From 42868580f1ec41cc684e3a1e1ed184419a5cd372 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 6 Jun 2026 14:31:30 +0200 Subject: [PATCH] feat(ci): implement testing stream workflows (#2250) * feat(ci): testing stream * feat(ci): workaround for scheduled stable build on non-default branch * feat(renovate): initial config for testing stream We want to get builds that are triggered by kinoite updates from renovate but promote changes like get-aurora-dev/common and ublue-os/brew from main to the stable branch, while still receiving updates for things like github actions. --- .github/renovate.json5 | 36 ++++++++++++------- .github/workflows/build-image-latest-main.yml | 2 +- .github/workflows/build-image-stable.yml | 9 ++--- ...image-beta.yml => build-image-testing.yml} | 12 +++---- .github/workflows/generate-release.yml | 1 + .../trigger-schedule-stable-image.yml | 27 ++++++++++++++ 6 files changed, 64 insertions(+), 23 deletions(-) rename .github/workflows/{build-image-beta.yml => build-image-testing.yml} (88%) create mode 100644 .github/workflows/trigger-schedule-stable-image.yml diff --git a/.github/renovate.json5 b/.github/renovate.json5 index ebef495f..f7f06559 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -4,7 +4,7 @@ "config:best-practices" ], - "baseBranchPatterns": ["main"], + "baseBranchPatterns": ["main", "stable-f44"], // Do not rebase when the default branch is updated "rebaseWhen": "never", @@ -32,23 +32,35 @@ "matchUpdateTypes": ["digest"] }, { - "matchUpdateTypes": ["pin", "digest", "pinDigest"], - "matchPackageNames": ["ghcr.io/jasonn3/build-container-installer"], - "automerge": false - }, - { + // We always want to trigger a fresh build when we have a new base image on every branch + // so we get package and security updates + "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], "automerge": true, - "matchUpdateTypes": ["digest"], - "matchDepNames": [ - "quay.io/fedora-ostree-desktops/kinoite", - "ghcr.io/ublue-os/brew", - "ghcr.io/get-aurora-dev/common" - ] + "matchUpdateTypes": ["digest"] }, { "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], "matchUpdateTypes": ["major"], "enabled": false + }, + { + "matchDepNames": [ + "ghcr.io/ublue-os/brew", + "ghcr.io/get-aurora-dev/common" + ], + "matchBaseBranches": ["main"], + "automerge": true, + "matchUpdateTypes": ["digest"] + }, + { + "matchDepNames": [ + "ghcr.io/ublue-os/brew", + "ghcr.io/get-aurora-dev/common" + ], + // Brew and common are not "security updates", they have to go through :testing/main first + // to reach a stable release + "matchBaseBranches": ["stable-f44"], + "enabled": false } ] } diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index 2b15b564..bf1c19e7 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -3,7 +3,7 @@ on: merge_group: pull_request: branches: - - main + - stable-f44 paths-ignore: - "**.md" - ".github/workflows/moderator.yml" diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index f3a02bbf..b3caabb9 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -1,15 +1,16 @@ name: Stable Images on: + # We do not want this to run after PR merges + # we are only publishing weekly :stable images + + # We still want to know if things are broken pull_request: branches: - - main - - testing + - stable-f44 paths-ignore: - "**.md" - ".github/workflows/moderator.yml" - ".github/workflows/scorecard.yml" - schedule: - - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM workflow_call: workflow_dispatch: inputs: diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-testing.yml similarity index 88% rename from .github/workflows/build-image-beta.yml rename to .github/workflows/build-image-testing.yml index 3a6277e5..ceb428b4 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-testing.yml @@ -1,9 +1,9 @@ -name: Beta Images +name: Testing Images on: - #merge_group: + merge_group: pull_request: branches: - - beta + - main paths-ignore: - "**.md" - ".github/workflows/moderator.yml" @@ -27,8 +27,8 @@ permissions: artifact-metadata: write jobs: - build-image-beta: - name: Build Beta Images + build-image-testing: + name: Build Testing Images uses: ./.github/workflows/reusable-build.yml secrets: inherit strategy: @@ -38,7 +38,7 @@ jobs: with: image_flavors: '["main", "nvidia-open"]' brand_name: ${{ matrix.brand_name }} - stream_name: beta + stream_name: testing previous_build: ${{ inputs.previous_build }} # FIXME: MAIN has no arm builds in ublue-os/akmods yet # https://github.com/ublue-os/akmods/pull/440 diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index e485b262..9918e068 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -34,6 +34,7 @@ jobs: uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 500 + ref: stable-f44 - name: Install Just run: | diff --git a/.github/workflows/trigger-schedule-stable-image.yml b/.github/workflows/trigger-schedule-stable-image.yml new file mode 100644 index 00000000..5873b886 --- /dev/null +++ b/.github/workflows/trigger-schedule-stable-image.yml @@ -0,0 +1,27 @@ +# We have this because we can't schedule builds on non-default branches +name: Trigger Stable Image Build +on: + schedule: + - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM + workflow_dispatch: + +permissions: {} + +jobs: + trigger-stable-build: + runs-on: ubuntu-slim + permissions: + contents: read + actions: write + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Trigger Stable Image Build + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + BRANCH: stable-f44 + run: | + gh workflow run \ + build-image-stable.yml \ + --ref "${BRANCH}"