY_IMAGE_NAME }}
 
           labels: |
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository_name }}/main/README.md
+            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository }}/main/README.md
             org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image.
             org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }}
             org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
-- 
cgit v1.2.3


From 86057f3f8fd309cc780886907d8f1268af787f13 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 20:26:38 -0500
Subject: chore(ci): fixing urls in build

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7811bf7..480ae9d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -89,7 +89,7 @@ jobs:
       - name: Get current version
         id: labels
         run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
+          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]')
           echo "VERSION=$ver" >> $GITHUB_OUTPUT
 
       # Build metadata
@@ -101,8 +101,8 @@ jobs:
             ${{ env.MY_IMAGE_NAME }}
 
           labels: |
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ github.repository }}/main/README.md
-            org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }} image.
+            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
+            org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}
             org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }}
             org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
 
-- 
cgit v1.2.3


From f1174061a3be3cf983ce7d018e72eb29bba908ea Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 20:30:49 -0500
Subject: chore(ci): fix version query

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 480ae9d..745b0c2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -89,7 +89,7 @@ jobs:
       - name: Get current version
         id: labels
         run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}}${{ env.NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]')
+          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
           echo "VERSION=$ver" >> $GITHUB_OUTPUT
 
       # Build metadata
-- 
cgit v1.2.3


From c15c1169de2a4ce82615101c53eb262237bd099e Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Sat, 26 Aug 2023 20:32:04 -0500
Subject: chore(ci): the ARG_ was missing from the env var in version lookup

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 745b0c2..fdd54f0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -89,7 +89,7 @@ jobs:
       - name: Get current version
         id: labels
         run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.FEDORA_VERSION}} | jq -r '.Labels["org.opencontainers.image.version"]')
+          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.ARG_FEDORA_VERSION }}${{ env.ARG_NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]')
           echo "VERSION=$ver" >> $GITHUB_OUTPUT
 
       # Build metadata
-- 
cgit v1.2.3


From 533cc8df68168466dcba65c667d09884f3817c98 Mon Sep 17 00:00:00 2001
From: Noel Miller <noelmiller@protonmail.com>
Date: Sun, 3 Mar 2024 11:39:58 -0600
Subject: feat: Updated build.yml to include container signing section

---
 .github/workflows/build.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fdd54f0..96547dc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,7 @@ env:
   MY_IMAGE_NAME: "custom-silverblue"  # the name of the image produced by this build
   ARG_SOURCE_IMAGE: "silverblue"  # see Containerfile for list of possible upstream images
   ARG_SOURCE_SUFFIX: "main"  # see Containerfile
-  ARG_FEDORA_VERSION: "38"  # see Containerfile
+  ARG_FEDORA_VERSION: "39"  # see Containerfile
   ARG_NVIDIA_VERSION: ""  # see Containerfile
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
@@ -156,3 +156,22 @@ jobs:
           password: ${{ env.REGISTRY_PASSWORD }}
           extra-args: |
             --disable-content-trust
+
+      # This section is optional and only needs to be enabled in you plan on distributing
+      # your project to others to consume. You will need to create a public and private key
+      # using Cosign and save the private key as a repository secret in Github for this workflow
+      # to consume. For more details, review the image signing section of the README.
+
+      # Sign container
+
+      #- uses: sigstore/cosign-installer@v3.4.0
+      #  if: github.event_name != 'pull_request'
+
+      #- name: Sign container image
+      #  if: github.event_name != 'pull_request'
+      #  run: |
+      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+      #  env:
+      #    TAGS: ${{ steps.push.outputs.digest }}
+      #    COSIGN_EXPERIMENTAL: false
+      #    COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-- 
cgit v1.2.3


From c3c55d367f9ad889c5ee89ea08d4f8f27c9cf920 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Fri, 12 Apr 2024 15:20:45 -0500
Subject: chore: simplify workflow even more

---
 .github/workflows/build.yml | 41 ++++++++---------------------------------
 1 file changed, 8 insertions(+), 33 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 96547dc..9154ca4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,21 +13,15 @@ on:
       - '**/README.md'
   workflow_dispatch:
 
-# The env variables starting with "ARG_" are described in the Containerfile of this repo.
-# The values here are defaults and should be modified if using a different image, needing
-# nvidia, a specific nvidia driver, or a different Fedora version.
 env:
-  MY_IMAGE_NAME: "custom-silverblue"  # the name of the image produced by this build
-  ARG_SOURCE_IMAGE: "silverblue"  # see Containerfile for list of possible upstream images
-  ARG_SOURCE_SUFFIX: "main"  # see Containerfile
-  ARG_FEDORA_VERSION: "39"  # see Containerfile
-  ARG_NVIDIA_VERSION: ""  # see Containerfile
+  MY_IMAGE_NAME: "ublue-custom"  # the name of the image produced by this build
+  MY_IMAGE_DESC: "My Customized Universal Blue System Image"
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
 jobs:
-  push-ghcr:
+  build_push:
     name: Build and push image
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
 
     permissions:
       contents: read
@@ -45,21 +39,14 @@ jobs:
         run: |
           # Generate a timestamp for creating an image version history
           TIMESTAMP="$(date +%Y%m%d)"
-          VARIANT="${{ env.ARG_FEDORA_VERSION }}"
-
           COMMIT_TAGS=()
           BUILD_TAGS=()
 
           # Have tags for tracking builds during pull request
           SHA_SHORT="${GITHUB_SHA::7}"
-          COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}")
-          COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}")
-
           COMMIT_TAGS+=("pr-${{ github.event.number }}")
           COMMIT_TAGS+=("${SHA_SHORT}")
 
-          BUILD_TAGS=("${VARIANT}")
-
           # Append matching timestamp tags to keep a version history
           for TAG in "${BUILD_TAGS[@]}"; do
               BUILD_TAGS+=("${TAG}-${TIMESTAMP}")
@@ -86,12 +73,6 @@ jobs:
 
           echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
 
-      - name: Get current version
-        id: labels
-        run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}:${{ env.ARG_FEDORA_VERSION }}${{ env.ARG_NVIDIA_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]')
-          echo "VERSION=$ver" >> $GITHUB_OUTPUT
-
       # Build metadata
       - name: Image Metadata
         uses: docker/metadata-action@v4
@@ -102,9 +83,8 @@ jobs:
 
           labels: |
             io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
-            org.opencontainers.image.description=Customized ${{ env.ARG_SOURCE_IMAGE }}-${{ env.ARG_SOURCE_SUFFIX }}
+            org.opencontainers.image.description=${{ env.MY_IMAGE_DESC }}
             org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }}
-            org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
 
       # Build image using Buildah action
       - name: Build Image
@@ -118,11 +98,6 @@ jobs:
           image: ${{ env.MY_IMAGE_NAME }}
           tags: |
             ${{ steps.generate-tags.outputs.alias_tags }}
-          build-args: |
-            SOURCE_IMAGE=${{ env.ARG_SOURCE_IMAGE }}
-            SOURCE_SUFFIX=${{ env.ARG_SOURCE_SUFFIX }}
-            FEDORA_VERSION=${{ env.ARG_FEDORA_VERSION }}
-            NVIDIA_VERSION=${{ env.ARG_NVIDIA_VERSION }}
           labels: ${{ steps.meta.outputs.labels }}
           oci: false
 
@@ -141,8 +116,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Push the image to GHCR (Image Registry)
-      - name: Push To GHCR
+      - name: Push Image to GHCR
         uses: redhat-actions/push-to-registry@v2
         id: push
         env:
@@ -170,7 +144,8 @@ jobs:
       #- name: Sign container image
       #  if: github.event_name != 'pull_request'
       #  run: |
-      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/$
+{{ steps.build_image.outputs.image }}@${TAGS}
       #  env:
       #    TAGS: ${{ steps.push.outputs.digest }}
       #    COSIGN_EXPERIMENTAL: false
-- 
cgit v1.2.3


From bcbb4d46263bf335f27b9a4a5ecc901e97aa6d96 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Fri, 12 Apr 2024 15:37:55 -0500
Subject: docs: add cosign and cleanup other info

---
 .github/workflows/build.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9154ca4..8840974 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -144,8 +144,7 @@ jobs:
       #- name: Sign container image
       #  if: github.event_name != 'pull_request'
       #  run: |
-      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/$
-{{ steps.build_image.outputs.image }}@${TAGS}
+      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
       #  env:
       #    TAGS: ${{ steps.push.outputs.digest }}
       #    COSIGN_EXPERIMENTAL: false
-- 
cgit v1.2.3


From 7e17e593a36f3b32760567cf9e35d3c73df76342 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Fri, 12 Apr 2024 17:02:33 -0500
Subject: chore(ci): expect signing by default

---
 .github/workflows/build.yml | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8840974..d5be3bc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -138,14 +138,12 @@ jobs:
 
       # Sign container
 
-      #- uses: sigstore/cosign-installer@v3.4.0
-      #  if: github.event_name != 'pull_request'
-
-      #- name: Sign container image
-      #  if: github.event_name != 'pull_request'
-      #  run: |
-      #    cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
-      #  env:
-      #    TAGS: ${{ steps.push.outputs.digest }}
-      #    COSIGN_EXPERIMENTAL: false
-      #    COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+      - name: Sign container image
+        uses: sigstore/cosign-installer@v3.4.0
+        if: github.event_name != 'pull_request'
+        run: |
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+        env:
+          TAGS: ${{ steps.push.outputs.digest }}
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-- 
cgit v1.2.3


From 24a1c643c8f298d0e5facd5e151e0e6b92e03ae5 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Mon, 22 Apr 2024 13:48:20 -0500
Subject: fix(ci): split cosign steps (#6)

A step can't have both "uses" and "run" so the cosign step needed to be split.
---
 .github/workflows/build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d5be3bc..d41d98d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -137,9 +137,10 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
 
       # Sign container
+      - uses: sigstore/cosign-installer@v3.4.0
+        if: github.event_name != 'pull_request'
 
       - name: Sign container image
-        uses: sigstore/cosign-installer@v3.4.0
         if: github.event_name != 'pull_request'
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
-- 
cgit v1.2.3


From 97069176d8f800786f038b9b161677e976925f3b Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Mon, 22 Apr 2024 23:05:49 -0500
Subject: refactor: use repo name as default image name (#7)

Also makes the source image's tag easier to understand in the
Containerfile.
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d41d98d..f7cc31b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,8 +14,8 @@ on:
   workflow_dispatch:
 
 env:
-  MY_IMAGE_NAME: "ublue-custom"  # the name of the image produced by this build
-  MY_IMAGE_DESC: "My Customized Universal Blue System Image"
+  MY_IMAGE_NAME: "${{ github.event.repository.name }}"  # the name of the image produced by this build, matches repo names
+  MY_IMAGE_DESC: "My Customized Universal Blue Image"
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
 jobs:
-- 
cgit v1.2.3


From 83cb8be06c80c2b5cffe675f8e2edddb97d480bc Mon Sep 17 00:00:00 2001
From: Marcin Jahn <10273406+marcinjahn@users.noreply.github.com>
Date: Tue, 23 Apr 2024 20:58:01 +0200
Subject: chore: update Node 16 actions to latest versions (#11)

Co-authored-by: Benjamin Sherman <benjamin@holyarmy.org>
Co-authored-by: Noel Miller <4983138+noelmiller@users.noreply.github.com>
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f7cc31b..5daee78 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       # Checkout push-to-registry action GitHub repository
       - name: Checkout Push to Registry action
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Generate tags
         id: generate-tags
@@ -75,7 +75,7 @@ jobs:
 
       # Build metadata
       - name: Image Metadata
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         id: meta
         with:
           images: |
-- 
cgit v1.2.3


From 76a968175aba5b36bc60e557c771ea1371c294e8 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Tue, 23 Apr 2024 16:50:38 -0500
Subject: chore: add dependabot (#14)

---
 .github/dependabot.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 .github/dependabot.yml

(limited to '.github')

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..92c44a8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
-- 
cgit v1.2.3


From 1b792e51606226d288cb53eda620f79df558533b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 23 Apr 2024 19:00:30 -0500
Subject: chore(deps): bump ASzc/change-string-case-action from 5 to 6 (#17)

Bumps [ASzc/change-string-case-action](https://github.com/aszc/change-string-case-action) from 5 to 6.
- [Release notes](https://github.com/aszc/change-string-case-action/releases)
- [Commits](https://github.com/aszc/change-string-case-action/compare/v5...v6)

---
updated-dependencies:
- dependency-name: ASzc/change-string-case-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5daee78..55e56a1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -105,7 +105,7 @@ jobs:
       # https://github.com/macbre/push-to-ghcr/issues/12
       - name: Lowercase Registry
         id: registry_case
-        uses: ASzc/change-string-case-action@v5
+        uses: ASzc/change-string-case-action@v6
         with:
           string: ${{ env.IMAGE_REGISTRY }}
 
-- 
cgit v1.2.3


From c38aa17113f30aa318df390d99bec16dc2e6ceca Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 23 Apr 2024 19:00:41 -0500
Subject: chore(deps): bump docker/login-action from 2 to 3 (#16)

Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 55e56a1..888926c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -110,7 +110,7 @@ jobs:
           string: ${{ env.IMAGE_REGISTRY }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-- 
cgit v1.2.3


From 92734d961fd6cb96ae69c283fdc947fe67fbac47 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 23 Apr 2024 19:02:52 -0500
Subject: chore(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (#15)

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 888926c..8ea733a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -137,7 +137,7 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
 
       # Sign container
-      - uses: sigstore/cosign-installer@v3.4.0
+      - uses: sigstore/cosign-installer@v3.5.0
         if: github.event_name != 'pull_request'
 
       - name: Sign container image
-- 
cgit v1.2.3


From 56254fb5918995238bc7d10464f4c6f496ac1e2e Mon Sep 17 00:00:00 2001
From: Kyle Gospodnetich <me@kylegospodneti.ch>
Date: Wed, 26 Jun 2024 19:28:49 -0700
Subject: feat: Maximize build space (#22)

Required to build Bazzite images
---
 .github/workflows/build.yml | 3 +++
 1 file changed, 3 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8ea733a..4f8e6d5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,6 +33,9 @@ jobs:
       - name: Checkout Push to Registry action
         uses: actions/checkout@v4
 
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@v7
+
       - name: Generate tags
         id: generate-tags
         shell: bash
-- 
cgit v1.2.3


From eef1bd332732f5ce732fa4e83b571e59418e7357 Mon Sep 17 00:00:00 2001
From: "Jorge O. Castro" <jorge.castro@gmail.com>
Date: Mon, 12 Aug 2024 17:29:11 -0400
Subject: chore(ci): explicitly use ubuntu 24.04 (#28)

Avoids the tar bug
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4f8e6d5..73acdd1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,7 +21,7 @@ env:
 jobs:
   build_push:
     name: Build and push image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     permissions:
       contents: read
-- 
cgit v1.2.3


From 20771a4d6bed98e77054e139e6747f21a98685b7 Mon Sep 17 00:00:00 2001
From: Robin Avery <robin@ribbanya.dev>
Date: Sun, 1 Sep 2024 07:12:39 -0400
Subject: style: fix wording in build.yml comment (#29)

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 73acdd1..3a979f3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -134,8 +134,8 @@ jobs:
           extra-args: |
             --disable-content-trust
 
-      # This section is optional and only needs to be enabled in you plan on distributing
-      # your project to others to consume. You will need to create a public and private key
+      # This section is optional and only needs to be enabled if you plan on distributing
+      # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
 
-- 
cgit v1.2.3


From 5267feaaea8fb23561c5e5ca640e4ca614a34b91 Mon Sep 17 00:00:00 2001
From: XLion <baby20030720@gmail.com>
Date: Wed, 27 Nov 2024 03:18:22 +0800
Subject: feat(ci): buildah: del `disable-content-trust`, enable zstd
 compression; bump sigstore/cosign-installer to 3.7.0 (#39)

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3a979f3..a61ef2d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
           extra-args: |
-            --disable-content-trust
+            --compression-format=zstd
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
@@ -140,7 +140,7 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
 
       # Sign container
-      - uses: sigstore/cosign-installer@v3.5.0
+      - uses: sigstore/cosign-installer@v3.7.0
         if: github.event_name != 'pull_request'
 
       - name: Sign container image
-- 
cgit v1.2.3


From 484c6aa0019d481f5673fb3289d24d3be9cd2658 Mon Sep 17 00:00:00 2001
From: "Jorge O. Castro" <jorge.castro@gmail.com>
Date: Mon, 2 Dec 2024 22:52:48 -0500
Subject: feat(ci): add concurrency (#38)

This makes it so that inprogress builds are cancelled when you make a new push. Matches the rest of ublue.
---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a61ef2d..b6d3598 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,6 +18,10 @@ env:
   MY_IMAGE_DESC: "My Customized Universal Blue Image"
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
+  cancel-in-progress: true
+
 jobs:
   build_push:
     name: Build and push image
-- 
cgit v1.2.3


From d251964f09d872d46313aefcdde1c2e4db0fe4fe Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Sun, 5 Jan 2025 12:33:03 -0300
Subject: feat: add artifacthub metadata by default and WIP README (#48)

---
 .github/renovate.json5      |   6 ++
 .github/workflows/build.yml | 152 +++++++++++++++++++-------------------------
 2 files changed, 70 insertions(+), 88 deletions(-)
 create mode 100644 .github/renovate.json5

(limited to '.github')

diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..5db72dd
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b6d3598..e4c7ea1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,5 @@
 ---
-name: build-ublue-custom
+name: Build Custom Image
 on:
   pull_request:
     branches:
@@ -17,6 +17,7 @@ env:
   MY_IMAGE_NAME: "${{ github.event.repository.name }}"  # the name of the image produced by this build, matches repo names
   MY_IMAGE_DESC: "My Customized Universal Blue Image"
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
+  ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"  # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/!
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@@ -33,67 +34,52 @@ jobs:
       id-token: write
 
     steps:
-      # Checkout push-to-registry action GitHub repository
-      - name: Checkout Push to Registry action
-        uses: actions/checkout@v4
-
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@v7
-
-      - name: Generate tags
-        id: generate-tags
-        shell: bash
+      # These stage versions are pinned by https://github.com/renovatebot/renovate
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      
+      - name: Get current date
+        id: date
         run: |
-          # Generate a timestamp for creating an image version history
-          TIMESTAMP="$(date +%Y%m%d)"
-          COMMIT_TAGS=()
-          BUILD_TAGS=()
-
-          # Have tags for tracking builds during pull request
-          SHA_SHORT="${GITHUB_SHA::7}"
-          COMMIT_TAGS+=("pr-${{ github.event.number }}")
-          COMMIT_TAGS+=("${SHA_SHORT}")
-
-          # Append matching timestamp tags to keep a version history
-          for TAG in "${BUILD_TAGS[@]}"; do
-              BUILD_TAGS+=("${TAG}-${TIMESTAMP}")
-          done
-
-          BUILD_TAGS+=("${TIMESTAMP}")
-          BUILD_TAGS+=("latest")
-
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-              echo "Generated the following commit tags: "
-              for TAG in "${COMMIT_TAGS[@]}"; do
-                  echo "${TAG}"
-              done
-
-              alias_tags=("${COMMIT_TAGS[@]}")
-          else
-              alias_tags=("${BUILD_TAGS[@]}")
-          fi
-
-          echo "Generated the following build tags: "
-          for TAG in "${BUILD_TAGS[@]}"; do
-              echo "${TAG}"
-          done
-
-          echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
-
-      # Build metadata
+          # This generates a timestamp like what is defined on the ArtifactHub documentation
+          # E.G: 2022-02-08T15:38:15Z'
+          # https://artifacthub.io/docs/topics/repositories/container-images/
+          # https://linux.die.net/man/1/date
+          echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
+
+      # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
+      # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@v5
-        id: meta
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
+        id: metadata
         with:
-          images: |
-            ${{ env.MY_IMAGE_NAME }}
-
+          # This generates all the tags for your image, you can add custom tags here too!
+          # By default, it should generate "latest" and "latest.(date here)".
+          tags: |
+            type=raw,value=latest
+            type=raw,value=latest.{{date 'YYYYMMDD'}}
+            type=raw,value={{date 'YYYYMMDD'}}
+            type=sha,enable=${{ github.event_name == 'pull_request' }}
+            type=ref,event=pr
           labels: |
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
-            org.opencontainers.image.description=${{ env.MY_IMAGE_DESC }}
-            org.opencontainers.image.title=${{ env.MY_IMAGE_NAME }}
+            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
+            org.opencontainers.image.created=${{ steps.date.outputs.date }}
+            org.opencontainers.image.description=${{ env.IMAGE_DESC }}
+            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
+            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
+            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
+            org.opencontainers.image.vendor=${{ github.repository_owner }}
+            org.opencontainers.image.version=latest
+            io.artifacthub.package.deprecated=false
+            io.artifacthub.package.keywords=bootc,ublue,universal-blue
+            io.artifacthub.package.license=Apache-2.0
+            io.artifacthub.package.logo-url=${{ env.ARTIFACTHUB_LOGO_URL }}
+            io.artifacthub.package.prerelease=false
+            containers.bootc=1
+          sep-tags: " "
+          sep-annotations: " "
 
-      # Build image using Buildah action
       - name: Build Image
         id: build_image
         uses: redhat-actions/buildah-build@v2
@@ -102,55 +88,45 @@ jobs:
             ./Containerfile
           # Postfix image name with -custom to make it a little more descriptive
           # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
-          image: ${{ env.MY_IMAGE_NAME }}
-          tags: |
-            ${{ steps.generate-tags.outputs.alias_tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          image: ${{ env.IMAGE_NAME }}
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
           oci: false
 
-      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
-      # https://github.com/macbre/push-to-ghcr/issues/12
-      - name: Lowercase Registry
-        id: registry_case
-        uses: ASzc/change-string-case-action@v6
-        with:
-          string: ${{ env.IMAGE_REGISTRY }}
-
+      # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
+      # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push Image to GHCR
-        uses: redhat-actions/push-to-registry@v2
+      - name: Push To GHCR
+        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         id: push
-        env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ github.token }}
         with:
-          image: ${{ steps.build_image.outputs.image }}
-          tags: ${{ steps.build_image.outputs.tags }}
-          registry: ${{ steps.registry_case.outputs.lowercase }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --compression-format=zstd
+          registry: ${{ env.IMAGE_REGISTRY }}
+          image: ${{ env.IMAGE_NAME }}
+          tags: ${{ steps.metadata.outputs.tags }}
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
-
-      # Sign container
-      - uses: sigstore/cosign-installer@v3.7.0
-        if: github.event_name != 'pull_request'
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+          IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${IMAGE_NAME}"
+          for tag in ${{ steps.metadata.outputs.tags }}; do
+            cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
+          done
         env:
           TAGS: ${{ steps.push.outputs.digest }}
           COSIGN_EXPERIMENTAL: false
-- 
cgit v1.2.3


From 57b12ce08ab9c447bdb80d750726b1434af406bb Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Wed, 8 Jan 2025 21:14:57 -0300
Subject: chore: add rechunk and maximize-build-storage examples on the build
 workflow (#52)

I believe these should be enabled by default, since they make builds a lot slower, but it is nice having some docs about it
---
 .github/workflows/build.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e4c7ea1..c12fb00 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -37,6 +37,12 @@ jobs:
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
+      # - name: Maximize build space
+      #   uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
+      #   with:
+      #     remove-codeql: true
       
       - name: Get current date
         id: date
@@ -93,6 +99,30 @@ jobs:
           labels: ${{ steps.metadata.outputs.labels }}
           oci: false
 
+      # Rechunk is a script that we use on Universal Blue to make sure there isnt a single huge layer when your image gets published.
+      # This does not make your image faster to download, just provides better resumability and fixes a few errors.
+      # Documentation for Rechunk is provided on their github repository at https://github.com/hhd-dev/rechunk
+      # You can enable it by uncommenting the following lines:
+      # - name: Run Rechunker
+      #   id: rechunk
+      #   uses: hhd-dev/rechunk@f153348d8100c1f504dec435460a0d7baf11a9d2 # v1.1.1
+      #   with:
+      #     rechunk: 'ghcr.io/hhd-dev/rechunk:v1.0.1'
+      #     ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
+      #     prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
+      #     skip_compression: true
+      #     version: ${{ env.CENTOS_VERSION }}
+      #     labels: ${{ steps.metadata.outputs.labels }} # Rechunk strips out all the labels during build, this needs to be reapplied here with newline separator
+
+      # This is necessary so that the podman socket can find the rechunked image on its storage
+      # - name: Load in podman and tag
+      #   run: |
+      #     IMAGE=$(podman pull ${{ steps.rechunk.outputs.ref }})
+      #     sudo rm -rf ${{ steps.rechunk.outputs.output }}
+      #     for tag in ${{ steps.metadata.outputs.tags }}; do
+      #       podman tag $IMAGE ${{ env.IMAGE_NAME }}:$tag
+      #     done
+
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-- 
cgit v1.2.3


From fdb05d7df8058a6db4cb1032be52242cc5a15f48 Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Wed, 8 Jan 2025 21:15:28 -0300
Subject: fix: use IMAGE_NAME and IMAGE_DESC for variables + fix typo in
 containerfile (#51)

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c12fb00..85eaf26 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,8 +14,8 @@ on:
   workflow_dispatch:
 
 env:
-  MY_IMAGE_NAME: "${{ github.event.repository.name }}"  # the name of the image produced by this build, matches repo names
-  MY_IMAGE_DESC: "My Customized Universal Blue Image"
+  IMAGE_NAME: "${{ github.event.repository.name }}"  # the name of the image produced by this build, matches repo names
+  IMAGE_DESC: "My Customized Universal Blue Image"
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
   ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"  # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/!
 
-- 
cgit v1.2.3


From 91d82ba7ed11e9333135683088233b85c5825cb1 Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Wed, 8 Jan 2025 21:15:48 -0300
Subject: feat: (re)add registry login to push to GHCR (#53)

---
 .github/workflows/build.yml | 5 +++++
 1 file changed, 5 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85eaf26..1fcf523 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -137,10 +137,15 @@ jobs:
         uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         id: push
+        env:
+          REGISTRY_USER: ${{ github.actor }}
+          REGISTRY_PASSWORD: ${{ github.token }}
         with:
           registry: ${{ env.IMAGE_REGISTRY }}
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}
+          username: ${{ env.REGISTRY_USER }}
+          password: ${{ env.REGISTRY_PASSWORD }}
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
-- 
cgit v1.2.3


From 49a464cd27047246c9b6858f9edb0bbb37e514c1 Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Sat, 11 Jan 2025 17:50:43 -0300
Subject: fix: registry-case action is still necessary (#56)

---
 .github/workflows/build.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1fcf523..0d2f144 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -133,6 +133,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
+      # https://github.com/macbre/push-to-ghcr/issues/12
+      - name: Lowercase Registry
+        id: registry_case
+        uses: ASzc/change-string-case-action@v6
+        with:
+          string: ${{ env.IMAGE_REGISTRY }}
+
       - name: Push To GHCR
         uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
@@ -141,7 +149,7 @@ jobs:
           REGISTRY_USER: ${{ github.actor }}
           REGISTRY_PASSWORD: ${{ github.token }}
         with:
-          registry: ${{ env.IMAGE_REGISTRY }}
+          registry: ${{ steps.registry_case.outputs.lowercase }}
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}
           username: ${{ env.REGISTRY_USER }}
-- 
cgit v1.2.3


From 3afaa3ddc3b3e32a3247d97038f6703a6387848c Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Sat, 11 Jan 2025 18:00:36 -0300
Subject: fix: signing also needs to be lowercase :sob: (#57)

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0d2f144..51d396d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -166,7 +166,7 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${IMAGE_NAME}"
+          IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${IMAGE_NAME}"
           for tag in ${{ steps.metadata.outputs.tags }}; do
             cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
           done
-- 
cgit v1.2.3


From 270005cec27f141e2b4071077be13f6f557ac52f Mon Sep 17 00:00:00 2001
From: Cristian Torres <18661121+PrototypeActual@users.noreply.github.com>
Date: Thu, 23 Jan 2025 22:46:11 -0500
Subject: Update build.yml (#61)

Added lowering casing of image name should it be uppercased.Switched variables to grab lowercased image name.
---
 .github/workflows/build.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 51d396d..a8d7325 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -141,6 +141,12 @@ jobs:
         with:
           string: ${{ env.IMAGE_REGISTRY }}
 
+      - name: Lowercase Image
+        id: image_case
+        uses: ASzc/change-string-case-action@v6
+        with:
+          string: ${{ env.IMAGE_NAME }}
+
       - name: Push To GHCR
         uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
@@ -150,7 +156,7 @@ jobs:
           REGISTRY_PASSWORD: ${{ github.token }}
         with:
           registry: ${{ steps.registry_case.outputs.lowercase }}
-          image: ${{ env.IMAGE_NAME }}
+          image: ${{ steps.image_case.outputs.lowercase }}
           tags: ${{ steps.metadata.outputs.tags }}
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
@@ -166,7 +172,7 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${IMAGE_NAME}"
+          IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}"
           for tag in ${{ steps.metadata.outputs.tags }}; do
             cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
           done
-- 
cgit v1.2.3


From 0489a006f3d782e53e7531c9c8c8499e1e36cbcb Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 11 Feb 2025 00:16:26 -0500
Subject: chore(deps): update sigstore/cosign-installer action to v3.8.0 (#66)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a8d7325..eea69bc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -166,7 +166,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From 409b244e27cae726b8603a4b3d006baf6f2459a2 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Feb 2025 09:03:51 -0500
Subject: chore(deps): update sigstore/cosign-installer action to v3.8.1 (#69)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index eea69bc..591560c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -166,7 +166,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From ec6838e770600548e31473cf0f030abb726fc57c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 28 Feb 2025 16:56:23 -0500
Subject: chore(deps): update docker/metadata-action digest to 902fa8e (#70)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 591560c..2be4bdf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 28681f9687186850284226a01f4f4396d25c3b58 Mon Sep 17 00:00:00 2001
From: Sean <SNThrailkill@gmail.com>
Date: Thu, 13 Mar 2025 19:30:38 -0500
Subject: feat(build-iso): Add ability to generate ISO (#79)

* initial commit of s3 upload for iso

* Updated Readme. Updated build-iso.yml from testing in test repo

* one more note to make it look more balanced

* add artifact upload ability and adjust README to detail how to use

* One more final note to help be explicit about artifact location.

---------

Co-authored-by: Sean Thrailkill <sean@thrailkill.cloud>
---
 .github/workflows/build-iso.yml | 103 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)
 create mode 100644 .github/workflows/build-iso.yml

(limited to '.github')

diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
new file mode 100644
index 0000000..1083249
--- /dev/null
+++ b/.github/workflows/build-iso.yml
@@ -0,0 +1,103 @@
+---
+name: Build ISOs
+
+on:
+  workflow_dispatch:
+    inputs:
+      upload-to-s3:
+        description: "Upload to S3"
+        required: false
+        default: false
+        type: boolean
+      platform:
+        required: true
+        type: choice
+        options:
+          - amd64
+          - arm64
+  pull_request:
+    branches:
+      - main
+    paths:
+      - './iso.toml'
+      - './.github/workflows/build-iso.yml'
+      - './Justfile'
+
+env:
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository }}"
+  DEFAULT_TAG: "latest"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build ISOs
+    runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    strategy:
+      fail-fast: false
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+
+    steps:
+      - name: lower case the image registry in case of any capitalization
+        run: |
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+      
+      - name: Install dependencies
+        if: inputs.platform == 'arm64'
+        run: |
+          set -x
+          sudo apt update -y
+          sudo apt install -y \
+            podman
+
+      - name: Maximize build space
+        if: inputs.platform != 'arm64'
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Setup Just
+        uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
+
+      - name: Build ISO
+        id: build
+        uses: ublue-os/bootc-image-builder-action@main
+        with:
+          bootc-image-builder-image: ghcr.io/centos-workstation/bootc-image-builder:latest
+          use-librepo: true
+          config-file: ./iso.toml
+          image: ${{ env.IMAGE_REGISTRY }}:${{ env.DEFAULT_TAG }}
+
+      - name: Upload ISOs and Checksum to Job Artifacts
+        if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+        with:
+          path: ${{ steps.build.outputs.output-directory }}
+          if-no-files-found: error
+          retention-days: 0
+          compression-level: 0
+          overwrite: true
+      
+      - name: Upload to S3
+        if: inputs.upload-to-s3 == true && github.event_name != 'pull_request'
+        shell: bash
+        env:
+          RCLONE_CONFIG_S3_TYPE: s3
+          RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }}
+          RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }}
+          RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.build.outputs.output-directory }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
\ No newline at end of file
-- 
cgit v1.2.3


From 0d90f22b6403cb528c77a04811269896d19f3376 Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@proton.me>
Date: Sat, 15 Mar 2025 15:31:35 -0300
Subject: ci: make sure renovate uses best-practices preset (#84)

Even if they say that its best for people that want the best practices on the docs, we should make people using this template have this safer thing by default

https://docs.renovatebot.com/presets-config/#configbest-practices
---
 .github/renovate.json5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 5db72dd..48515b9 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:best-practices"
   ]
 }
-- 
cgit v1.2.3


From 5bdea6ca89365bf05459ffc249d73116871dbbb9 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 15 Mar 2025 14:32:51 -0400
Subject: chore(deps): pin dependencies (#85)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2be4bdf..ac6e188 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -88,7 +88,7 @@ jobs:
 
       - name: Build Image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
         with:
           containerfiles: |
             ./Containerfile
@@ -137,13 +137,13 @@ jobs:
       # https://github.com/macbre/push-to-ghcr/issues/12
       - name: Lowercase Registry
         id: registry_case
-        uses: ASzc/change-string-case-action@v6
+        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
         with:
           string: ${{ env.IMAGE_REGISTRY }}
 
       - name: Lowercase Image
         id: image_case
-        uses: ASzc/change-string-case-action@v6
+        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
         with:
           string: ${{ env.IMAGE_NAME }}
 
-- 
cgit v1.2.3


From 04a3a8f576fdf24abaac2a46ad60ee442716c10d Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@proton.me>
Date: Sat, 15 Mar 2025 16:02:07 -0300
Subject: ci: use the same renovate config as bluefin-lts (#86)

* ci: use the same renovate config as bluefin-lts

This one makes it so we (and people that use this template) dont need to manually bump the docker images all the time, like we ran into with [bluefin LTS](https://github.com/ublue-os/bluefin-lts/pull/398#issuecomment-2726873005)

* fix: also remove the pin on Containerfile
---
 .github/renovate.json5 | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 48515b9..5e48a3e 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,6 +1,21 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:best-practices"
+    "config:best-practices",
+  ],
+
+  "rebaseWhen": "never",
+
+  "packageRules": [
+    {
+      "automerge": true,
+      "matchUpdateTypes": ["pin", "pinDigest"]
+    },
+    {
+      "enabled": false,
+      "matchUpdateTypes": ["digest", "pinDigest", "pin"],
+      "matchDepTypes": ["container"],
+      "matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
+    },
   ]
 }
-- 
cgit v1.2.3


From 8f6f85b3686f81306d310f4fff5e244c20bf3181 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 15 Mar 2025 15:03:09 -0400
Subject: chore(deps): update docker/login-action digest to 74a5d14 (#80)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ac6e188..8457604 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -126,7 +126,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From ed3affcb2f579cd904e600ed95c7b3fb95710a1b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 15 Mar 2025 15:03:23 -0400
Subject: chore(deps): update extractions/setup-just action to v3 (#83)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build-iso.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index 1083249..a267c8d 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -65,7 +65,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Just
-        uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
 
       - name: Build ISO
         id: build
-- 
cgit v1.2.3


From 89cdbfd05ff381f19505bcd2f6a2bcfcf72bad69 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 20 Mar 2025 09:17:26 -0400
Subject: chore(deps): update actions/upload-artifact digest to ea165f8 (#90)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build-iso.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index a267c8d..b8aa38e 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload ISOs and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From eddcdc6cf421fa663ecc5670f4fc9f5fb54499ae Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 24 Apr 2025 08:42:53 +0100
Subject: chore(deps): update sigstore/cosign-installer action to v3.8.2 (#98)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8457604..ad0d565 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -166,7 +166,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From 3e88d8228dc12c32c316d8be1b638e17ccbdeeed Mon Sep 17 00:00:00 2001
From: Christian Glombek <LorbusChris@users.noreply.github.com>
Date: Tue, 10 Jun 2025 02:15:44 +0200
Subject: chore: simplify (#111)

---
 .github/workflows/build-disk.yml | 115 +++++++++++++++++++++++++++++++++++++++
 .github/workflows/build-iso.yml  | 103 -----------------------------------
 .github/workflows/build.yml      |  46 +++++++---------
 3 files changed, 135 insertions(+), 129 deletions(-)
 create mode 100644 .github/workflows/build-disk.yml
 delete mode 100644 .github/workflows/build-iso.yml

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
new file mode 100644
index 0000000..e0d0cac
--- /dev/null
+++ b/.github/workflows/build-disk.yml
@@ -0,0 +1,115 @@
+---
+name: Build disk images
+
+on:
+  workflow_dispatch:
+    inputs:
+      upload-to-s3:
+        description: "Upload to S3"
+        required: false
+        default: false
+        type: boolean
+      platform:
+        required: true
+        type: choice
+        options:
+          - amd64
+          - arm64
+  pull_request:
+    branches:
+      - main
+    paths:
+      - './disk_config/disk.toml'
+      - './disk_config/iso.toml'
+      - './.github/workflows/build-disk.yml'
+
+env:
+  IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
+  DEFAULT_TAG: "latest"
+  BIB_IMAGE: "ghcr.io/lorbuschris/bootc-image-builder:20250608" # "quay.io/centos-bootc/bootc-image-builder:latest" - see https://github.com/osbuild/bootc-image-builder/pull/954
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build disk images
+    runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        disk-type: ["qcow2", "anaconda-iso"]
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+
+    steps:
+      - name: Prepare environment
+        run: |
+          USER_UID=$(id -u)
+          USER_GID=$(id -g)
+          # Concatenate the types with a hyphen
+          DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-')
+          # Lowercase the image uri
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+          echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV}
+          echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV}
+          echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV}
+
+      - name: Install dependencies
+        if: inputs.platform == 'arm64'
+        run: |
+          set -x
+          sudo apt update -y
+          sudo apt install -y \
+            podman
+
+      - name: Maximize build space
+        if: inputs.platform != 'arm64'
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Build disk images
+        id: build
+        uses: osbuild/bootc-image-builder-action@main
+        with:
+          builder-image: ${{ env.BIB_IMAGE }}
+          config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
+          image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
+          chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
+          types: ${{ matrix.disk-type }}
+          additional-args: --use-librepo=True
+
+      - name: Upload disk images and Checksum to Job Artifacts
+        if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          path: ${{ steps.build.outputs.output-directory }}
+          if-no-files-found: error
+          retention-days: 0
+          compression-level: 0
+          overwrite: true
+      
+      - name: Upload to S3
+        if: inputs.upload-to-s3 == true && github.event_name != 'pull_request'
+        shell: bash
+        env:
+          RCLONE_CONFIG_S3_TYPE: s3
+          RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }}
+          RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }}
+          RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.build.outputs.output-directory }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
\ No newline at end of file
diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
deleted file mode 100644
index b8aa38e..0000000
--- a/.github/workflows/build-iso.yml
+++ /dev/null
@@ -1,103 +0,0 @@
----
-name: Build ISOs
-
-on:
-  workflow_dispatch:
-    inputs:
-      upload-to-s3:
-        description: "Upload to S3"
-        required: false
-        default: false
-        type: boolean
-      platform:
-        required: true
-        type: choice
-        options:
-          - amd64
-          - arm64
-  pull_request:
-    branches:
-      - main
-    paths:
-      - './iso.toml'
-      - './.github/workflows/build-iso.yml'
-      - './Justfile'
-
-env:
-  IMAGE_REGISTRY: "ghcr.io/${{ github.repository }}"
-  DEFAULT_TAG: "latest"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Build ISOs
-    runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
-    strategy:
-      fail-fast: false
-    permissions:
-      contents: read
-      packages: read
-      id-token: write
-
-    steps:
-      - name: lower case the image registry in case of any capitalization
-        run: |
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-      
-      - name: Install dependencies
-        if: inputs.platform == 'arm64'
-        run: |
-          set -x
-          sudo apt update -y
-          sudo apt install -y \
-            podman
-
-      - name: Maximize build space
-        if: inputs.platform != 'arm64'
-        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
-        with:
-          remove-codeql: true
-
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: Setup Just
-        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-
-      - name: Build ISO
-        id: build
-        uses: ublue-os/bootc-image-builder-action@main
-        with:
-          bootc-image-builder-image: ghcr.io/centos-workstation/bootc-image-builder:latest
-          use-librepo: true
-          config-file: ./iso.toml
-          image: ${{ env.IMAGE_REGISTRY }}:${{ env.DEFAULT_TAG }}
-
-      - name: Upload ISOs and Checksum to Job Artifacts
-        if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          path: ${{ steps.build.outputs.output-directory }}
-          if-no-files-found: error
-          retention-days: 0
-          compression-level: 0
-          overwrite: true
-      
-      - name: Upload to S3
-        if: inputs.upload-to-s3 == true && github.event_name != 'pull_request'
-        shell: bash
-        env:
-          RCLONE_CONFIG_S3_TYPE: s3
-          RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }}
-          RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
-          RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-          RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }}
-          RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
-          SOURCE_DIR: ${{ steps.build.outputs.output-directory }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y rclone
-          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
\ No newline at end of file
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ad0d565..8e6e384 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,5 @@
 ---
-name: Build Custom Image
+name: Build container image
 on:
   pull_request:
     branches:
@@ -14,10 +14,12 @@ on:
   workflow_dispatch:
 
 env:
-  IMAGE_NAME: "${{ github.event.repository.name }}"  # the name of the image produced by this build, matches repo names
   IMAGE_DESC: "My Customized Universal Blue Image"
+  IMAGE_KEYWORDS: "bootc,ublue,universal-blue"
+  IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"  # Put your own image here for a fancy profile on https://artifacthub.io/!
+  IMAGE_NAME: "${{ github.event.repository.name }}"  # output image name, usually same as repo name
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
-  ARTIFACTHUB_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"  # You should put your own image here so that you get a fancy profile image on https://artifacthub.io/!
+  DEFAULT_TAG: "latest"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@@ -34,6 +36,12 @@ jobs:
       id-token: write
 
     steps:
+      - name: Prepare environment
+        run: |
+          # Lowercase the image uri
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -60,10 +68,10 @@ jobs:
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-          # By default, it should generate "latest" and "latest.(date here)".
+          # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date".
           tags: |
-            type=raw,value=latest
-            type=raw,value=latest.{{date 'YYYYMMDD'}}
+            type=raw,value=${{ env.DEFAULT_TAG }}
+            type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
             type=raw,value={{date 'YYYYMMDD'}}
             type=sha,enable=${{ github.event_name == 'pull_request' }}
             type=ref,event=pr
@@ -76,11 +84,11 @@ jobs:
             org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
             org.opencontainers.image.vendor=${{ github.repository_owner }}
-            org.opencontainers.image.version=latest
+            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
             io.artifacthub.package.deprecated=false
-            io.artifacthub.package.keywords=bootc,ublue,universal-blue
+            io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
             io.artifacthub.package.license=Apache-2.0
-            io.artifacthub.package.logo-url=${{ env.ARTIFACTHUB_LOGO_URL }}
+            io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
             io.artifacthub.package.prerelease=false
             containers.bootc=1
           sep-tags: " "
@@ -133,20 +141,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
-      # https://github.com/macbre/push-to-ghcr/issues/12
-      - name: Lowercase Registry
-        id: registry_case
-        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
-        with:
-          string: ${{ env.IMAGE_REGISTRY }}
-
-      - name: Lowercase Image
-        id: image_case
-        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
-        with:
-          string: ${{ env.IMAGE_NAME }}
-
       - name: Push To GHCR
         uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
@@ -155,8 +149,8 @@ jobs:
           REGISTRY_USER: ${{ github.actor }}
           REGISTRY_PASSWORD: ${{ github.token }}
         with:
-          registry: ${{ steps.registry_case.outputs.lowercase }}
-          image: ${{ steps.image_case.outputs.lowercase }}
+          registry: ${{ env.IMAGE_REGISTRY }}
+          image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
@@ -172,7 +166,7 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          IMAGE_FULL="${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}"
+          IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
           for tag in ${{ steps.metadata.outputs.tags }}; do
             cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
           done
-- 
cgit v1.2.3


From 101137c7b79b04bcb9d7d23d54d00cb8d4dc8d60 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 18 Jun 2025 13:54:32 +0300
Subject: chore(deps): update sigstore/cosign-installer action to v3.9.0 (#112)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8e6e384..db95edd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -160,7 +160,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+        uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From 523b7a05d5a6d9a28a515ea98e64536926f39948 Mon Sep 17 00:00:00 2001
From: Zeglius <33781398+Zeglius@users.noreply.github.com>
Date: Tue, 24 Jun 2025 06:09:43 +0200
Subject: feat: Bind mount podman container storage to btrfs loopback (#115)

---
 .github/workflows/build.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index db95edd..17f3bcd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,7 +51,10 @@ jobs:
       #   uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
       #   with:
       #     remove-codeql: true
-      
+
+      - name: Mount BTRFS for podman storage
+        uses: ublue-os/container-storage-action@main
+
       - name: Get current date
         id: date
         run: |
-- 
cgit v1.2.3


From b78fa9686712dc75234ee4eea7d2e59fff34bc8b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Jun 2025 11:53:32 +0300
Subject: chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1
 (#118)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 17f3bcd..9a6b4b1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,7 +163,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From cb2d192abeab7b762ad22a4703eb6016cfbc5de6 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Thu, 17 Jul 2025 16:45:28 -0400
Subject: chore(deps): update sigstore/cosign-installer action to v3.9.2 (#119)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a6b4b1..9776ec9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,7 +163,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From 32b7fd241722cf405e430b6cc962d22862f49730 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 08:59:22 -0400
Subject: chore(deps): update docker/metadata-action digest to c1e5197 (#122)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9776ec9..02d560f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -67,7 +67,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 2963d059eb1d8cca3ad8c6d0e3836c3330cc88ff Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 8 Aug 2025 08:43:00 -0400
Subject: chore(deps): update docker/login-action digest to 184bdaa (#124)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 02d560f..8c99d08 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -137,7 +137,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From a55a2e58c5e212751fd8952273b3b36e143e3ef4 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Mon, 11 Aug 2025 14:25:02 +0100
Subject: chore(deps): update actions/checkout action to v5 (#130)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index e0d0cac..88756c0 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c99d08..8470597 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       # - name: Maximize build space
-- 
cgit v1.2.3


From ae071dc75017ada7a51496c3f989a03b9d394609 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 12 Sep 2025 18:55:45 -0400
Subject: chore(deps): update sigstore/cosign-installer action to v3.10.0
 (#135)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8470597..f2d3691 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,7 +163,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From bf2fe0f31addbad5520041b35f640e06bf1292cc Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Sun, 28 Sep 2025 14:23:33 +0200
Subject: feat(ci): add fallback condition for btrfs bind mount (#134)

---
 .github/workflows/build.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f2d3691..4d867be 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -53,7 +53,15 @@ jobs:
       #     remove-codeql: true
 
       - name: Mount BTRFS for podman storage
-        uses: ublue-os/container-storage-action@main
+        id: container-storage-action
+        uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140
+
+        # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space
+        # See: https://github.com/ublue-os/container-storage-action/pull/11
+        continue-on-error: true 
+        with:
+          target-dir: /var/lib/containers
+          mount-opts: compress-force=zstd:2
 
       - name: Get current date
         id: date
-- 
cgit v1.2.3


From 396fd4efda2effd0044cd8199f13b06b440b65ce Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 30 Sep 2025 07:04:09 +0300
Subject: chore(deps): update docker/login-action digest to 5e57cd1 (#138)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d867be..ecd3ffa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -145,7 +145,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From dc912bc7eaa87d1ec9bb0bc690cc18a6ccddb63c Mon Sep 17 00:00:00 2001
From: Ondra Pelech <ondra.pelech@gmail.com>
Date: Tue, 28 Oct 2025 09:23:39 +0100
Subject: Container image labels point to specific commit (#153)

---
 .github/workflows/build.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ecd3ffa..b7d99af 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -87,13 +87,13 @@ jobs:
             type=sha,enable=${{ github.event_name == 'pull_request' }}
             type=ref,event=pr
           labels: |
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
+            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
             org.opencontainers.image.created=${{ steps.date.outputs.date }}
             org.opencontainers.image.description=${{ env.IMAGE_DESC }}
-            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
-            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile
+            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
+            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile
             org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
+            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
             org.opencontainers.image.vendor=${{ github.repository_owner }}
             org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
             io.artifacthub.package.deprecated=false
-- 
cgit v1.2.3


From 1f42991aa3c70d92a6ae1947a74986caf9e098d1 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Tue, 4 Nov 2025 09:35:36 +0100
Subject: docs: clarify usage of space saving actions (#163)

---
 .github/workflows/build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b7d99af..61e75bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,9 +46,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
+      # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       # - name: Maximize build space
-      #   uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
+      #   uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
       #   with:
       #     remove-codeql: true
 
-- 
cgit v1.2.3


From 268e63453deba72c6098ca406226cb70b327dc41 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 14 Nov 2025 10:48:45 +0200
Subject: chore(deps): bump docker/metadata-action from 5.8.0 to 5.9.0 (#167)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 61e75bb..944dbb5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,7 +76,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 3d25bebc48b2c6418233d4cd27a505bf947c2f9a Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Wed, 19 Nov 2025 21:42:35 +0200
Subject: chore(deps): update actions/checkout digest to 93cb6ef (#168)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 88756c0..eee4fa8 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 944dbb5..66ca0b3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-- 
cgit v1.2.3


From de726feb9a9221820f71834395b3065f73bbf8b5 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 11:17:43 +0200
Subject: chore(deps): update actions/checkout action to v6 (#169)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index eee4fa8..e20474c 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 66ca0b3..041f96d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
       # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-- 
cgit v1.2.3


From 5e40e0c14f51b891c747924493899ead4bb705b3 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 28 Nov 2025 08:22:30 +0200
Subject: chore(deps): update docker/metadata-action digest to c299e40 (#170)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 041f96d..6b93b96 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,7 +76,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 1b96722e1fd9e79af74f9584f931c5da9670c1d3 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 19:35:31 +0200
Subject: chore(deps): update actions/checkout digest to 8e8c483 (#171)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index e20474c..e1ce80e 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6b93b96..543a05d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-- 
cgit v1.2.3


From 849ed7bc52a62124bc58515ad6afa99e8a5d33b0 Mon Sep 17 00:00:00 2001
From: Kyle Gospodnetich <me@kylegospodneti.ch>
Date: Wed, 17 Dec 2025 12:51:18 -0800
Subject: fix: Maximize build space by default and use legacy rechunker in-org

---
 .github/workflows/build.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 543a05d..00d23dd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -48,10 +48,10 @@ jobs:
 
       # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-      # - name: Maximize build space
-      #   uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-      #   with:
-      #     remove-codeql: true
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
+        with:
+          remove-codeql: true
 
       - name: Mount BTRFS for podman storage
         id: container-storage-action
@@ -125,9 +125,9 @@ jobs:
       # You can enable it by uncommenting the following lines:
       # - name: Run Rechunker
       #   id: rechunk
-      #   uses: hhd-dev/rechunk@f153348d8100c1f504dec435460a0d7baf11a9d2 # v1.1.1
+      #   uses: ublue-os/legacy-rechunk@a925083d9af7cb04b3e2a6e8c01bfa495f38b710 # v1.0.0
       #   with:
-      #     rechunk: 'ghcr.io/hhd-dev/rechunk:v1.0.1'
+      #     rechunk: 'ghcr.io/ublue-os/legacy-rechunk:v1.0.0-x86_64'
       #     ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
       #     prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
       #     skip_compression: true
-- 
cgit v1.2.3


From be44a7c4653a93542cb1b59e4aba74681150175e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 12:53:18 -0800
Subject: chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 (#175)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...b7c566a772e6b6bfb58ed0dc250532a479d7789f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index e1ce80e..984b60c 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload disk images and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v4
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From e5b72dbbd2cd3ec00c26c735834df62d20143ee3 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 12:53:43 -0800
Subject: chore(deps): update sigstore/cosign-installer action to v3.10.1
 (#146)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 00d23dd..85769c2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -172,7 +172,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image
-- 
cgit v1.2.3


From caf6f7b73448b7ae5a4ea40f4d931e9598326730 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 12:54:23 -0800
Subject: chore(deps): update actions/upload-artifact action to v5 (#152)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: Kyle Gospodnetich <me@kylegospodneti.ch>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 984b60c..f759019 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload disk images and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From cf8c622d95744509dbffccbfb11083fcd4e84c74 Mon Sep 17 00:00:00 2001
From: Kyle Gospodnetich <me@kylegospodneti.ch>
Date: Wed, 17 Dec 2025 12:55:52 -0800
Subject: fix: Update cosign-installer to v4.0.0

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85769c2..5e18e01 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -172,8 +172,10 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        with:
+          cosign-release: 'v2.6.1'
 
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-- 
cgit v1.2.3


From 72c4fa0f72f9ba8a7fd46b4ac619d35d9fe3a070 Mon Sep 17 00:00:00 2001
From: Kyle Gospodnetich <me@kylegospodneti.ch>
Date: Wed, 17 Dec 2025 12:57:17 -0800
Subject: fix: Drop unneeded remove-codeql flag

---
 .github/workflows/build.yml | 2 --
 1 file changed, 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5e18e01..217689a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -50,8 +50,6 @@ jobs:
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-        with:
-          remove-codeql: true
 
       - name: Mount BTRFS for podman storage
         id: container-storage-action
-- 
cgit v1.2.3


From 6ee78234e3df84398e2de7c67000f1fdcc50265e Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 23:58:50 +0200
Subject: chore(deps): update actions/upload-artifact action to v6 (#179)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index f759019..3dff937 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload disk images and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From 1ed5b30294183666cb69ff5b496127974b5e3fb0 Mon Sep 17 00:00:00 2001
From: Michael Cuomo <10276078+mykeelium@users.noreply.github.com>
Date: Sat, 24 Jan 2026 00:29:44 -0500
Subject: fix: alter BIB_IMAGE to suggested on osbuild/bootc-image-builder
 (#188)

---
 .github/workflows/build-disk.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 3dff937..45aa607 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -27,7 +27,7 @@ env:
   IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
   DEFAULT_TAG: "latest"
-  BIB_IMAGE: "ghcr.io/lorbuschris/bootc-image-builder:20250608" # "quay.io/centos-bootc/bootc-image-builder:latest" - see https://github.com/osbuild/bootc-image-builder/pull/954
+  BIB_IMAGE: "quay.io/centos-bootc/bootc-image-builder:latest"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
@@ -112,4 +112,4 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y rclone
-          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
\ No newline at end of file
+          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
-- 
cgit v1.2.3


From db28befef166ed5c065c4398165e429bf9be7391 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 26 Jan 2026 08:14:58 +0200
Subject: chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#189)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 45aa607..a35491c 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 217689a..06b483f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-- 
cgit v1.2.3


From c273c05c27aae30d4e63ac929697353b89d56ca8 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Sun, 1 Feb 2026 13:29:49 +0100
Subject: chore: remove btrfs-action (#192)

---
 .github/workflows/build.yml | 12 ------------
 1 file changed, 12 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 06b483f..1d2dd90 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,22 +46,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      # You only use this action if the container-storage-action proves to be unreliable, you don't need to enable both
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
 
-      - name: Mount BTRFS for podman storage
-        id: container-storage-action
-        uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140
-
-        # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space
-        # See: https://github.com/ublue-os/container-storage-action/pull/11
-        continue-on-error: true 
-        with:
-          target-dir: /var/lib/containers
-          mount-opts: compress-force=zstd:2
-
       - name: Get current date
         id: date
         run: |
-- 
cgit v1.2.3


From 61c16bbefe8d591e59d0f9075bbf325f30079773 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Feb 2026 06:49:29 +0200
Subject: chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#193)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d2dd90..6cb85db 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From b240b3655737aa3c9d2fe458ced23632f2411a60 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 06:48:36 +0200
Subject: chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#199)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index a35491c..29df29c 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload disk images and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From 7f5bf0d292d9609187c8feca253602dd59693ed1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 21:24:59 +0100
Subject: chore(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 (#202)

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...030e881283bb7a6894de51c315a6bfe6a94e05cf)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6cb85db..1a08988 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,7 +62,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 04d003befdf7defe76fe4f79e26ddd9ce07ccedc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Mar 2026 16:59:43 +0100
Subject: chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#203)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a08988..16fbf15 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From 7357a44510f052cfbf77fb65b447c6ccea52e2da Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Thu, 2 Apr 2026 22:51:14 +0200
Subject: chore(deps): update docker/login-action action to v4.1.0 (#208)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 16fbf15..85d3532 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From 483d45225f0614243a43caa4937a7a0dc4e02291 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Fri, 3 Apr 2026 09:13:07 +0200
Subject: chore(ci): remove remove-unwanted-software-action (#209)

---
 .github/workflows/build.yml | 4 ----
 1 file changed, 4 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85d3532..fbaf527 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,10 +46,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-
       - name: Get current date
         id: date
         run: |
-- 
cgit v1.2.3


From 2a321c0fa74238cf98f3bd953aba96a66705dc4c Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Fri, 3 Apr 2026 21:17:21 +0200
Subject: Revert "chore(ci): remove remove-unwanted-software-action (#209)"
 (#210)

This reverts commit 483d45225f0614243a43caa4937a7a0dc4e02291.

This only got rarer but this is still needed sometimes :(
---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fbaf527..85d3532 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,6 +46,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
+      # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
+
       - name: Get current date
         id: date
         run: |
-- 
cgit v1.2.3


From 223a648738e20344612cdc1cc0b3b11083e5a87e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 02:12:45 +0200
Subject: chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#212)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 29df29c..67ee43e 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload disk images and Checksum to Job Artifacts
         if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: ${{ steps.build.outputs.output-directory }}
           if-no-files-found: error
-- 
cgit v1.2.3


From 9db41a20a2b721b6760e883c5e9acc39e7face39 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 02:15:48 +0200
Subject: chore(deps): update sigstore/cosign-installer action to v4.1.0 (#204)

* chore(deps): update sigstore/cosign-installer action to v4.1.0

* chore: bump cosign-release to v.2.6.3

---------

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85d3532..d8469ad 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -158,10 +158,10 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
-          cosign-release: 'v2.6.1'
+          cosign-release: 'v2.6.3'
 
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-- 
cgit v1.2.3


From ebf38108c08fe17d146b309caeeac106bae990e4 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sat, 23 May 2026 12:10:04 +0300
Subject: chore(deps): update docker/metadata-action action to v6.1.0 (#224)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d8469ad..d794606 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,7 +62,7 @@ jobs:
       # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
       # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: metadata
         with:
           # This generates all the tags for your image, you can add custom tags here too!
-- 
cgit v1.2.3


From 241dce59e1ad900b8870a309f9458be57d76037a Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 06:41:45 +0300
Subject: chore(deps): update actions/checkout digest to df4cb1c (#226)

---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 67ee43e..d8bc599 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d794606..c1fd45b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
 
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       - name: Maximize build space
-- 
cgit v1.2.3


From aa3ba96095417c41d02cf14b2c8d8778ceb6f502 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 06:42:07 +0300
Subject: chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#225)

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c1fd45b..85a8c97 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From a65bb3da1f7c5ed04ac3d8b5f69878c5ecee14ea Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Wed, 17 Jun 2026 16:16:34 +0200
Subject: refactor: rewrite in just, saner defaults (#218)

* refactor: rewrite in just, saner defaults

I think it makes sense to do this as it is longterm easier to maintain,
locally iterate and extend.

Documents how to rebase to a local image, it pains me greatly when
people iterate on github and wait forever for things to build and then
to download the image for trivial things they could also quickly do
locally.

Rpm-ostree rechunker by default instead of opt-in legacy-rechunker,
chunkah is also available if people want to use it already, if we deem
it ready then we can enable it later on. They can all be opted-out of.

Have a way to copy files to /{usr,etc} by default.

We should sign the digest of the image instead of the tag.

Co-Authored-by: a lot of sugar and bad music

* docs: bump fedora-bootc version

Co-authored-by: Jill Fiore <contact@lumaeris.com>

* fix: formatting inconsistency

Co-authored-by: Jill Fiore <contact@lumaeris.com>

* docs: remove variable mentions from workflows

These are now defined in the image-template.env file

* fix: small nits in labels

Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>

---------

Co-authored-by: Jill Fiore <contact@lumaeris.com>
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
---
 .github/workflows/build.yml | 193 ++++++++++++++++++++------------------------
 1 file changed, 89 insertions(+), 104 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85a8c97..e355434 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,12 +14,7 @@ on:
   workflow_dispatch:
 
 env:
-  IMAGE_DESC: "My Customized Universal Blue Image"
-  IMAGE_KEYWORDS: "bootc,ublue,universal-blue"
-  IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"  # Put your own image here for a fancy profile on https://artifacthub.io/!
-  IMAGE_NAME: "${{ github.event.repository.name }}"  # output image name, usually same as repo name
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
-  DEFAULT_TAG: "latest"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@@ -36,98 +31,87 @@ jobs:
       id-token: write
 
     steps:
-      - name: Prepare environment
-        run: |
-          # Lowercase the image uri
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
-
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
 
-      - name: Get current date
-        id: date
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
+
+      - name: Check Just Syntax
+        shell: bash
         run: |
-          # This generates a timestamp like what is defined on the ArtifactHub documentation
-          # E.G: 2022-02-08T15:38:15Z'
-          # https://artifacthub.io/docs/topics/repositories/container-images/
-          # https://linux.die.net/man/1/date
-          echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
-
-      # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
-      # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
-      - name: Image Metadata
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: metadata
-        with:
-          # This generates all the tags for your image, you can add custom tags here too!
-          # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date".
-          tags: |
-            type=raw,value=${{ env.DEFAULT_TAG }}
-            type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
-            type=raw,value={{date 'YYYYMMDD'}}
-            type=sha,enable=${{ github.event_name == 'pull_request' }}
-            type=ref,event=pr
-          labels: |
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
-            org.opencontainers.image.created=${{ steps.date.outputs.date }}
-            org.opencontainers.image.description=${{ env.IMAGE_DESC }}
-            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
-            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
-            org.opencontainers.image.vendor=${{ github.repository_owner }}
-            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
-            io.artifacthub.package.deprecated=false
-            io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
-            io.artifacthub.package.license=Apache-2.0
-            io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
-            io.artifacthub.package.prerelease=false
-            containers.bootc=1
-          sep-tags: " "
-          sep-annotations: " "
+          just check
+
+      - name: Image Name
+        id: image-name
+        run: |
+          IMAGE_NAME=$(just image_name)
+
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
+
+      - name: Default Tag
+        id: gen-default-tag
+        run: |
+          DEFAULT_TAG=$(just generate-default-tag)
+
+          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
+
+      - name: Prepare environment
+        run: |
+          # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
+      # This actually builds the container image
       - name: Build Image
-        id: build_image
-        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
-        with:
-          containerfiles: |
-            ./Containerfile
-          # Postfix image name with -custom to make it a little more descriptive
-          # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
-          image: ${{ env.IMAGE_NAME }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          oci: false
-
-      # Rechunk is a script that we use on Universal Blue to make sure there isnt a single huge layer when your image gets published.
-      # This does not make your image faster to download, just provides better resumability and fixes a few errors.
-      # Documentation for Rechunk is provided on their github repository at https://github.com/hhd-dev/rechunk
-      # You can enable it by uncommenting the following lines:
-      # - name: Run Rechunker
-      #   id: rechunk
-      #   uses: ublue-os/legacy-rechunk@a925083d9af7cb04b3e2a6e8c01bfa495f38b710 # v1.0.0
-      #   with:
-      #     rechunk: 'ghcr.io/ublue-os/legacy-rechunk:v1.0.0-x86_64'
-      #     ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
-      #     prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
-      #     skip_compression: true
-      #     version: ${{ env.CENTOS_VERSION }}
-      #     labels: ${{ steps.metadata.outputs.labels }} # Rechunk strips out all the labels during build, this needs to be reapplied here with newline separator
-
-      # This is necessary so that the podman socket can find the rechunked image on its storage
-      # - name: Load in podman and tag
-      #   run: |
-      #     IMAGE=$(podman pull ${{ steps.rechunk.outputs.ref }})
-      #     sudo rm -rf ${{ steps.rechunk.outputs.output }}
-      #     for tag in ${{ steps.metadata.outputs.tags }}; do
-      #       podman tag $IMAGE ${{ env.IMAGE_NAME }}:$tag
-      #     done
+        id: build-image
+        run: |
+          sudo -E $(command -v just) build \
+            ${IMAGE_NAME} \
+            ${DEFAULT_TAG}
+
+      # This is optional, this provides smaller delta updates
+      - name: Rechunk with rpm-ostree
+        id: rechunk
+        run: |
+          sudo -E $(command -v just) ostree-rechunk \
+            ${IMAGE_NAME} \
+            ${DEFAULT_TAG}
+
+      # If you are feeling adventurous, use the new distro agnostic rechunker
+      # https://github.com/coreos/chunkah
+      # You can delete the Rechunk with rpm-ostree portion then if you use this
+      #- name: Rechunk with Chunkah
+      #  id: rechunk
+      #  run: |
+      #    sudo -E $(command -v just) rechunk \
+      #      ${IMAGE_NAME} \
+      #      ${DEFAULT_TAG}
+
+      - name: Generate Build Tags
+        id: gen-build-tags
+        run: |
+          alias_tags="$(just generate-build-tags \
+                        ${IMAGE_NAME} \
+                        ${DEFAULT_TAG})"
+
+          echo "Tags for this Action..."
+          echo "${alias_tags}"
+          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
+
+      - name: Tag Image
+        id: tag-images
+        env:
+          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
+        run: |
+          sudo -E $(command -v just) tag-images \
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}" \
+            "${ALIAS_TAGS}"
 
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
@@ -140,37 +124,38 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        id: push
+        id: push-image
         env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ github.token }}
-        with:
-          registry: ${{ env.IMAGE_REGISTRY }}
-          image: ${{ env.IMAGE_NAME }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
+          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
+        run: |
+          set -euox pipefail
+          for tag in ${ALIAS_TAGS}; do
+            sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
+          done
+
+          digest=$(< /tmp/digestfile)
+
+          echo "digest=${digest}" >> $GITHUB_OUTPUT
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
+        id: sign-image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        run: |
-          IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
-          for tag in ${{ steps.metadata.outputs.tags }}; do
-            cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
-          done
         env:
-          TAGS: ${{ steps.push.outputs.digest }}
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          DIGEST: ${{ steps.push-image.outputs.digest }}
+        run: |
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
+
-- 
cgit v1.2.3


From 9bbbf9370f9e5c00df5181adad7c8f7b30a4c6b4 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 21:40:59 +0200
Subject: chore(deps): update actions/checkout action to v7 (#228)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 .github/workflows/build.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index d8bc599..8f24f42 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -75,7 +75,7 @@ jobs:
           remove-codeql: true
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Build disk images
         id: build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e355434..8278947 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-- 
cgit v1.2.3


From bdbe3c0defc4dd587ac933774b7d36f31338c1e6 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 03:05:27 +0000
Subject: chore(deps): pin dependencies (#230)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 8f24f42..a24f5a4 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -79,7 +79,7 @@ jobs:
 
       - name: Build disk images
         id: build
-        uses: osbuild/bootc-image-builder-action@main
+        uses: osbuild/bootc-image-builder-action@8661cd3832544ad68c12dcde8681b13ab0f56a8d # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
           config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
-- 
cgit v1.2.3


From 4a99dd73617e0cd5784929b5007a0aa5e92c7dd5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 07:24:46 +0200
Subject: chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#235)

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8278947..de2882d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -116,7 +116,7 @@ jobs:
       # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
       # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From ed40e44b610cac878f17fa4233d8e3d19b8d67bb Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 9 Jul 2026 16:53:52 +0800
Subject: Configure AeroCore image mirrors

Add build-time mirror configuration for Flatpak and Homebrew, expose the related build args, and install an AeroCore-owned profile script to load mirror environment files. Rename the mirror configuration files from the Bazzite-prefixed names to AeroCore-prefixed names while keeping the upstream Bazzite helper reference intact.

Verification: bash -n system_files/etc/profile.d/aerocore-mirrors.sh && bash -n build_files/build.sh
---
 .github/workflows/build.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index de2882d..90371c8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -69,6 +69,11 @@ jobs:
       # This actually builds the container image
       - name: Build Image
         id: build-image
+        env:
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
+          HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
+          HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
         run: |
           sudo -E $(command -v just) build \
             ${IMAGE_NAME} \
@@ -158,4 +163,3 @@ jobs:
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
-
-- 
cgit v1.2.3


From 61a3dd784f1bb36b89644e158c4e9d75da736935 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 9 Jul 2026 17:21:21 +0800
Subject: Push build images to ACR

Add an ACR publish step after the existing GHCR publish and signing flow. The step is gated to non-PR default-branch runs and only executes when ACR_REGISTRY and ACR_NAMESPACE repository variables are set.

Verification: ruby YAML parser loaded .github/workflows/build.yml successfully.
---
 .github/workflows/build.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 90371c8..b822ac6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,3 +163,23 @@ jobs:
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
+
+      - name: Push To ACR
+        if: |
+          github.event_name != 'pull_request' &&
+          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
+          vars.ACR_REGISTRY != '' &&
+          vars.ACR_NAMESPACE != ''
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
+        run: |
+          set -euo pipefail
+          echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
+
+          for tag in ${ALIAS_TAGS}; do
+            sudo -E podman push "${IMAGE_NAME}:${tag}" "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}"
+          done
-- 
cgit v1.2.3


From 9344fb4f7622ad643a1118ec1989ff2136c35b1f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 09:24:16 +0000
Subject: chore(deps): bump osbuild/bootc-image-builder-action

Bumps [osbuild/bootc-image-builder-action](https://github.com/osbuild/bootc-image-builder-action) from 8661cd3832544ad68c12dcde8681b13ab0f56a8d to 30960621b85c9e76c653082f9ef4cab5a10210d5.
- [Release notes](https://github.com/osbuild/bootc-image-builder-action/releases)
- [Commits](https://github.com/osbuild/bootc-image-builder-action/compare/8661cd3832544ad68c12dcde8681b13ab0f56a8d...30960621b85c9e76c653082f9ef4cab5a10210d5)

---
updated-dependencies:
- dependency-name: osbuild/bootc-image-builder-action
  dependency-version: 30960621b85c9e76c653082f9ef4cab5a10210d5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index a24f5a4..1de6c6e 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -79,7 +79,7 @@ jobs:
 
       - name: Build disk images
         id: build
-        uses: osbuild/bootc-image-builder-action@8661cd3832544ad68c12dcde8681b13ab0f56a8d # main
+        uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
           config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
-- 
cgit v1.2.3


From 75f30511833eb72dfe24fb4e2946aab65571173c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 9 Jul 2026 18:21:37 +0800
Subject: Promote ACR images manually

Remove push-triggered builds and split ACR publishing out of the build workflow.

Add a manual promote-acr workflow that copies an existing GHCR tag to ACR, supports explicit target tags, validates the required ACR configuration, and signs the promoted ACR digest.

Verification: parsed both workflow YAML files and checked embedded run blocks with bash -n.
---
 .github/workflows/build.yml       |  25 -------
 .github/workflows/promote-acr.yml | 147 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 147 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/promote-acr.yml

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b822ac6..56f8da9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,11 +6,6 @@ on:
       - main
   schedule:
     - cron: '05 10 * * *'  # 10:05am UTC everyday
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - '**/README.md'
   workflow_dispatch:
 
 env:
@@ -163,23 +158,3 @@ jobs:
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
-
-      - name: Push To ACR
-        if: |
-          github.event_name != 'pull_request' &&
-          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
-          vars.ACR_REGISTRY != '' &&
-          vars.ACR_NAMESPACE != ''
-        env:
-          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
-          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
-          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
-        run: |
-          set -euo pipefail
-          echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
-
-          for tag in ${ALIAS_TAGS}; do
-            sudo -E podman push "${IMAGE_NAME}:${tag}" "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}"
-          done
diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
new file mode 100644
index 0000000..99a67f8
--- /dev/null
+++ b/.github/workflows/promote-acr.yml
@@ -0,0 +1,147 @@
+---
+name: Promote image to ACR
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_tag:
+        description: "Existing GHCR tag to promote"
+        required: true
+        type: string
+      target_tags:
+        description: "Space-separated ACR tags to publish; defaults to source_tag"
+        required: false
+        type: string
+      image_name:
+        description: "Image name override; defaults to image-template.env"
+        required: false
+        type: string
+
+env:
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
+  cancel-in-progress: false
+
+jobs:
+  promote_acr:
+    name: Promote GHCR image to ACR
+    runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
+
+      - name: Install skopeo
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+
+      - name: Prepare image variables
+        env:
+          IMAGE_NAME_INPUT: ${{ inputs.image_name }}
+          SOURCE_TAG: ${{ inputs.source_tag }}
+          TARGET_TAGS_INPUT: ${{ inputs.target_tags }}
+        run: |
+          set -euo pipefail
+
+          image_name="${IMAGE_NAME_INPUT:-$(just image_name)}"
+          target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}"
+
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "SOURCE_TAG=${SOURCE_TAG}" >> "$GITHUB_ENV"
+          echo "TARGET_TAGS=${target_tags}" >> "$GITHUB_ENV"
+
+      - name: Validate ACR configuration
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+        run: |
+          set -euo pipefail
+
+          : "${ACR_REGISTRY:?Repository variable ACR_REGISTRY is required.}"
+          : "${ACR_NAMESPACE:?Repository variable ACR_NAMESPACE is required.}"
+          : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}"
+          : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}"
+          : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}"
+
+      - name: Login to GitHub Container Registry
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "$GITHUB_TOKEN" | sudo -E podman login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Login to ACR
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        run: |
+          set -euo pipefail
+          echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
+          echo "$ACR_PASSWORD" | docker login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
+
+      - name: Promote image
+        id: promote
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
+        run: |
+          set -euo pipefail
+
+          source_image="docker://${IMAGE_REGISTRY}/${IMAGE_NAME}:${SOURCE_TAG}"
+          first_target=""
+
+          {
+            echo "# Promote to ACR result"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          for tag in ${TARGET_TAGS}; do
+            dest_image="${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}"
+            sudo -E skopeo copy "$source_image" "docker://$dest_image"
+            echo "$dest_image" >> "$GITHUB_STEP_SUMMARY"
+            if [ -z "$first_target" ]; then
+              first_target="$dest_image"
+            fi
+          done
+
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+          digest=$(sudo -E skopeo inspect --format '{{.Digest}}' "docker://$first_target")
+          if [ -z "$digest" ]; then
+            echo "Failed to resolve digest for $first_target" >&2
+            exit 1
+          fi
+
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: 'v2.6.3'
+
+      - name: Sign ACR image
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          DIGEST: ${{ steps.promote.outputs.digest }}
+        run: |
+          set -euo pipefail
+
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}@${DIGEST}"
-- 
cgit v1.2.3


From 42a6ff3286804854c1c21a7e62158f09e19a9b09 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sun, 12 Jul 2026 23:33:44 +0800
Subject: Add live installer build workflow

Add a Bazzite-style installer payload, CI workflow, and local\nPodman commands for building and testing the live ISO.\n\nFix stale disk image configuration references and installer targets.
---
 .github/workflows/build-disk.yml           |   7 +-
 .github/workflows/build-live-installer.yml | 116 +++++++++++++++++++++++++++++
 2 files changed, 120 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/build-live-installer.yml

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 1de6c6e..02ef44a 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -20,7 +20,8 @@ on:
       - main
     paths:
       - './disk_config/disk.toml'
-      - './disk_config/iso.toml'
+      - './disk_config/iso-kde.toml'
+      - './disk_config/iso-gnome.toml'
       - './.github/workflows/build-disk.yml'
 
 env:
@@ -36,7 +37,7 @@ concurrency:
 jobs:
   build:
     name: Build disk images
-    runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ inputs.platform == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     strategy:
       fail-fast: false
       matrix:
@@ -82,7 +83,7 @@ jobs:
         uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
-          config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
+          config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso-kde.toml' || './disk_config/disk.toml' }}
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
           types: ${{ matrix.disk-type }}
diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
new file mode 100644
index 0000000..870699e
--- /dev/null
+++ b/.github/workflows/build-live-installer.yml
@@ -0,0 +1,116 @@
+name: Build live installer
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "AeroCore image tag to install"
+        required: false
+        default: latest
+        type: string
+  workflow_call:
+  push:
+    branches:
+      - main
+    paths:
+      - "installer/**"
+      - "just_scripts/build-live-installer.sh"
+      - ".github/workflows/build-live-installer.yml"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-live-installer:
+    name: Build KDE live installer
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      BASE_IMAGE: ghcr.io/ublue-os/bazzite:stable
+      FEDORA_VERSION: "44"
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Mount container storage BTRFS loopback
+        run: |
+          sudo truncate -s 70G /mnt/podman-storage.img
+          sudo mkfs.btrfs -f /mnt/podman-storage.img
+          sudo podman system reset --force
+          sudo systemctl stop podman.service
+          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
+          sudo systemctl start podman.service
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Prepare image references
+        run: |
+          image_name="$(just image_name)"
+          image_registry="${IMAGE_REGISTRY,,}"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        run: |
+          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
+            --username '${{ github.actor }}' --password-stdin
+
+      - name: Pull AeroCore install image
+        run: |
+          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+
+      - name: Build live installer payload
+        run: |
+          sudo podman build \
+            --cap-add sys_admin \
+            --security-opt label=disable \
+            --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            --tag localhost/aerocore-live-payload:latest \
+            --file installer/Containerfile \
+            .
+
+      - name: Build ISO
+        id: build
+        uses: Zeglius/titanoboa@revamp-pr
+        with:
+          arch: x86_64
+          image_name: aerocore-live-payload
+          image_repo: localhost
+          variant: Kinoite
+          version: ${{ env.FEDORA_VERSION }}
+          image_tag: latest
+          iso_name: aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
+          enable_cache_dnf: "false"
+          enable_cache_skopeo: "false"
+          enable_flatpak_dependencies: "false"
+          additional_templates: /github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl
+
+      - name: Display checksum
+        run: |
+          cat "${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM"
+
+      - name: Upload ISO artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: aerocore-os-live-installer-${{ env.IMAGE_TAG }}
+          path: |
+            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}
+            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM
+          if-no-files-found: error
+          compression-level: 0
-- 
cgit v1.2.3


From 78bc16acebffcffcb5e544139cb4c5169f652985 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:17:46 +0800
Subject: Allow env override for image update ref

Pass OSTREE_IMAGE_REF from GitHub repository variables into the image build so image-info.json can point systems at the configured update source.
---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56f8da9..1a7f7d4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -69,6 +69,7 @@ jobs:
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
+          OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
         run: |
           sudo -E $(command -v just) build \
             ${IMAGE_NAME} \
-- 
cgit v1.2.3


From 81027c19c3f10e64d095e74b1e3387e8daf4e15f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:26:39 +0800
Subject: Publish manual testing image tags

Allow manually dispatched testing branch builds to publish and sign both the moving testing tag and a dated testing tag.
---
 .github/workflows/build.yml | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a7f7d4..e542a89 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,7 +51,11 @@ jobs:
       - name: Default Tag
         id: gen-default-tag
         run: |
-          DEFAULT_TAG=$(just generate-default-tag)
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
+            DEFAULT_TAG="testing-$(date -u +%Y%m%d)"
+          else
+            DEFAULT_TAG=$(just generate-default-tag)
+          fi
 
           echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
 
@@ -96,9 +100,13 @@ jobs:
       - name: Generate Build Tags
         id: gen-build-tags
         run: |
-          alias_tags="$(just generate-build-tags \
-                        ${IMAGE_NAME} \
-                        ${DEFAULT_TAG})"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
+            alias_tags="testing ${DEFAULT_TAG}"
+          else
+            alias_tags="$(just generate-build-tags \
+                          ${IMAGE_NAME} \
+                          ${DEFAULT_TAG})"
+          fi
 
           echo "Tags for this Action..."
           echo "${alias_tags}"
@@ -114,18 +122,18 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
-      # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
-      # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
+      # These `if` statements keep pull requests from publishing packages.
+      # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -145,14 +153,14 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-- 
cgit v1.2.3


From 80dc6c0ccafc54d48b862b46261e12b53675b77f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 00:55:21 +0800
Subject: Use BTRFS storage for image builds

Mount /var/lib/containers on the larger runner disk before building so rpm-ostree rechunk has enough space for bootc images.
---
 .github/workflows/build.yml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e542a89..0b1a54b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,12 +27,31 @@ jobs:
 
     steps:
       # These stage versions are pinned by https://github.com/renovatebot/renovate
+      - name: Show disk space
+        run: sudo df -h
+
+      - name: Check if /mnt is there
+        id: check-mnt
+        run: |
+          if sudo mountpoint /mnt; then
+            echo "mnt_is_there=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "mnt_is_there=0" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Free Disk Space
+        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+
+      - name: Mount BTRFS for podman storage
+        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
+        uses: ublue-os/container-storage-action@main
+        with:
+          target-dir: /var/lib/containers
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
-
       - name: Install just
         uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
 
-- 
cgit v1.2.3


From be56c887f55c7a342657c5bd3ccf6cace00d4504 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 01:05:10 +0800
Subject: Free disk space on standard runners

---
 .github/workflows/build.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0b1a54b..1edbe30 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,11 @@ jobs:
       - name: Show disk space
         run: sudo df -h
 
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
+        with:
+          extra-squeeze: true
+
       - name: Check if /mnt is there
         id: check-mnt
         run: |
@@ -39,16 +44,15 @@ jobs:
             echo "mnt_is_there=0" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Free Disk Space
-        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
-        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
-
       - name: Mount BTRFS for podman storage
         if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
         uses: ublue-os/container-storage-action@main
         with:
           target-dir: /var/lib/containers
 
+      - name: Show available build space
+        run: sudo df -h
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-- 
cgit v1.2.3


From 2fdcf15e7266c3eed21d81497180e0521464020c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Mon, 13 Jul 2026 08:25:32 +0800
Subject: Pass Cosign password to signing step

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1edbe30..e72f937 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -187,6 +187,7 @@ jobs:
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
-- 
cgit v1.2.3


From 5a41b4c5daf60b45105d0dc552c4d46022c92b04 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 14:04:06 +0800
Subject: Integrate Instruments release seed

Download and verify the selected release during image builds.
Bootstrap it once into the first graphical user's XDG directories.
---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e72f937..49d2f81 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -97,6 +97,10 @@ jobs:
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
           OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
+          INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }}
+          INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }}
+          INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
+          INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
           sudo -E $(command -v just) build \
             ${IMAGE_NAME} \
-- 
cgit v1.2.3


From 6913c30a0e63b96c8af6b1de084ed103a73eaf2b Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 18:43:23 +0800
Subject: Fix ACR promotion environment vars

Bind the manual promotion job to the selected GitHub Environment so
environment-scoped ACR variables and secrets are available. Resolve the
image name from the dispatch override first, then IMAGE_NAME, then
image-template.env through just. Pass the Cosign password during
signing.
---
 .github/workflows/promote-acr.yml | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 99a67f8..890962f 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -4,6 +4,11 @@ name: Promote image to ACR
 on:
   workflow_dispatch:
     inputs:
+      environment:
+        description: "GitHub Environment containing ACR vars/secrets"
+        required: true
+        default: testing
+        type: environment
       source_tag:
         description: "Existing GHCR tag to promote"
         required: true
@@ -13,7 +18,7 @@ on:
         required: false
         type: string
       image_name:
-        description: "Image name override; defaults to image-template.env"
+        description: "Image name override; defaults to IMAGE_NAME var, then image-template.env"
         required: false
         type: string
 
@@ -21,13 +26,14 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
+  group: ${{ github.workflow }}-${{ inputs.environment }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
   cancel-in-progress: false
 
 jobs:
   promote_acr:
     name: Promote GHCR image to ACR
     runs-on: ubuntu-24.04
+    environment: ${{ inputs.environment }}
 
     permissions:
       contents: read
@@ -48,18 +54,21 @@ jobs:
       - name: Prepare image variables
         env:
           IMAGE_NAME_INPUT: ${{ inputs.image_name }}
+          IMAGE_NAME_VAR: ${{ vars.IMAGE_NAME }}
           SOURCE_TAG: ${{ inputs.source_tag }}
           TARGET_TAGS_INPUT: ${{ inputs.target_tags }}
         run: |
           set -euo pipefail
 
-          image_name="${IMAGE_NAME_INPUT:-$(just image_name)}"
+          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-$(just image_name)}}"
           target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}"
 
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
-          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
-          echo "SOURCE_TAG=${SOURCE_TAG}" >> "$GITHUB_ENV"
-          echo "TARGET_TAGS=${target_tags}" >> "$GITHUB_ENV"
+          {
+            echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}"
+            echo "IMAGE_NAME=${image_name,,}"
+            echo "SOURCE_TAG=${SOURCE_TAG}"
+            echo "TARGET_TAGS=${target_tags}"
+          } >> "$GITHUB_ENV"
 
       - name: Validate ACR configuration
         env:
@@ -68,14 +77,16 @@ jobs:
           ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
           ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
         run: |
           set -euo pipefail
 
-          : "${ACR_REGISTRY:?Repository variable ACR_REGISTRY is required.}"
-          : "${ACR_NAMESPACE:?Repository variable ACR_NAMESPACE is required.}"
-          : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}"
-          : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}"
-          : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}"
+          : "${ACR_REGISTRY:?Repository or environment variable ACR_REGISTRY is required.}"
+          : "${ACR_NAMESPACE:?Repository or environment variable ACR_NAMESPACE is required.}"
+          : "${ACR_USERNAME:?Repository or environment secret ACR_USERNAME is required.}"
+          : "${ACR_PASSWORD:?Repository or environment secret ACR_PASSWORD is required.}"
+          : "${COSIGN_PRIVATE_KEY:?Repository or environment secret SIGNING_SECRET is required.}"
+          : "${COSIGN_PASSWORD:?Repository or environment secret COSIGN_PASSWORD is required.}"
 
       - name: Login to GitHub Container Registry
         env:
@@ -140,6 +151,7 @@ jobs:
           ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.promote.outputs.digest }}
         run: |
           set -euo pipefail
-- 
cgit v1.2.3


From e77483dcb6570a003001ea1c81a962c9f45fda74 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 15 Jul 2026 18:50:32 +0800
Subject: Remove ACR environment input

Keep ACR promotion compatible with repositories that do not configure
GitHub Environments by using repository-level variables and secrets.
---
 .github/workflows/promote-acr.yml | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 890962f..6b00e3b 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -4,11 +4,6 @@ name: Promote image to ACR
 on:
   workflow_dispatch:
     inputs:
-      environment:
-        description: "GitHub Environment containing ACR vars/secrets"
-        required: true
-        default: testing
-        type: environment
       source_tag:
         description: "Existing GHCR tag to promote"
         required: true
@@ -26,14 +21,13 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.environment }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
+  group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
   cancel-in-progress: false
 
 jobs:
   promote_acr:
     name: Promote GHCR image to ACR
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.environment }}
 
     permissions:
       contents: read
@@ -81,12 +75,12 @@ jobs:
         run: |
           set -euo pipefail
 
-          : "${ACR_REGISTRY:?Repository or environment variable ACR_REGISTRY is required.}"
-          : "${ACR_NAMESPACE:?Repository or environment variable ACR_NAMESPACE is required.}"
-          : "${ACR_USERNAME:?Repository or environment secret ACR_USERNAME is required.}"
-          : "${ACR_PASSWORD:?Repository or environment secret ACR_PASSWORD is required.}"
-          : "${COSIGN_PRIVATE_KEY:?Repository or environment secret SIGNING_SECRET is required.}"
-          : "${COSIGN_PASSWORD:?Repository or environment secret COSIGN_PASSWORD is required.}"
+          : "${ACR_REGISTRY:?Repository variable ACR_REGISTRY is required.}"
+          : "${ACR_NAMESPACE:?Repository variable ACR_NAMESPACE is required.}"
+          : "${ACR_USERNAME:?Repository secret ACR_USERNAME is required.}"
+          : "${ACR_PASSWORD:?Repository secret ACR_PASSWORD is required.}"
+          : "${COSIGN_PRIVATE_KEY:?Repository secret SIGNING_SECRET is required.}"
+          : "${COSIGN_PASSWORD:?Repository secret COSIGN_PASSWORD is required.}"
 
       - name: Login to GitHub Container Registry
         env:
-- 
cgit v1.2.3


From 04b8dcbbc3d5707f488c9b67ba96ce88ccd15181 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 17 Jul 2026 06:56:56 +0800
Subject: Fix live installer ISO build

Build the live installer from the requested local AeroCore image, use a
separate Fedora live base, pass the payload through rootful container
storage, and write reproducible checksum entries without host paths.
---
 .github/workflows/build-live-installer.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 870699e..b5fedb3 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -13,6 +13,7 @@ on:
     branches:
       - main
     paths:
+      - "Justfile"
       - "installer/**"
       - "just_scripts/build-live-installer.sh"
       - ".github/workflows/build-live-installer.yml"
@@ -34,7 +35,7 @@ jobs:
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
-      BASE_IMAGE: ghcr.io/ublue-os/bazzite:stable
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "44"
 
     steps:
@@ -76,11 +77,21 @@ jobs:
 
       - name: Build live installer payload
         run: |
+          mkdir -p output
+          sudo podman tag \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            localhost/aerocore-live-payload:latest
+          sudo podman save \
+            --format oci-archive \
+            --output output/install-payload.oci \
+            localhost/aerocore-live-payload:latest
+
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
-            --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-live-payload:latest \
             --file installer/Containerfile \
             .
-- 
cgit v1.2.3


From 96aac6e87ac41b27383d1839687f391925080007 Mon Sep 17 00:00:00 2001
From: Tranch Xiao <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 01:15:45 +0800
Subject: ci: Disable daily scheduled build

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56f8da9..95f2f1c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,8 +4,8 @@ on:
   pull_request:
     branches:
       - main
-  schedule:
-    - cron: '05 10 * * *'  # 10:05am UTC everyday
+  #schedule:
+  #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
 
 env:
-- 
cgit v1.2.3


From fc07365cdc27a2e78a57cdf673fa19a99d7cf57f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 08:40:43 +0800
Subject: Constrain builds to bazzite-deck

Keep the live installer Fedora version aligned with the deck base image and fail early if BASE_IMAGE is overridden to a non-deck variant.
---
 .github/workflows/build-live-installer.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index b5fedb3..98441df 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -35,8 +35,9 @@ jobs:
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "44"
+      FEDORA_VERSION: "43"
 
     steps:
       - name: Maximize build space
-- 
cgit v1.2.3


From 1f05e893325979375ab53c4bd6999af826bc62d8 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:08:54 +0800
Subject: ci: pin Titanoboa live installer action

---
 .github/workflows/build-live-installer.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 98441df..059c3e9 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -99,7 +99,7 @@ jobs:
 
       - name: Build ISO
         id: build
-        uses: Zeglius/titanoboa@revamp-pr
+        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
           arch: x86_64
           image_name: aerocore-live-payload
-- 
cgit v1.2.3


From dd3cd9c9d8d8830bc1d05267c16c30de8758474d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:21:37 +0800
Subject: ci: fix workflow inputs and paths

---
 .github/workflows/build-disk.yml | 7 +++----
 .github/workflows/build.yml      | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 02ef44a..869277d 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -19,10 +19,9 @@ on:
     branches:
       - main
     paths:
-      - './disk_config/disk.toml'
-      - './disk_config/iso-kde.toml'
-      - './disk_config/iso-gnome.toml'
-      - './.github/workflows/build-disk.yml'
+      - 'disk_config/disk.toml'
+      - 'disk_config/iso-kde.toml'
+      - '.github/workflows/build-disk.yml'
 
 env:
   IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 49d2f81..3182eff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-- 
cgit v1.2.3


From 2794877cbd7d5480a66da1592bc000c1eec8b620 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:31:49 +0800
Subject: ci: add live installer PR validation

---
 .github/workflows/validate-live-installer.yml | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/validate-live-installer.yml

(limited to '.github')

diff --git a/.github/workflows/validate-live-installer.yml b/.github/workflows/validate-live-installer.yml
new file mode 100644
index 0000000..3d35a5d
--- /dev/null
+++ b/.github/workflows/validate-live-installer.yml
@@ -0,0 +1,40 @@
+name: Validate live installer
+
+on:
+  pull_request:
+    paths:
+      - "Justfile"
+      - "installer/**"
+      - "just_scripts/build-live-installer.sh"
+      - ".github/workflows/build-live-installer.yml"
+      - ".github/workflows/validate-live-installer.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-live-installer:
+    name: Validate live installer inputs
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Validate workflow YAML
+        run: |
+          ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
+
+      - name: Validate Justfile formatting
+        run: |
+          just --unstable --fmt --check -f Justfile
+
+      - name: Validate build scripts
+        run: |
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+            bash -n "$script"
+          done
+          bash -n system_files/usr/libexec/aerocore-instruments-setup
-- 
cgit v1.2.3


From 5198f735cf5a8c9e8390c2fa2156252c79be72ab Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 16:40:16 +0800
Subject: ci: quote workflow shell variables

---
 .github/workflows/build-disk.yml | 14 ++++++++------
 .github/workflows/build.yml      | 35 ++++++++++++++++++-----------------
 2 files changed, 26 insertions(+), 23 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index 869277d..cef58be 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -54,11 +54,13 @@ jobs:
           # Concatenate the types with a hyphen
           DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-')
           # Lowercase the image uri
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
-          echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV}
-          echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV}
-          echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV}
+          {
+            echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}"
+            echo "IMAGE_NAME=${IMAGE_NAME,,}"
+            echo "DISK_TYPE=${DISK_TYPE}"
+            echo "USER_UID=${USER_UID}"
+            echo "USER_GID=${USER_GID}"
+          } >> "$GITHUB_ENV"
 
       - name: Install dependencies
         if: inputs.platform == 'arm64'
@@ -112,4 +114,4 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y rclone
-          rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}
+          rclone copy "$SOURCE_DIR" "S3:${{ secrets.S3_BUCKET_NAME }}"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3182eff..a4661fb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -69,7 +69,7 @@ jobs:
         run: |
           IMAGE_NAME=$(just image_name)
 
-          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
 
       - name: Default Tag
         id: gen-default-tag
@@ -80,13 +80,13 @@ jobs:
             DEFAULT_TAG=$(just generate-default-tag)
           fi
 
-          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
+          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV"
 
       - name: Prepare environment
         run: |
           # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
 
       # This actually builds the container image
       - name: Build Image
@@ -102,17 +102,17 @@ jobs:
           INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
           INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
-          sudo -E $(command -v just) build \
-            ${IMAGE_NAME} \
-            ${DEFAULT_TAG}
+          sudo -E "$(command -v just)" build \
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}"
 
       # This is optional, this provides smaller delta updates
       - name: Rechunk with rpm-ostree
         id: rechunk
         run: |
-          sudo -E $(command -v just) ostree-rechunk \
-            ${IMAGE_NAME} \
-            ${DEFAULT_TAG}
+          sudo -E "$(command -v just)" ostree-rechunk \
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}"
 
       # If you are feeling adventurous, use the new distro agnostic rechunker
       # https://github.com/coreos/chunkah
@@ -131,20 +131,20 @@ jobs:
             alias_tags="testing ${DEFAULT_TAG}"
           else
             alias_tags="$(just generate-build-tags \
-                          ${IMAGE_NAME} \
-                          ${DEFAULT_TAG})"
+            "${IMAGE_NAME}" \
+            "${DEFAULT_TAG}")"
           fi
 
           echo "Tags for this Action..."
           echo "${alias_tags}"
-          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
+          echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT"
 
       - name: Tag Image
         id: tag-images
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
         run: |
-          sudo -E $(command -v just) tag-images \
+          sudo -E "$(command -v just)" tag-images \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
@@ -167,12 +167,13 @@ jobs:
         run: |
           set -euox pipefail
           for tag in ${ALIAS_TAGS}; do
-            sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
+            sudo -E podman push --digestfile=/tmp/digestfile \
+              "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}"
           done
 
           digest=$(< /tmp/digestfile)
 
-          echo "digest=${digest}" >> $GITHUB_OUTPUT
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
@@ -194,4 +195,4 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}"
-- 
cgit v1.2.3


From 50ba1fad553bc4a0c01f4e600e190a10c92fb944 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 22 Jul 2026 17:47:04 +0800
Subject: ci: order image and installer builds

---
 .github/workflows/build-live-installer.yml | 12 ++++++------
 .github/workflows/build.yml                |  3 +++
 2 files changed, 9 insertions(+), 6 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 059c3e9..5993b2f 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -9,14 +9,13 @@ on:
         default: latest
         type: string
   workflow_call:
-  push:
+  workflow_run:
+    workflows:
+      - Build container image
+    types:
+      - completed
     branches:
       - main
-    paths:
-      - "Justfile"
-      - "installer/**"
-      - "just_scripts/build-live-installer.sh"
-      - ".github/workflows/build-live-installer.yml"
 
 permissions: {}
 
@@ -27,6 +26,7 @@ concurrency:
 jobs:
   build-live-installer:
     name: Build KDE live installer
+    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: ubuntu-24.04
     permissions:
       contents: read
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a4661fb..221c735 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,9 @@
 ---
 name: Build container image
 on:
+  push:
+    branches:
+      - main
   pull_request:
     branches:
       - main
-- 
cgit v1.2.3


From 75919c6b2c8d227c5356db825d16e2ceded67575 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 23 Jul 2026 01:06:50 +0800
Subject: ci: update live installer action inputs

---
 .github/workflows/build-live-installer.yml | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 5993b2f..c685fd7 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -101,28 +101,20 @@ jobs:
         id: build
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
-          arch: x86_64
-          image_name: aerocore-live-payload
-          image_repo: localhost
-          variant: Kinoite
-          version: ${{ env.FEDORA_VERSION }}
-          image_tag: latest
-          iso_name: aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
-          enable_cache_dnf: "false"
-          enable_cache_skopeo: "false"
-          enable_flatpak_dependencies: "false"
-          additional_templates: /github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl
+          image-ref: localhost/aerocore-live-payload:latest
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
 
       - name: Display checksum
         run: |
-          cat "${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM"
+          iso_path="output/aerocore-os-${IMAGE_TAG}-amd64.iso"
+          sha256sum "${iso_path}" | tee "${iso_path}-CHECKSUM"
 
       - name: Upload ISO artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: aerocore-os-live-installer-${{ env.IMAGE_TAG }}
           path: |
-            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}
-            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM
+            output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
+            output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso-CHECKSUM
           if-no-files-found: error
           compression-level: 0
-- 
cgit v1.2.3


From f114b3ff7f1924cb84d398d7c1054d930e74c043 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 23 Jul 2026 14:30:04 +0800
Subject: feat: Adjust live installer build for consistent ISO naming

Introduce an `ISO_FILE_TAG` environment variable to ensure consistent ISO filenames.
This variable is set to 'testing' when on the testing branch, or uses the provided
`image_tag` otherwise. This change affects the ISO destination path, checksum file
generation, artifact upload naming, and the R2 upload.

Additionally, prepare ISO and checksum files into a dedicated upload directory
before uploading artifacts and to R2. This simplifies the artifact handling.
---
 .github/workflows/build-live-installer.yml | 47 +++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 7 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index c685fd7..4b8cb62 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -35,6 +35,7 @@ jobs:
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "43"
@@ -102,19 +103,51 @@ jobs:
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
           image-ref: localhost/aerocore-live-payload:latest
-          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
 
       - name: Display checksum
         run: |
-          iso_path="output/aerocore-os-${IMAGE_TAG}-amd64.iso"
-          sha256sum "${iso_path}" | tee "${iso_path}-CHECKSUM"
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          checksum_path="${iso_path}-CHECKSUM"
+          sha256sum "${iso_path}" | tee "${checksum_path}"
+          {
+            echo "# ISO Checksum (SHA256)"
+            echo
+            echo "ISO: $(basename "${iso_path}")"
+            echo
+            echo '```'
+            cat "${checksum_path}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Prepare ISO upload files
+        run: |
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          upload_dir="output/upload"
+          mkdir -p "${upload_dir}"
+          mv "${iso_path}" "${upload_dir}/"
+          mv "${iso_path}-CHECKSUM" "${upload_dir}/"
 
       - name: Upload ISO artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: aerocore-os-live-installer-${{ env.IMAGE_TAG }}
-          path: |
-            output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
-            output/aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso-CHECKSUM
+          name: aerocore-os-live-installer-${{ env.ISO_FILE_TAG }}
+          path: output/upload
           if-no-files-found: error
           compression-level: 0
+
+      - name: Upload ISO and checksum to R2
+        if: github.ref_name == 'testing' || github.ref_name == 'main'
+        shell: bash
+        env:
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_REGION: auto
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          SOURCE_DIR: ${{ github.workspace }}/output/upload
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy "$SOURCE_DIR" R2:bazzite
-- 
cgit v1.2.3


From 3c86b459d129f3303d8fc9cf236f79d1536d120d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 23 Jul 2026 16:47:13 +0800
Subject: Fix live installer ISO path

Normalize the path reported by Titanoboa before checksum and upload
steps so artifacts misplaced under the action directory remain usable.

Also enable pipefail so checksum failures are not hidden by tee.

Verified with YAML parsing, git diff checks, and local path simulation.
---
 .github/workflows/build-live-installer.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 4b8cb62..1f57edd 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -105,8 +105,25 @@ jobs:
           image-ref: localhost/aerocore-live-payload:latest
           iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
 
+      - name: Normalize ISO output path
+        shell: bash
+        env:
+          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+        run: |
+          if [[ ! -f "${GENERATED_ISO}" ]]; then
+            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
+            exit 1
+          fi
+          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
+            mkdir -p "$(dirname "${EXPECTED_ISO}")"
+            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
+          fi
+
       - name: Display checksum
+        shell: bash
         run: |
+          set -o pipefail
           iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
           checksum_path="${iso_path}-CHECKSUM"
           sha256sum "${iso_path}" | tee "${checksum_path}"
-- 
cgit v1.2.3


From 782243eda6b3a5279537a40f57755daff5d03254 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 23 Jul 2026 18:11:26 +0800
Subject: test: update build-live-installer.yml to prepare and upload ISO

Refactor the ISO upload process in the build workflow.
Move the ISO file to a dedicated upload directory and recalculate the checksum there.
Upload only the checksum as a job artifact for the 'testing' branch.
Adjust the R2 upload condition to trigger only on workflow dispatch for the 'main' branch.

Co-authored-by: llm-git <llm-git@ttll.de>
---
 .github/workflows/build-live-installer.yml | 34 +++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 12 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
index 1f57edd..0965c33 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-live-installer.yml
@@ -137,24 +137,34 @@ jobs:
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
 
-      - name: Prepare ISO upload files
+      - name: Move ISO to upload directory
+        id: upload-directory
+        shell: bash
         run: |
-          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
-          upload_dir="output/upload"
-          mkdir -p "${upload_dir}"
-          mv "${iso_path}" "${upload_dir}/"
-          mv "${iso_path}-CHECKSUM" "${upload_dir}/"
-
-      - name: Upload ISO artifact
+          iso_upload_dir="${{ github.workspace }}/output/upload"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_name="$(basename "${iso_path}")"
+
+          mkdir -p "${iso_upload_dir}"
+          mv "${iso_path}" "${iso_upload_dir}/"
+          (
+            cd "${iso_upload_dir}"
+            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
+          )
+          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload ISO checksum to Job Artifacts
+        if: github.ref_name == 'testing'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: aerocore-os-live-installer-${{ env.ISO_FILE_TAG }}
-          path: output/upload
+          name: aerocore-os-live-installer-${{ env.ISO_FILE_TAG }}-checksum
+          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
           if-no-files-found: error
+          retention-days: 1
           compression-level: 0
 
       - name: Upload ISO and checksum to R2
-        if: github.ref_name == 'testing' || github.ref_name == 'main'
+        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
         shell: bash
         env:
           RCLONE_CONFIG_R2_TYPE: s3
@@ -163,7 +173,7 @@ jobs:
           RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           RCLONE_CONFIG_R2_REGION: auto
           RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          SOURCE_DIR: ${{ github.workspace }}/output/upload
+          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
         run: |
           sudo apt-get update
           sudo apt-get install -y rclone
-- 
cgit v1.2.3


From 4dd41315acaa07112864a3833dfb7775d9b44274 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 24 Jul 2026 17:29:04 +0800
Subject: Rename live installer to installer ISO

Use installer ISO terminology across Just, workflows, scripts, docs, and
image payloads while preserving compatibility aliases for existing
commands.
---
 .github/workflows/build-installer-iso.yml     | 180 ++++++++++++++++++++++++++
 .github/workflows/build-live-installer.yml    | 180 --------------------------
 .github/workflows/validate-installer-iso.yml  |  40 ++++++
 .github/workflows/validate-live-installer.yml |  40 ------
 4 files changed, 220 insertions(+), 220 deletions(-)
 create mode 100644 .github/workflows/build-installer-iso.yml
 delete mode 100644 .github/workflows/build-live-installer.yml
 create mode 100644 .github/workflows/validate-installer-iso.yml
 delete mode 100644 .github/workflows/validate-live-installer.yml

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
new file mode 100644
index 0000000..cfa7b80
--- /dev/null
+++ b/.github/workflows/build-installer-iso.yml
@@ -0,0 +1,180 @@
+name: Build installer ISO
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "AeroCore image tag to install"
+        required: false
+        default: latest
+        type: string
+  workflow_call:
+  workflow_run:
+    workflows:
+      - Build container image
+    types:
+      - completed
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-installer-iso:
+    name: Build KDE installer ISO
+    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
+      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
+      FEDORA_VERSION: "43"
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Mount container storage BTRFS loopback
+        run: |
+          sudo truncate -s 70G /mnt/podman-storage.img
+          sudo mkfs.btrfs -f /mnt/podman-storage.img
+          sudo podman system reset --force
+          sudo systemctl stop podman.service
+          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
+          sudo systemctl start podman.service
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Prepare image references
+        run: |
+          image_name="$(just image_name)"
+          image_registry="${IMAGE_REGISTRY,,}"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        run: |
+          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
+            --username '${{ github.actor }}' --password-stdin
+
+      - name: Pull AeroCore install image
+        run: |
+          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+
+      - name: Build installer ISO payload
+        run: |
+          mkdir -p output
+          sudo podman tag \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            localhost/aerocore-installer-payload:latest
+          sudo podman save \
+            --format oci-archive \
+            --output output/install-payload.oci \
+            localhost/aerocore-installer-payload:latest
+
+          sudo podman build \
+            --cap-add sys_admin \
+            --security-opt label=disable \
+            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --tag localhost/aerocore-installer-payload:latest \
+            --file installer/Containerfile \
+            .
+
+      - name: Build ISO
+        id: build
+        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
+        with:
+          image-ref: localhost/aerocore-installer-payload:latest
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+
+      - name: Normalize ISO output path
+        shell: bash
+        env:
+          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+        run: |
+          if [[ ! -f "${GENERATED_ISO}" ]]; then
+            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
+            exit 1
+          fi
+          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
+            mkdir -p "$(dirname "${EXPECTED_ISO}")"
+            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
+          fi
+
+      - name: Display checksum
+        shell: bash
+        run: |
+          set -o pipefail
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          checksum_path="${iso_path}-CHECKSUM"
+          sha256sum "${iso_path}" | tee "${checksum_path}"
+          {
+            echo "# ISO Checksum (SHA256)"
+            echo
+            echo "ISO: $(basename "${iso_path}")"
+            echo
+            echo '```'
+            cat "${checksum_path}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Move ISO to upload directory
+        id: upload-directory
+        shell: bash
+        run: |
+          iso_upload_dir="${{ github.workspace }}/output/upload"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_name="$(basename "${iso_path}")"
+
+          mkdir -p "${iso_upload_dir}"
+          mv "${iso_path}" "${iso_upload_dir}/"
+          (
+            cd "${iso_upload_dir}"
+            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
+          )
+          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload ISO checksum to Job Artifacts
+        if: github.ref_name == 'testing'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
+          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Upload ISO and checksum to R2
+        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        shell: bash
+        env:
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_REGION: auto
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy "$SOURCE_DIR" R2:bazzite
diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-live-installer.yml
deleted file mode 100644
index 0965c33..0000000
--- a/.github/workflows/build-live-installer.yml
+++ /dev/null
@@ -1,180 +0,0 @@
-name: Build live installer
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_tag:
-        description: "AeroCore image tag to install"
-        required: false
-        default: latest
-        type: string
-  workflow_call:
-  workflow_run:
-    workflows:
-      - Build container image
-    types:
-      - completed
-    branches:
-      - main
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  build-live-installer:
-    name: Build KDE live installer
-    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: read
-
-    env:
-      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
-      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
-      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
-      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
-
-    steps:
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
-        with:
-          remove-codeql: true
-
-      - name: Mount container storage BTRFS loopback
-        run: |
-          sudo truncate -s 70G /mnt/podman-storage.img
-          sudo mkfs.btrfs -f /mnt/podman-storage.img
-          sudo podman system reset --force
-          sudo systemctl stop podman.service
-          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
-          sudo systemctl start podman.service
-
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
-      - name: Prepare image references
-        run: |
-          image_name="$(just image_name)"
-          image_registry="${IMAGE_REGISTRY,,}"
-          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
-          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
-
-      - name: Login to GHCR
-        run: |
-          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
-            --username '${{ github.actor }}' --password-stdin
-
-      - name: Pull AeroCore install image
-        run: |
-          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
-
-      - name: Build live installer payload
-        run: |
-          mkdir -p output
-          sudo podman tag \
-            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-live-payload:latest
-          sudo podman save \
-            --format oci-archive \
-            --output output/install-payload.oci \
-            localhost/aerocore-live-payload:latest
-
-          sudo podman build \
-            --cap-add sys_admin \
-            --security-opt label=disable \
-            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
-            --tag localhost/aerocore-live-payload:latest \
-            --file installer/Containerfile \
-            .
-
-      - name: Build ISO
-        id: build
-        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
-        with:
-          image-ref: localhost/aerocore-live-payload:latest
-          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
-
-      - name: Normalize ISO output path
-        shell: bash
-        env:
-          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
-          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
-        run: |
-          if [[ ! -f "${GENERATED_ISO}" ]]; then
-            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
-            exit 1
-          fi
-          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
-            mkdir -p "$(dirname "${EXPECTED_ISO}")"
-            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
-          fi
-
-      - name: Display checksum
-        shell: bash
-        run: |
-          set -o pipefail
-          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
-          checksum_path="${iso_path}-CHECKSUM"
-          sha256sum "${iso_path}" | tee "${checksum_path}"
-          {
-            echo "# ISO Checksum (SHA256)"
-            echo
-            echo "ISO: $(basename "${iso_path}")"
-            echo
-            echo '```'
-            cat "${checksum_path}"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Move ISO to upload directory
-        id: upload-directory
-        shell: bash
-        run: |
-          iso_upload_dir="${{ github.workspace }}/output/upload"
-          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
-          iso_name="$(basename "${iso_path}")"
-
-          mkdir -p "${iso_upload_dir}"
-          mv "${iso_path}" "${iso_upload_dir}/"
-          (
-            cd "${iso_upload_dir}"
-            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
-          )
-          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
-
-      - name: Upload ISO checksum to Job Artifacts
-        if: github.ref_name == 'testing'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: aerocore-os-live-installer-${{ env.ISO_FILE_TAG }}-checksum
-          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-
-      - name: Upload ISO and checksum to R2
-        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
-        shell: bash
-        env:
-          RCLONE_CONFIG_R2_TYPE: s3
-          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
-          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          RCLONE_CONFIG_R2_REGION: auto
-          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y rclone
-          rclone copy "$SOURCE_DIR" R2:bazzite
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
new file mode 100644
index 0000000..37f5496
--- /dev/null
+++ b/.github/workflows/validate-installer-iso.yml
@@ -0,0 +1,40 @@
+name: Validate installer ISO
+
+on:
+  pull_request:
+    paths:
+      - "Justfile"
+      - "installer/**"
+      - "just_scripts/build-installer-iso.sh"
+      - ".github/workflows/build-installer-iso.yml"
+      - ".github/workflows/validate-installer-iso.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-installer-iso:
+    name: Validate installer ISO inputs
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Validate workflow YAML
+        run: |
+          ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
+
+      - name: Validate Justfile formatting
+        run: |
+          just --unstable --fmt --check -f Justfile
+
+      - name: Validate build scripts
+        run: |
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+            bash -n "$script"
+          done
+          bash -n system_files/usr/libexec/aerocore-instruments-setup
diff --git a/.github/workflows/validate-live-installer.yml b/.github/workflows/validate-live-installer.yml
deleted file mode 100644
index 3d35a5d..0000000
--- a/.github/workflows/validate-live-installer.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Validate live installer
-
-on:
-  pull_request:
-    paths:
-      - "Justfile"
-      - "installer/**"
-      - "just_scripts/build-live-installer.sh"
-      - ".github/workflows/build-live-installer.yml"
-      - ".github/workflows/validate-live-installer.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  validate-live-installer:
-    name: Validate live installer inputs
-    runs-on: ubuntu-24.04
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
-      - name: Validate workflow YAML
-        run: |
-          ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
-
-      - name: Validate Justfile formatting
-        run: |
-          just --unstable --fmt --check -f Justfile
-
-      - name: Validate build scripts
-        run: |
-          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
-            bash -n "$script"
-          done
-          bash -n system_files/usr/libexec/aerocore-instruments-setup
-- 
cgit v1.2.3


From 9cdb3a038c2d29eefd95c4f5a274881a67e061c9 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 07:39:18 +0800
Subject: Disable automatic installer ISO builds

Remove the workflow_run trigger from the installer ISO workflow while ISO construction is being tested manually. Keep workflow_dispatch and workflow_call available.
---
 .github/workflows/build-installer-iso.yml | 8 --------
 1 file changed, 8 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index cfa7b80..bae0458 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -9,13 +9,6 @@ on:
         default: latest
         type: string
   workflow_call:
-  workflow_run:
-    workflows:
-      - Build container image
-    types:
-      - completed
-    branches:
-      - main
 
 permissions: {}
 
@@ -26,7 +19,6 @@ concurrency:
 jobs:
   build-installer-iso:
     name: Build KDE installer ISO
-    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: ubuntu-24.04
     permissions:
       contents: read
-- 
cgit v1.2.3


From db108b8b23c86ba39a2ba289fc6129a6325f045f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 09:57:45 +0800
Subject: Normalize installer payload and host naming

Use a formal local installer image tag and set aerocore-os as the
default hostname in both the live image and installed target system.
---
 .github/workflows/build-installer-iso.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index bae0458..7650ebb 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -74,7 +74,7 @@ jobs:
           mkdir -p output
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-installer-payload:latest
+            localhost/aerocore-os-installer:latest
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
@@ -86,7 +86,7 @@ jobs:
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
-            --tag localhost/aerocore-installer-payload:latest \
+            --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
 
@@ -94,7 +94,7 @@ jobs:
         id: build
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
-          image-ref: localhost/aerocore-installer-payload:latest
+          image-ref: localhost/aerocore-os-installer:latest
           iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
 
       - name: Normalize ISO output path
-- 
cgit v1.2.3


From ce39b6bacb3fa9e7ec2770798649f4f3a1bd6678 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 10:13:57 +0800
Subject: Fix stale installer payload references

---
 .github/workflows/build-installer-iso.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 7650ebb..f7897b9 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -78,13 +78,13 @@ jobs:
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-installer-payload:latest
+            localhost/aerocore-os-installer:latest
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
-- 
cgit v1.2.3


From 0ebf76e160c1e45d537e24d145fed47a38d8d99d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 22:49:06 +0800
Subject: Route installer updates through OSTREE_IMAGE_REF

Use the configured ref for ISO boot origins and derive GHCR fallbacks
from the current repository instead of hardcoding the image path.
---
 .github/workflows/build-installer-iso.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index f7897b9..a6348aa 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -31,6 +31,7 @@ jobs:
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "43"
+      OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
       - name: Maximize build space
@@ -72,19 +73,23 @@ jobs:
       - name: Build installer ISO payload
         run: |
           mkdir -p output
+          ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://${IMAGE_REGISTRY}/${IMAGE_NAME}}"
+          install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
+          install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
+          install_image_ref="${install_image_ref#docker://}"
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
-- 
cgit v1.2.3


From 05c9b9bd017e8e20b70bd791e1f04cabd6664cd4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 23:28:23 +0800
Subject: Add branch-aware versioned image tags

Generate Fedora/date version tags and publish stable or testing aliases
from the corresponding Git branch.
---
 .github/workflows/build.yml | 58 ++++++++++++++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 22 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 221c735..6a59b2a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,11 +4,13 @@ on:
   push:
     branches:
       - main
+      - testing
   pull_request:
     branches:
       - main
-  schedule:
-    - cron: '05 10 * * *'  # 10:05am UTC everyday
+      - testing
+  #schedule:
+  #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
 
 env:
@@ -74,16 +76,36 @@ jobs:
 
           echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
 
-      - name: Default Tag
-        id: gen-default-tag
+      - name: Generate Version and Tags
+        id: gen-version
+        env:
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
-            DEFAULT_TAG="testing-$(date -u +%Y%m%d)"
+          set -euo pipefail
+
+          sudo podman pull "${BASE_IMAGE}"
+          FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
+          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            VERSION_TAG="testing-${VERSION_BASE}"
+            VERSION_PRETTY="Testing (F${VERSION_BASE})"
+            IMAGE_BRANCH="testing"
+            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
-            DEFAULT_TAG=$(just generate-default-tag)
+            VERSION_TAG="${VERSION_BASE}"
+            VERSION_PRETTY="Stable (F${VERSION_BASE})"
+            IMAGE_BRANCH="stable"
+            ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
           fi
 
-          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV"
+          {
+            echo "DEFAULT_TAG=${VERSION_TAG}"
+            echo "IMAGE_BRANCH=${IMAGE_BRANCH}"
+            echo "VERSION_TAG=${VERSION_TAG}"
+            echo "VERSION_PRETTY=${VERSION_PRETTY}"
+            echo "ALIAS_TAGS=${ALIAS_TAGS}"
+          } >> "$GITHUB_ENV"
 
       - name: Prepare environment
         run: |
@@ -130,17 +152,9 @@ jobs:
       - name: Generate Build Tags
         id: gen-build-tags
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${GITHUB_REF_NAME}" == "testing" ]]; then
-            alias_tags="testing ${DEFAULT_TAG}"
-          else
-            alias_tags="$(just generate-build-tags \
-            "${IMAGE_NAME}" \
-            "${DEFAULT_TAG}")"
-          fi
-
           echo "Tags for this Action..."
-          echo "${alias_tags}"
-          echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT"
+          echo "${ALIAS_TAGS}"
+          echo "alias_tags=${ALIAS_TAGS}" >> "$GITHUB_OUTPUT"
 
       - name: Tag Image
         id: tag-images
@@ -156,14 +170,14 @@ jobs:
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -184,14 +198,14 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'))
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-- 
cgit v1.2.3


From 21c68e32f7a8d77876ba782016a8063c42167963 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sun, 26 Jul 2026 01:23:31 +0800
Subject: Make stable the default image channel

Keep latest as a main-branch alias while using Fedora/date versions for
image metadata and release tags.
---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6a59b2a..97bfd91 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -88,11 +88,13 @@ jobs:
           VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
 
           if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            DEFAULT_TAG="testing"
             VERSION_TAG="testing-${VERSION_BASE}"
             VERSION_PRETTY="Testing (F${VERSION_BASE})"
             IMAGE_BRANCH="testing"
             ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
+            DEFAULT_TAG="stable"
             VERSION_TAG="${VERSION_BASE}"
             VERSION_PRETTY="Stable (F${VERSION_BASE})"
             IMAGE_BRANCH="stable"
@@ -100,7 +102,7 @@ jobs:
           fi
 
           {
-            echo "DEFAULT_TAG=${VERSION_TAG}"
+            echo "DEFAULT_TAG=${DEFAULT_TAG}"
             echo "IMAGE_BRANCH=${IMAGE_BRANCH}"
             echo "VERSION_TAG=${VERSION_TAG}"
             echo "VERSION_PRETTY=${VERSION_PRETTY}"
-- 
cgit v1.2.3


From 02f76b85f9ebcb198184599a6b18f5c885280a43 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sun, 26 Jul 2026 01:32:34 +0800
Subject: Run lightweight checks for pull requests

---
 .github/workflows/build.yml                  |  4 ----
 .github/workflows/validate-installer-iso.yml | 18 +++++++++---------
 2 files changed, 9 insertions(+), 13 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 97bfd91..b9d12cf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,10 +5,6 @@ on:
     branches:
       - main
       - testing
-  pull_request:
-    branches:
-      - main
-      - testing
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 37f5496..131ad5b 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -1,20 +1,17 @@
-name: Validate installer ISO
+name: Validate pull request
 
 on:
   pull_request:
-    paths:
-      - "Justfile"
-      - "installer/**"
-      - "just_scripts/build-installer-iso.sh"
-      - ".github/workflows/build-installer-iso.yml"
-      - ".github/workflows/validate-installer-iso.yml"
+    branches:
+      - main
+      - testing
 
 permissions:
   contents: read
 
 jobs:
-  validate-installer-iso:
-    name: Validate installer ISO inputs
+  validate:
+    name: Run lightweight checks
     runs-on: ubuntu-24.04
 
     steps:
@@ -28,6 +25,9 @@ jobs:
         run: |
           ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'
 
+      - name: Validate Just syntax
+        run: just check
+
       - name: Validate Justfile formatting
         run: |
           just --unstable --fmt --check -f Justfile
-- 
cgit v1.2.3


From 2d40be3f0106c2768dcec28a3144a959a3592cd7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:58:37 +0000
Subject: chore(deps): bump docker/login-action from 4.4.0 to 4.5.1

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.4.0 to 4.5.1.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...abd2ef45e78c5afb21d64d4ca52ee8550d9572c7)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b9d12cf..3c8cc06 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -167,7 +167,7 @@ jobs:
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From 301945ffb4db538ff25cece94a66acf80223340a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:28:49 +0800
Subject: Allow live user to launch installer

Authorize only the local active liveuser session for Anaconda's specific
polkit action, avoiding the transient password prompt.

Validate installer polkit rule syntax in the pull request workflow.
---
 .github/workflows/validate-installer-iso.yml | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 131ad5b..391afd8 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -38,3 +38,9 @@ jobs:
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+
+      - name: Validate installer polkit rules
+        run: |
+          for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
+            node --check < "$rule"
+          done
-- 
cgit v1.2.3


From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 08:23:02 +0800
Subject: Fix installer update origin

Rewrite installed bootc origins to the configured signed registry
reference.
---
 .github/workflows/build-installer-iso.yml | 2 ++
 1 file changed, 2 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index a6348aa..143eafc 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -91,6 +91,8 @@ jobs:
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --build-arg "INSTALL_IMAGE_TAG=${IMAGE_TAG}" \
+            --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
-- 
cgit v1.2.3


From d8983c361705874558a20328ce3355852208c178 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 17:05:41 +0800
Subject: Fix weak password crash in Live installer

Restore the Cockpit force-password behavior embedded in Fedora 43's
Anaconda WebUI bundle. Apply strict password policy through conf.d so
weak passwords remain a form validation error instead of aborting the
installer.
---
 .github/workflows/validate-installer-iso.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 391afd8..a93e9cd 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -39,6 +39,17 @@ jobs:
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
 
+      - name: Validate Anaconda WebUI patch
+        run: |
+          fixture="$(mktemp)"
+          trap 'rm -f "${fixture}"' EXIT
+          printf '%s' 'n===0?r(new Error(X2("Password is too weak"))):o(' |
+            gzip -n > "${fixture}"
+          installer/patch-anaconda-webui.sh "${fixture}"
+          gzip -dc "${fixture}" |
+            grep -Fq 'n===0&&!e?r(new Error(X2("Password is too weak"))):o('
+          installer/patch-anaconda-webui.sh "${fixture}"
+
       - name: Validate installer polkit rules
         run: |
           for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
-- 
cgit v1.2.3


From 23fc544482f0fd97cb3fd1870c00fbc3b10636ea Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 19:54:24 +0000
Subject: chore(deps): bump docker/login-action from 4.5.1 to 4.5.2

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.1 to 4.5.2.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7...371161bbe7024a29a25c5e19bfcbc0804fe9ad2c)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3c8cc06..832b9fa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -167,7 +167,7 @@ jobs:
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From 636dcb9dc7af0c23bddeb855da8479eb06df090a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 5 Aug 2026 06:50:26 +0800
Subject: Align ISO workflow live naming

Match Bazzite's live ISO workflow label and output filename while keeping local build and run helpers pointed at the same artifact.
---
 .github/workflows/build-installer-iso.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 143eafc..1352080 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -1,4 +1,4 @@
-name: Build installer ISO
+name: Build Live ISOs
 
 on:
   workflow_dispatch:
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   build-installer-iso:
-    name: Build KDE installer ISO
+    name: Build KDE live ISO
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -102,13 +102,13 @@ jobs:
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
           image-ref: localhost/aerocore-os-installer:latest
-          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso
 
       - name: Normalize ISO output path
         shell: bash
         env:
           GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
-          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso
         run: |
           if [[ ! -f "${GENERATED_ISO}" ]]; then
             echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
@@ -123,7 +123,7 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
           checksum_path="${iso_path}-CHECKSUM"
           sha256sum "${iso_path}" | tee "${checksum_path}"
           {
@@ -141,7 +141,7 @@ jobs:
         shell: bash
         run: |
           iso_upload_dir="${{ github.workspace }}/output/upload"
-          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
           iso_name="$(basename "${iso_path}")"
 
           mkdir -p "${iso_upload_dir}"
-- 
cgit v1.2.3


From f9c48dc987bc8b56bc32c24ce0e0f352db8dd421 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 19:54:44 +0000
Subject: chore(deps): bump docker/login-action from 4.5.2 to 4.6.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.2 to 4.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 832b9fa..0596fab 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -167,7 +167,7 @@ jobs:
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
         with:
           registry: ghcr.io
-- 
cgit v1.2.3


From a66fc38e29a79e92cb73fc26626a482fbfc4ec41 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 20 Aug 2026 07:20:09 +0800
Subject: ci: create GitHub release after image build

---
 .github/workflows/build.yml            | 21 ++++++++++++++
 .github/workflows/generate_release.yml | 51 ++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 .github/workflows/generate_release.yml

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 832b9fa..6ff5963 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,11 @@ on:
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
+    inputs:
+      handwritten:
+        description: "Small changelog about changes in this build"
+        required: false
+        type: string
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
@@ -20,6 +25,8 @@ jobs:
   build_push:
     name: Build and push image
     runs-on: ubuntu-24.04
+    outputs:
+      release_tag: ${{ steps.gen-version.outputs.release_tag }}
 
     permissions:
       contents: read
@@ -105,6 +112,8 @@ jobs:
             echo "ALIAS_TAGS=${ALIAS_TAGS}"
           } >> "$GITHUB_ENV"
 
+          echo "release_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
+
       - name: Prepare environment
         run: |
           # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
@@ -211,3 +220,15 @@ jobs:
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}"
+
+  generate_release:
+    name: Generate Release
+    needs: [build_push]
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: write
+    secrets: inherit
+    uses: ./.github/workflows/generate_release.yml
+    with:
+      release_tag: ${{ needs.build_push.outputs.release_tag }}
+      handwritten: ${{ inputs.handwritten }}
diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
new file mode 100644
index 0000000..ff6ef1e
--- /dev/null
+++ b/.github/workflows/generate_release.yml
@@ -0,0 +1,51 @@
+name: Generate Release
+
+on:
+  workflow_call:
+    inputs:
+      handwritten:
+        required: false
+        type: string
+      release_tag:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      handwritten:
+        description: 'Small changelog about changes in this build'
+        required: false
+        type: string
+      release_tag:
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  generate-release:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 50
+
+      - name: Determine release channel
+        id: target
+        run: |
+          target="${GITHUB_REF_NAME}"
+          [[ "${target}" == "main" ]] && target="stable"
+          echo "target=${target}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate release
+        uses: softprops/action-gh-release@v3.0.2
+        with:
+          tag_name: "${{ inputs.release_tag }}"
+          name: "AeroCore OS ${{ inputs.release_tag }}"
+          body: |
+            ${{ inputs.handwritten }}
+          prerelease: ${{ steps.target.outputs.target != 'stable' }}
+          make_latest: ${{ steps.target.outputs.target == 'stable' }}
-- 
cgit v1.2.3


From 94493f8e11f6c4549258e73d20fa6803ace750c8 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 20 Aug 2026 07:23:32 +0800
Subject: ci: restrict release creation branches

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6ff5963..b42fd60 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -224,7 +224,9 @@ jobs:
   generate_release:
     name: Generate Release
     needs: [build_push]
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' &&
+        (github.ref_name == github.event.repository.default_branch ||
+         github.ref_name == 'testing')
     permissions:
       contents: write
     secrets: inherit
-- 
cgit v1.2.3


From 3fc03faafa274bd4915ea65981cdb4bf03cfd305 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 20 Aug 2026 09:53:57 +0800
Subject: fix(release): Use tag name for release title

The release title should reflect the tag name, not include "AeroCore OS".
This change updates the `generate_release.yml` workflow to use the tag
name directly for the release title.

Co-authored-by: llm-git <llm-git@ttll.de>
---
 .github/workflows/generate_release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index ff6ef1e..f741c83 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -44,7 +44,7 @@ jobs:
         uses: softprops/action-gh-release@v3.0.2
         with:
           tag_name: "${{ inputs.release_tag }}"
-          name: "AeroCore OS ${{ inputs.release_tag }}"
+          name: "${{ inputs.release_tag }}"
           body: |
             ${{ inputs.handwritten }}
           prerelease: ${{ steps.target.outputs.target != 'stable' }}
-- 
cgit v1.2.3


From 80cde14b9c368f58e8f16ad121396ce2f1a50f44 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 21 Aug 2026 08:42:38 +0800
Subject: Adapt to Bazzite 44

Update Deck identity matching for the new upstream scripts and add
fixture coverage for patch idempotence.

Move the live installer base to Fedora 44 while retaining the Fedora 43
Anaconda workaround for explicit legacy builds.
---
 .github/workflows/build-installer-iso.yml    | 4 ++--
 .github/workflows/validate-installer-iso.yml | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 1352080..cebb0a6 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -29,8 +29,8 @@ jobs:
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:44
+      FEDORA_VERSION: "44"
       OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index a93e9cd..5aa6335 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -34,11 +34,14 @@ jobs:
 
       - name: Validate build scripts
         run: |
-          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
 
+      - name: Test Bazzite Deck identity patch
+        run: tests/test-patch-bazzite-deck-identity.sh
+
       - name: Validate Anaconda WebUI patch
         run: |
           fixture="$(mktemp)"
-- 
cgit v1.2.3


From 0a25c4e957f98df15c5e914fd647c3cd6de54456 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 22 Aug 2026 00:08:30 +0800
Subject: Publish testing ISO to R2

---
 .github/workflows/build-installer-iso.yml | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index cebb0a6..9073077 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -152,18 +152,8 @@ jobs:
           )
           echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
 
-      - name: Upload ISO checksum to Job Artifacts
-        if: github.ref_name == 'testing'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
-          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-
       - name: Upload ISO and checksum to R2
-        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        if: github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'testing')
         shell: bash
         env:
           RCLONE_CONFIG_R2_TYPE: s3
-- 
cgit v1.2.3


From 6cb356d3837ef5a9637c2f6df1de7ef85196c280 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 26 Aug 2026 10:41:01 +0800
Subject: fix(installer): configure the GPT auto-root type

Resolve Anaconda target mounts to their backing partition before marking
it as the bootc GPT auto-root partition.
---
 .github/workflows/validate-installer-iso.yml | 3 +++
 1 file changed, 3 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 5aa6335..2151a23 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -42,6 +42,9 @@ jobs:
       - name: Test Bazzite Deck identity patch
         run: tests/test-patch-bazzite-deck-identity.sh
 
+      - name: Test GPT root configuration
+        run: tests/test-configure-target-gpt-root.sh
+
       - name: Validate Anaconda WebUI patch
         run: |
           fixture="$(mktemp)"
-- 
cgit v1.2.3


From 10411b5e32b78f57b6ad995c434cfc4fc390d689 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 26 Aug 2026 10:59:21 +0800
Subject: fix(config): make local dotenv optional

Load a private .env when present, but keep CI configuration in GitHub
runtime variables and retain the tracked template as a guide.
---
 .github/workflows/build-installer-iso.yml    |  6 ++----
 .github/workflows/build.yml                  | 12 ++++++++++++
 .github/workflows/promote-acr.yml            |  8 +++-----
 .github/workflows/validate-installer-iso.yml |  3 +++
 4 files changed, 20 insertions(+), 9 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 9073077..da3ef10 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -26,6 +26,7 @@ jobs:
 
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
@@ -51,12 +52,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
       - name: Prepare image references
         run: |
-          image_name="$(just image_name)"
+          image_name="${IMAGE_NAME,,}"
           image_registry="${IMAGE_REGISTRY,,}"
           echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
           echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 78b6dc6..908a18f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,18 @@ on:
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
+  REPO_ORGANIZATION: ${{ vars.REPO_ORGANIZATION || github.repository_owner }}
+  IMAGE_DESC: ${{ vars.IMAGE_DESC || 'AeroCore customized Bazzite Deck image' }}
+  IMAGE_KEYWORDS: ${{ vars.IMAGE_KEYWORDS || 'bootc,oci,linux,bazzite,steam-deck,aerocore' }}
+  IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }}
+  DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }}
+  BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }}
+  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+  FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
+  HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
+  HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
+  OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
diff --git a/.github/workflows/promote-acr.yml b/.github/workflows/promote-acr.yml
index 6b00e3b..ceb5c0f 100644
--- a/.github/workflows/promote-acr.yml
+++ b/.github/workflows/promote-acr.yml
@@ -13,12 +13,13 @@ on:
         required: false
         type: string
       image_name:
-        description: "Image name override; defaults to IMAGE_NAME var, then image-template.env"
+        description: "Image name override; defaults to the runtime IMAGE_NAME variable"
         required: false
         type: string
 
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.image_name || 'default' }}-${{ inputs.source_tag }}
@@ -37,9 +38,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
-
       - name: Install skopeo
         run: |
           sudo apt-get update
@@ -54,7 +52,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-$(just image_name)}}"
+          image_name="${IMAGE_NAME_INPUT:-${IMAGE_NAME_VAR:-${IMAGE_NAME}}}"
           target_tags="${TARGET_TAGS_INPUT:-$SOURCE_TAG}"
 
           {
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 2151a23..466d2c4 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -32,6 +32,9 @@ jobs:
         run: |
           just --unstable --fmt --check -f Justfile
 
+      - name: Test dotenv precedence
+        run: tests/test-dotenv-precedence.sh
+
       - name: Validate build scripts
         run: |
           for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
-- 
cgit v1.2.3


From 890d6cd86b6bc83b7960c5f54a526af2c13cb755 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 26 Aug 2026 11:17:35 +0800
Subject: Fix CI validation environment defaults

---
 .github/workflows/validate-installer-iso.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 466d2c4..5ddf344 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -13,6 +13,18 @@ jobs:
   validate:
     name: Run lightweight checks
     runs-on: ubuntu-24.04
+    # `just check` parses the whole Justfile, so provide the non-secret
+    # variables required by its top-level metadata declarations. This job
+    # does not build or publish an image; production builds use repository
+    # runtime variables in their respective workflows.
+    env:
+      IMAGE_NAME: aerocore-os
+      REPO_ORGANIZATION: aerocore-io
+      IMAGE_DESC: AeroCore customized Bazzite Deck image
+      IMAGE_KEYWORDS: bootc,oci,linux,bazzite,steam-deck,aerocore
+      IMAGE_LOGO_URL: https://avatars.githubusercontent.com/u/120078124?s=200&v=4
+      DEFAULT_TAG: testing
+      BIB_IMAGE: quay.io/centos-bootc/bootc-image-builder:latest
 
     steps:
       - name: Checkout
-- 
cgit v1.2.3


From cc2a2c630120627d8d89e6fec90fdeeb04ca1a51 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 26 Aug 2026 10:41:53 +0800
Subject: fix(installer): restore interactive account setup

Use an AeroCore Anaconda profile so the live installer keeps the
accounts page that Fedora KDE hides.
---
 .github/workflows/validate-installer-iso.yml | 3 +++
 1 file changed, 3 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 5ddf344..d98964d 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -60,6 +60,9 @@ jobs:
       - name: Test GPT root configuration
         run: tests/test-configure-target-gpt-root.sh
 
+      - name: Validate AeroCore Anaconda profile
+        run: tests/test-aerocore-anaconda-profile.sh
+
       - name: Validate Anaconda WebUI patch
         run: |
           fixture="$(mktemp)"
-- 
cgit v1.2.3


From ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Tue, 25 Aug 2026 10:44:18 +0800
Subject: fix(installer): validate ISO payload metadata

Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.
---
 .github/workflows/build-installer-iso.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index da3ef10..2402dfe 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -68,6 +68,26 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
+      - name: Verify AeroCore install image identity
+        run: |
+          sudo podman run --rm --entrypoint /usr/bin/bash \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
+              system_release_target=$(readlink -f /etc/system-release)
+              if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
+                echo "NUL byte in ${system_release_target}" >&2
+                exit 1
+              fi
+              case "$(<"$system_release_target")" in
+                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                *)
+                  echo "Unexpected system-release: $(<"$system_release_target")" >&2
+                  exit 1
+                  ;;
+              esac
+              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
+                /usr/share/ublue-os/image-info.json >/dev/null
+            '
+
       - name: Build installer ISO payload
         run: |
           mkdir -p output
-- 
cgit v1.2.3


From 8774e3cf7db1f8ad37e659017f6b363f54f9d79d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 27 Aug 2026 04:37:18 +0800
Subject: fix: authenticate Booster release downloads

Mount the CI token as a build secret for release asset requests.
---
 .github/workflows/build.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 908a18f..98f9c15 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -136,6 +136,7 @@ jobs:
       - name: Build Image
         id: build-image
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
@@ -146,7 +147,11 @@ jobs:
           INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
           INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
         run: |
-          sudo -E "$(command -v just)" build \
+          GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token"
+          umask 077
+          printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}"
+          trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT
+          sudo GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
-- 
cgit v1.2.3


From 31ee20282a23dfc1244c003a97a2656afffdd4a2 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 27 Aug 2026 04:49:28 +0800
Subject: fix: preserve build environment under sudo

Keep the CI variables available while passing the GitHub token file.
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 98f9c15..02a6055 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -151,7 +151,7 @@ jobs:
           umask 077
           printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}"
           trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT
-          sudo GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \
+          sudo -E GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
-- 
cgit v1.2.3


From e4608f18bc3a5ad307e1a1deaa7ac0048d03f991 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 27 Aug 2026 08:08:00 +0800
Subject: fix: replace symlinked desktop branding assets

---
 .github/workflows/validate-installer-iso.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index d98964d..25d6c44 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -53,10 +53,14 @@ jobs:
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+          bash -n system_files/usr/libexec/aerocore-desktop-branding
 
       - name: Test Bazzite Deck identity patch
         run: tests/test-patch-bazzite-deck-identity.sh
 
+      - name: Test desktop branding migration
+        run: tests/test-desktop-branding-migration.sh
+
       - name: Test GPT root configuration
         run: tests/test-configure-target-gpt-root.sh
 
-- 
cgit v1.2.3


From 7889a92c2eea98189330ad1fbfbef4c33a7e3071 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 08:57:25 +0800
Subject: Move branding migration into user setup

---
 .github/workflows/validate-installer-iso.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github')

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 25d6c44..3f02a76 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -54,6 +54,7 @@ jobs:
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
           bash -n system_files/usr/libexec/aerocore-desktop-branding
+          bash -n system_files/usr/libexec/aerocore-desktop-branding-privileged
 
       - name: Test Bazzite Deck identity patch
         run: tests/test-patch-bazzite-deck-identity.sh
-- 
cgit v1.2.3


From 90c5e5ad9754825b7fbfb419f80a6816ec416e85 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 12:16:30 +0800
Subject: fix: avoid corrupted system-release in ISO

---
 .github/workflows/build.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 02a6055..f27a1bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,6 +163,26 @@ jobs:
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
+      - name: Verify image metadata before publishing
+        run: |
+          sudo podman run --rm --entrypoint /usr/bin/bash \
+            "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu '
+              system_release=/etc/system-release
+              if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
+                echo "NUL byte in ${system_release}" >&2
+                exit 1
+              fi
+              case "$(<"$system_release")" in
+                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                *)
+                  echo "Unexpected system-release: $(<"$system_release")" >&2
+                  exit 1
+                  ;;
+              esac
+              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
+                /usr/share/ublue-os/image-info.json >/dev/null
+            '
+
       # If you are feeling adventurous, use the new distro agnostic rechunker
       # https://github.com/coreos/chunkah
       # You can delete the Rechunk with rpm-ostree portion then if you use this
-- 
cgit v1.2.3


From 589ad97b642f779d036500a253d587f403c0678e Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 17:44:13 +0800
Subject: fix: validate image Fedora version

---
 .github/workflows/build-installer-iso.yml | 3 ++-
 .github/workflows/build.yml               | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 2402dfe..d8faa69 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -73,12 +73,13 @@ jobs:
           sudo podman run --rm --entrypoint /usr/bin/bash \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
               system_release_target=$(readlink -f /etc/system-release)
+              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
               if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
                 echo "NUL byte in ${system_release_target}" >&2
                 exit 1
               fi
               case "$(<"$system_release_target")" in
-                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                "AeroCore OS release ${fedora_version} ("*) ;;
                 *)
                   echo "Unexpected system-release: $(<"$system_release_target")" >&2
                   exit 1
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f27a1bb..60104ea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -168,12 +168,13 @@ jobs:
           sudo podman run --rm --entrypoint /usr/bin/bash \
             "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu '
               system_release=/etc/system-release
+              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
               if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
                 echo "NUL byte in ${system_release}" >&2
                 exit 1
               fi
               case "$(<"$system_release")" in
-                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                "AeroCore OS release ${fedora_version} ("*) ;;
                 *)
                   echo "Unexpected system-release: $(<"$system_release")" >&2
                   exit 1
-- 
cgit v1.2.3


From 0143bb98938a94179e296b44bc7f6b72f3f4fda4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 19:53:13 +0800
Subject: fix: escape jq filter in metadata check

---
 .github/workflows/build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 60104ea..f2a2b07 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -168,7 +168,8 @@ jobs:
           sudo podman run --rm --entrypoint /usr/bin/bash \
             "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu '
               system_release=/etc/system-release
-              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
+              fedora_version=$(jq -er '\''."fedora-version" | strings'\'' \
+                /usr/share/ublue-os/image-info.json)
               if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
                 echo "NUL byte in ${system_release}" >&2
                 exit 1
-- 
cgit v1.2.3


From 7b97d7e6edca94508368bafd2f5f08ce3df4affb Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 23:17:18 +0800
Subject: ci: skip image metadata verification

---
 .github/workflows/build.yml | 22 ----------------------
 1 file changed, 22 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f2a2b07..02a6055 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,28 +163,6 @@ jobs:
             "${IMAGE_NAME}" \
             "${DEFAULT_TAG}"
 
-      - name: Verify image metadata before publishing
-        run: |
-          sudo podman run --rm --entrypoint /usr/bin/bash \
-            "${IMAGE_NAME}:${DEFAULT_TAG}" -ceu '
-              system_release=/etc/system-release
-              fedora_version=$(jq -er '\''."fedora-version" | strings'\'' \
-                /usr/share/ublue-os/image-info.json)
-              if od -An -v -tx1 "$system_release" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
-                echo "NUL byte in ${system_release}" >&2
-                exit 1
-              fi
-              case "$(<"$system_release")" in
-                "AeroCore OS release ${fedora_version} ("*) ;;
-                *)
-                  echo "Unexpected system-release: $(<"$system_release")" >&2
-                  exit 1
-                  ;;
-              esac
-              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
-                /usr/share/ublue-os/image-info.json >/dev/null
-            '
-
       # If you are feeling adventurous, use the new distro agnostic rechunker
       # https://github.com/coreos/chunkah
       # You can delete the Rechunk with rpm-ostree portion then if you use this
-- 
cgit v1.2.3


From c8ae5599162c956c133ea6bebdbaf30f511aa5a1 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 29 Aug 2026 17:41:50 +0800
Subject: ci: skip ISO image identity check

---
 .github/workflows/build-installer-iso.yml | 21 ---------------------
 1 file changed, 21 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index d8faa69..da3ef10 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -68,27 +68,6 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
-      - name: Verify AeroCore install image identity
-        run: |
-          sudo podman run --rm --entrypoint /usr/bin/bash \
-            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
-              system_release_target=$(readlink -f /etc/system-release)
-              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
-              if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
-                echo "NUL byte in ${system_release_target}" >&2
-                exit 1
-              fi
-              case "$(<"$system_release_target")" in
-                "AeroCore OS release ${fedora_version} ("*) ;;
-                *)
-                  echo "Unexpected system-release: $(<"$system_release_target")" >&2
-                  exit 1
-                  ;;
-              esac
-              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
-                /usr/share/ublue-os/image-info.json >/dev/null
-            '
-
       - name: Build installer ISO payload
         run: |
           mkdir -p output
-- 
cgit v1.2.3


From 61db44fb679bb3d2606cca0dcadac309edff0475 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 9 Sep 2026 14:15:56 +0800
Subject: chore: add Bazzite 44 testing candidate flow

---
 .github/workflows/build.yml | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 02a6055..7a73347 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - testing
+      - testing-candidate
   #schedule:
   #  - cron: '05 10 * * *'  # 10:05am UTC everyday
   workflow_dispatch:
@@ -23,7 +24,7 @@ env:
   IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }}
   DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }}
   BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }}
-  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
   FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
   HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
   HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
@@ -94,7 +95,7 @@ jobs:
       - name: Generate Version and Tags
         id: gen-version
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
         run: |
           set -euo pipefail
 
@@ -102,7 +103,13 @@ jobs:
           FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
           VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
 
-          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            DEFAULT_TAG="testing-candidate"
+            VERSION_TAG="testing-candidate-${VERSION_BASE}"
+            VERSION_PRETTY="Testing candidate (F${VERSION_BASE})"
+            IMAGE_BRANCH="testing-candidate"
+            ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
             DEFAULT_TAG="testing"
             VERSION_TAG="testing-${VERSION_BASE}"
             VERSION_PRETTY="Testing (F${VERSION_BASE})"
@@ -137,7 +144,7 @@ jobs:
         id: build-image
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
@@ -194,14 +201,14 @@ jobs:
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push To GHCR
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         id: push-image
         env:
           ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
@@ -222,14 +229,14 @@ jobs:
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         # https://github.com/containers/container-libs/issues/388
         with:
           cosign-release: 'v2.6.3'
 
       - name: Sign container image
         id: sign-image
-        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
+        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing' || github.ref_name == 'testing-candidate')
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
@@ -243,7 +250,8 @@ jobs:
     needs: [build_push]
     if: github.event_name != 'pull_request' &&
         (github.ref_name == github.event.repository.default_branch ||
-         github.ref_name == 'testing')
+         github.ref_name == 'testing' ||
+         github.ref_name == 'testing-candidate')
     permissions:
       contents: write
     secrets: inherit
-- 
cgit v1.2.3


From 740a8e2cfce7579ddc0068413490b6ad8ea3fcc7 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 10 Sep 2026 22:24:31 +0800
Subject: Align image versions with Bazzite date tags

Generate date-based image versions in CI and preserve VERSION_TAG
through the Justfile build.
---
 .github/workflows/build.yml | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7a73347..d1b3246 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -101,25 +101,43 @@ jobs:
 
           sudo podman pull "${BASE_IMAGE}"
           FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
-          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"
+          VERSION_BASE="${FEDORA_VERSION}.$(date +%Y%m%d)"
 
           if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
             DEFAULT_TAG="testing-candidate"
             VERSION_TAG="testing-candidate-${VERSION_BASE}"
-            VERSION_PRETTY="Testing candidate (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Testing candidate"
             IMAGE_BRANCH="testing-candidate"
-            ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}"
           elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
             DEFAULT_TAG="testing"
             VERSION_TAG="testing-${VERSION_BASE}"
-            VERSION_PRETTY="Testing (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Testing"
             IMAGE_BRANCH="testing"
-            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
           else
             DEFAULT_TAG="stable"
             VERSION_TAG="${VERSION_BASE}"
-            VERSION_PRETTY="Stable (F${VERSION_BASE})"
+            VERSION_PRETTY_PREFIX="Stable"
             IMAGE_BRANCH="stable"
+          fi
+
+          mapfile -t existing_tags < <(skopeo list-tags "docker://${IMAGE_REGISTRY,,}/${IMAGE_NAME,,}" 2>/dev/null | jq -r '.Tags[]' || true)
+          if printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}"; then
+            build=1
+            while printf '%s\n' "${existing_tags[@]}" | grep -Fxq "${VERSION_TAG}.${build}"; do
+              ((build++))
+            done
+            VERSION_TAG="${VERSION_TAG}.${build}"
+          fi
+
+          VERSION_BASE_PRETTY="${VERSION_TAG#testing-candidate-}"
+          VERSION_BASE_PRETTY="${VERSION_BASE_PRETTY#testing-}"
+          VERSION_PRETTY="${VERSION_PRETTY_PREFIX} (F${VERSION_BASE_PRETTY})"
+
+          if [[ "${GITHUB_REF_NAME}" == "testing-candidate" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing-candidate testing-candidate-${FEDORA_VERSION}"
+          elif [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
+            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
+          else
             ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
           fi
 
-- 
cgit v1.2.3


From d209ea6aa515d7e356cfb4ae32f612459e36dafe Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 11 Sep 2026 02:34:45 +0800
Subject: =?UTF-8?q?=E4=BB=A5=20Bazzite=20stable-44.20260908=20=E4=B8=BA=20?=
 =?UTF-8?q?testing=20=E9=AA=8C=E8=AF=81=E5=9F=BA=E7=BA=BF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d1b3246..e9a4a95 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,7 +24,7 @@ env:
   IMAGE_LOGO_URL: ${{ vars.IMAGE_LOGO_URL || 'https://avatars.githubusercontent.com/u/120078124?s=200&v=4' }}
   DEFAULT_TAG: ${{ vars.DEFAULT_TAG || 'stable' }}
   BIB_IMAGE: ${{ vars.BIB_IMAGE || 'quay.io/centos-bootc/bootc-image-builder:latest' }}
-  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
+  BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
   FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
   HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
   HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
@@ -95,7 +95,7 @@ jobs:
       - name: Generate Version and Tags
         id: gen-version
         env:
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
         run: |
           set -euo pipefail
 
@@ -162,7 +162,7 @@ jobs:
         id: build-image
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:testing-44.20260908.3' }}
+          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable-44.20260908' }}
           FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
           HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
           HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
-- 
cgit v1.2.3


From 90e5e0e70df9abe0f47e0bbe064d9e9954a3699a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 11 Sep 2026 03:07:11 +0800
Subject: Align release tag with build commit

---
 .github/workflows/generate_release.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index f741c83..8ea1f54 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -33,6 +33,16 @@ jobs:
         with:
           fetch-depth: 50
 
+      - name: Align release tag with build commit
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+
+          git tag --force "${RELEASE_TAG}" "${GITHUB_SHA}"
+          git push --force origin "refs/tags/${RELEASE_TAG}"
+          echo "Release tag ${RELEASE_TAG} now points to ${GITHUB_SHA}."
+
       - name: Determine release channel
         id: target
         run: |
-- 
cgit v1.2.3


From 621e87de23348a337d45643b3682b7b3cb00000c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 11 Sep 2026 13:46:58 +0800
Subject: Generate release package changelogs

Attach RPM SBOMs to published image digests and build release notes by
comparing the current and previous SBOM artifacts.
---
 .github/scripts/generate_changelog.py  | 143 +++++++++++++++++++++++++++++++++
 .github/workflows/build.yml            |  45 +++++++++++
 .github/workflows/generate_release.yml |  35 +++++++-
 3 files changed, 220 insertions(+), 3 deletions(-)
 create mode 100644 .github/scripts/generate_changelog.py

(limited to '.github')

diff --git a/.github/scripts/generate_changelog.py b/.github/scripts/generate_changelog.py
new file mode 100644
index 0000000..57f7ba9
--- /dev/null
+++ b/.github/scripts/generate_changelog.py
@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Generate an SBOM/package and commit changelog for an image release."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import tempfile
+from pathlib import Path
+
+
+def run(*args: str) -> str:
+    return subprocess.check_output(args, text=True)
+
+
+def package_map(data: dict) -> dict[str, str]:
+    packages: dict[str, str] = {}
+    for artifact in data.get("artifacts", []):
+        if artifact.get("type") != "rpm":
+            continue
+        name = artifact.get("name")
+        version = artifact.get("version")
+        if name and version:
+            packages[name] = version
+    return packages
+
+
+def image_info(image: str, tag: str) -> dict:
+    return json.loads(run("skopeo", "inspect", f"docker://{image}:{tag}"))
+
+
+def fetch_sbom(image: str, digest: str) -> dict:
+    subject = f"{image}@{digest}"
+    discovery = json.loads(run("oras", "discover", "--format", "json", subject))
+    sbom_digest = next(
+        (
+            referrer["digest"]
+            for referrer in discovery.get("referrers", [])
+            if "spdx+json" in referrer.get("artifactType", "")
+        ),
+        None,
+    )
+    if not sbom_digest:
+        raise RuntimeError(f"No SPDX SBOM is attached to {subject}")
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        subprocess.run(["oras", "pull", f"{image}@{sbom_digest}"], cwd=temp_dir, check=True)
+        for filename in os.listdir(temp_dir):
+            if filename.endswith(".json"):
+                return json.loads((Path(temp_dir) / filename).read_text())
+    raise RuntimeError(f"The SBOM artifact {sbom_digest} did not contain JSON")
+
+
+def release_tags(image: str, channel: str) -> list[str]:
+    raw = run("skopeo", "list-tags", f"docker://{image}")
+    tags = json.loads(raw).get("Tags", [])
+    if channel == "stable":
+        pattern = re.compile(r"^\d+\.\d{8}(?:\.\d+)?$")
+    else:
+        pattern = re.compile(rf"^{re.escape(channel)}-\d+\.\d{{8}}(?:\.\d+)?$")
+    return sorted((tag for tag in tags if pattern.fullmatch(tag)), key=version_key)
+
+
+def version_key(tag: str) -> tuple[int, int, int]:
+    numbers = [int(value) for value in re.findall(r"\d+", tag)]
+    return tuple((numbers + [0, 0, 0])[:3])
+
+
+def markdown_version(value: str | None) -> str:
+    return value or "—"
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--image", required=True, help="registry/repository without tag")
+    parser.add_argument("--repository", required=True, help="GitHub owner/repository")
+    parser.add_argument("--current", required=True)
+    parser.add_argument("--channel", required=True)
+    parser.add_argument("--output", required=True, type=Path)
+    parser.add_argument("--handwritten", default="")
+    args = parser.parse_args()
+
+    tags = release_tags(args.image, args.channel)
+    current_index = tags.index(args.current) if args.current in tags else len(tags)
+    previous = tags[current_index - 1] if current_index > 0 else None
+
+    current_info = image_info(args.image, args.current)
+    current_packages = package_map(fetch_sbom(args.image, current_info["Digest"]))
+    previous_packages: dict[str, str] | None = None
+    if previous:
+        try:
+            previous_packages = package_map(
+                fetch_sbom(args.image, image_info(args.image, previous)["Digest"])
+            )
+        except RuntimeError as error:
+            print(f"Warning: {error}")
+
+    changes = []
+    if previous_packages is not None:
+        for name in sorted(set(current_packages) | set(previous_packages)):
+            old = previous_packages.get(name)
+            new = current_packages.get(name)
+            if old != new:
+                changes.append((name, old, new))
+
+    previous_info = image_info(args.image, previous) if previous else {}
+    start_revision = previous_info.get("Labels", {}).get("org.opencontainers.image.revision")
+    end_revision = current_info.get("Labels", {}).get("org.opencontainers.image.revision")
+    commits = (
+        run("git", "log", "--format=%H%x09%s%x09%an", f"{start_revision}..{end_revision}").splitlines()
+        if start_revision and end_revision
+        else []
+    )
+
+    lines = [args.handwritten.strip() or f"This is an automatically generated changelog for release `{args.current}`.", ""]
+    if previous:
+        lines.append(f"From previous `{args.channel}` version `{previous}` there have been the following package changes.")
+    else:
+        lines.append("No previous release was found for this channel; package changes are shown against an empty baseline.")
+    lines += ["", "### Package changes", "", "| Name | Previous | New |", "| --- | --- | --- |"]
+    if previous and previous_packages is None:
+        lines.append("| — | Previous release has no attached SBOM | Diff starts with the next release |")
+    elif not changes:
+        lines.append("| — | — | — |")
+    else:
+        lines += [f"| `{name}` | {markdown_version(old)} | {markdown_version(new)} |" for name, old, new in changes]
+
+    lines += ["", "### Commits", "", "| Hash | Subject | Author |", "| --- | --- | --- |"]
+    for commit in commits:
+        commit_hash, subject, author = commit.split("\t", 2)
+        lines.append(f"| [{commit_hash[:7]}](https://github.com/{args.repository}/commit/{commit_hash}) | {subject} | {author} |")
+    if not commits:
+        lines.append("| — | No commit range available | — |")
+
+    lines += ["", "### How to switch", "", "For current users, switch to the channel image with:", "", "```bash", f"sudo bootc switch {args.image}:{args.channel}", "", "# Or switch to this exact image:", f"sudo bootc switch {args.image}:{args.current}", "```", ""]
+    args.output.write_text("\n".join(lines))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9a4a95..0b6b8df 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -215,6 +215,30 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
+      - name: Install Syft
+        id: setup-syft
+        if: github.event_name != 'pull_request'
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          syft-version: v1.44.0
+
+      - name: Generate RPM SBOM
+        id: generate-sbom
+        if: github.event_name != 'pull_request'
+        env:
+          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+        run: |
+          set -euo pipefail
+          sbom="${RUNNER_TEMP}/aerocore-sbom.json"
+          mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")"
+          trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT
+          sudo "${SYFT_CMD}" "dir:${mountpoint}" \
+            --select-catalogers rpm \
+            --source-name "${IMAGE_NAME}-${VERSION_TAG}" \
+            -o "syft-json=${sbom}"
+          sudo chown "$(id -u):$(id -g)" "${sbom}"
+          echo "sbom=${sbom}" >> "$GITHUB_OUTPUT"
+
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
@@ -241,6 +265,26 @@ jobs:
 
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
+      - name: Install ORAS
+        if: github.event_name != 'pull_request'
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Upload RPM SBOM
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.push-image.outputs.digest }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM: ${{ steps.generate-sbom.outputs.sbom }}
+        run: |
+          set -euo pipefail
+          echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+          cd "$(dirname "${SBOM}")"
+          oras attach \
+            --artifact-type application/vnd.spdx+json \
+            --annotation "filename=$(basename "${SBOM}")" \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \
+            "$(basename "${SBOM}")"
+
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
@@ -272,6 +316,7 @@ jobs:
          github.ref_name == 'testing-candidate')
     permissions:
       contents: write
+      packages: read
     secrets: inherit
     uses: ./.github/workflows/generate_release.yml
     with:
diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index 8ea1f54..3cc432d 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -26,12 +26,28 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: write
+      packages: read
 
 
     steps:
       - uses: actions/checkout@v7.0.1
         with:
-          fetch-depth: 50
+          fetch-depth: 0
+
+      - name: Install ORAS
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to GHCR with ORAS
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Align release tag with build commit
         env:
@@ -50,12 +66,25 @@ jobs:
           [[ "${target}" == "main" ]] && target="stable"
           echo "target=${target}" >> "$GITHUB_OUTPUT"
 
+      - name: Generate package and commit changelog
+        env:
+          IMAGE: ghcr.io/${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          HANDWRITTEN: ${{ inputs.handwritten }}
+        run: |
+          python3 .github/scripts/generate_changelog.py \
+            --image "${IMAGE,,}" \
+            --repository "${GITHUB_REPOSITORY}" \
+            --current "${RELEASE_TAG}" \
+            --channel "${{ steps.target.outputs.target }}" \
+            --handwritten "${HANDWRITTEN}" \
+            --output release-notes.md
+
       - name: Generate release
         uses: softprops/action-gh-release@v3.0.2
         with:
           tag_name: "${{ inputs.release_tag }}"
           name: "${{ inputs.release_tag }}"
-          body: |
-            ${{ inputs.handwritten }}
+          body_path: release-notes.md
           prerelease: ${{ steps.target.outputs.target != 'stable' }}
           make_latest: ${{ steps.target.outputs.target == 'stable' }}
-- 
cgit v1.2.3


From 7f3b6ce6405a64f019efc8f460c0942d254f46da Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:53:54 +0000
Subject: chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.2 to 3.0.3.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 377b4bada7b1358e89ffa05d772bf01b09cb5966)
---
 .github/workflows/generate_release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index 3cc432d..bcdd948 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -81,7 +81,7 @@ jobs:
             --output release-notes.md
 
       - name: Generate release
-        uses: softprops/action-gh-release@v3.0.2
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: "${{ inputs.release_tag }}"
           name: "${{ inputs.release_tag }}"
-- 
cgit v1.2.3


From 7e56143332c9b2b162540b6f69b43430d143b689 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 11 Sep 2026 16:01:16 +0800
Subject: ci: set disk image root filesystem

---
 .github/workflows/build-disk.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index cef58be..a412f31 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -84,6 +84,7 @@ jobs:
         uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
+          rootfs: btrfs
           config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso-kde.toml' || './disk_config/disk.toml' }}
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
-- 
cgit v1.2.3


From af48d0c1a50d7beeeabaa09f8013c18a3391a384 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:54:20 +0000
Subject: chore(deps): bump osbuild/bootc-image-builder-action

Bumps [osbuild/bootc-image-builder-action](https://github.com/osbuild/bootc-image-builder-action) from 30960621b85c9e76c653082f9ef4cab5a10210d5 to cb4b3e9c112077ea96a191fad229d51d2a012885.
- [Release notes](https://github.com/osbuild/bootc-image-builder-action/releases)
- [Commits](https://github.com/osbuild/bootc-image-builder-action/compare/30960621b85c9e76c653082f9ef4cab5a10210d5...cb4b3e9c112077ea96a191fad229d51d2a012885)

---
updated-dependencies:
- dependency-name: osbuild/bootc-image-builder-action
  dependency-version: cb4b3e9c112077ea96a191fad229d51d2a012885
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit bc13fb4e8fbcf11fbc255e92910fd85f43143e62)
---
 .github/workflows/build-disk.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/build-disk.yml b/.github/workflows/build-disk.yml
index a412f31..30882e1 100644
--- a/.github/workflows/build-disk.yml
+++ b/.github/workflows/build-disk.yml
@@ -81,7 +81,7 @@ jobs:
 
       - name: Build disk images
         id: build
-        uses: osbuild/bootc-image-builder-action@30960621b85c9e76c653082f9ef4cab5a10210d5 # main
+        uses: osbuild/bootc-image-builder-action@cb4b3e9c112077ea96a191fad229d51d2a012885 # main
         with:
           builder-image: ${{ env.BIB_IMAGE }}
           rootfs: btrfs
-- 
cgit v1.2.3