quine-global-labs/aurora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(ci): initial work for using flag/arg-based workflow (#2443)

Browse source 
* refactor(ci): initial work for using flag/arg-based workflow

The goal of this is to make the buildsystem function like any other CLI
program. The only recipes I haven't touched in this PR are the very
simple recipes like verify-container, retag-nvidia-ghcr and
login-registry. In the future I want to split up this Justfile in
multiple smaller ones where it feels right to do that.

resolves: https://github.com/ublue-os/aurora/issues/2436

* document minimum just version

* build recipe

* feat: redo the way we do kernel pins

This allows an independent pinning of kernels for future ARM builds
regardless of x86. Probably the way we should have done it from the
beginning.

* get rid of build-ghcr and build-pipeline related things

We are not using the build-pipeline recipe anywhere right now. I think a
build-rechunk recipe is good enough for now.

I think build-ghcr doesn't make any sense anymore as it's now just a
single additional flag. The rechunk recipe with chunkah currently
doesn't alter any behavior when run in ghcr so we can delete this. But
this will likely change when chunkah implements some form of passing a
previous manifest.

I want to do a recipe at some point which replaces the general idea of
the pipeline recipe and is as close to github as possible. Build ->
Rechunk -> Secureboot-> tag + push an image to a local registry bootc
install.

* do deprecated build-chunked-oci recipe

* remove build-pipeline parts of ostree-rechunk

* export oci

* load rootful recipe

currently not used in CI as we are running everything as root.

* secureboot

* generate-point

* gen-sbom

* package cache

* bootc install

* some remaining shebangs

best practice to use env bash here instead

* push recipe

* redo generate-build-tags and tag-images

I removed the version input here. This has been broken for probably a
very long time, this didn't do anything for months at least, oldest log
I could find here:

```
Error: no such object: "aurora:latest"
Tags for this Action...
latest latest-43.20260424 latest-20260424 43 43-43.20260424 43-20260424
```

Kernel input is now done through just, so no reason to pass that, no
idea why we had that here in the first place.

* fix kernel pin for build-rechunk

This convenience recipe needs to take all the options from the build one
This commit is contained in:
renner 2026-06-27 08:36:37 +02:00 committed by GitHub
parent d267b04c71
commit cfd014fa2f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 283 additions and 227 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.github/workflows/build-image-latest-main.yml vendored
View file

@ -40,7 +40,6 @@ jobs:
image_flavors: '["main", "nvidia-open"]' image_flavors: '["main", "nvidia-open"]'
brand_name: ${{ matrix.brand_name }} brand_name: ${{ matrix.brand_name }}
stream_name: latest stream_name: latest
#kernel_pin: 6.12.15-200.fc41.x86_64
# FIXME: MAIN has no arm builds in ublue-os/akmods yet # FIXME: MAIN has no arm builds in ublue-os/akmods yet
# https://github.com/ublue-os/akmods/pull/440 # https://github.com/ublue-os/akmods/pull/440
# architecture: '["aarch64","x86_64"]' # architecture: '["aarch64","x86_64"]'

1
.github/workflows/build-image-stable.yml vendored
View file

@ -31,7 +31,6 @@ jobs:
matrix: matrix:
brand_name: ["aurora"] brand_name: ["aurora"]
with: with:
#kernel_pin: 6.14.11-300.fc42.x86_64 ## This is where kernels get pinned.
brand_name: ${{ matrix.brand_name }} brand_name: ${{ matrix.brand_name }}
stream_name: stable stream_name: stable
# Enable ARM when it makes sense # Enable ARM when it makes sense

1
.github/workflows/build-image-testing.yml vendored
View file

@ -31,7 +31,6 @@ jobs:
image_flavors: '["main", "nvidia-open"]' image_flavors: '["main", "nvidia-open"]'
brand_name: ${{ matrix.brand_name }} brand_name: ${{ matrix.brand_name }}
stream_name: testing stream_name: testing
#kernel_pin: 6.12.15-200.fc41.x86_64
# FIXME: MAIN has no arm builds in ublue-os/akmods yet # FIXME: MAIN has no arm builds in ublue-os/akmods yet
# https://github.com/ublue-os/akmods/pull/440 # https://github.com/ublue-os/akmods/pull/440
# architecture: '["aarch64","x86_64"]' # architecture: '["aarch64","x86_64"]'

120
.github/workflows/reusable-build.yml vendored
View file

@ -15,9 +15,6 @@ on:
description: "The Fedora Version: stable, or latest" description: "The Fedora Version: stable, or latest"
required: true required: true
type: string type: string
kernel_pin:
description: "The full kernel version to pin"
type: string
architecture: architecture:
description: "JSON string of architectures to build, '[aarch64, x86_64]'" description: "JSON string of architectures to build, '[aarch64, x86_64]'"
default: "['x86_64']" default: "['x86_64']"
@ -134,7 +131,11 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: | run: |
IMAGE_NAME="$(just image_name ${MATRIX_BASE_NAME} ${MATRIX_STREAM_NAME} ${MATRIX_IMAGE_FLAVOR})" IMAGE_NAME="$(just image_name \
--image ${MATRIX_BASE_NAME} \
--tag ${MATRIX_STREAM_NAME} \
--flavor ${MATRIX_IMAGE_FLAVOR})"
echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
- name: DNF Package Cache Setup - name: DNF Package Cache Setup
@ -146,11 +147,12 @@ jobs:
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
GITHUB_EVENT_NAME: ${{ github.event_name }} GITHUB_EVENT_NAME: ${{ github.event_name }}
run: | run: |
CACHE="$(just setup-cache "${MATRIX_BASE_NAME}" \ CACHE="$(just setup-cache \
"${MATRIX_STREAM_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --tag "${MATRIX_STREAM_NAME}" \
"1" \ --flavor "${MATRIX_IMAGE_FLAVOR}" \
"${GITHUB_EVENT_NAME}")" --ghcr \
--github-event "${GITHUB_EVENT_NAME}")"
CACHE_NAME="$(echo "${CACHE}" | cut -d' ' -f 1)" CACHE_NAME="$(echo "${CACHE}" | cut -d' ' -f 1)"
ALLOW_CACHE_WRITE="$(echo "${CACHE}" | cut -d' ' -f 2)" ALLOW_CACHE_WRITE="$(echo "${CACHE}" | cut -d' ' -f 2)"
@ -173,17 +175,18 @@ jobs:
id: build-image id: build-image
shell: bash shell: bash
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # ghcurl
MATRIX_BASE_NAME: ${{ matrix.base_name }} MATRIX_BASE_NAME: ${{ matrix.base_name }}
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
INPUTS_KERNEL_PIN: ${{ inputs.kernel_pin }}
run: | run: |
sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \ sudo -E $(command -v just) \
build-ghcr "${MATRIX_BASE_NAME}" \ repo_organization="${{ github.repository_owner }}" \
"${MATRIX_STREAM_NAME}" \ build \
"${MATRIX_IMAGE_FLAVOR}" \ --image "${MATRIX_BASE_NAME}" \
"${INPUTS_KERNEL_PIN}" --tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}" \
--ghcr
# https://github.com/actions/cache/issues/1533 # https://github.com/actions/cache/issues/1533
- name: Hack around permission issue caching - name: Hack around permission issue caching
@ -208,9 +211,10 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: | run: |
sudo -E $(command -v just) rechunk "${MATRIX_BASE_NAME}" \ sudo -E $(command -v just) rechunk \
"${MATRIX_STREAM_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" --tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
- name: Setup Syft - name: Setup Syft
id: setup-syft id: setup-syft
@ -226,10 +230,11 @@ jobs:
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }} SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
run: | run: |
sudo -E $(command -v just) gen-sbom "${MATRIX_BASE_NAME}" \ sudo -E $(command -v just) gen-sbom \
"${MATRIX_STREAM_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --tag "${MATRIX_STREAM_NAME}" \
"${SYFT_CMD}" --flavor "${MATRIX_IMAGE_FLAVOR}" \
"${SYFT_CMD}"
- name: Secureboot Check - name: Secureboot Check
id: secureboot id: secureboot
@ -239,9 +244,10 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: | run: |
sudo -E $(command -v just) secureboot "${MATRIX_BASE_NAME}" \ sudo -E $(command -v just) secureboot \
"${MATRIX_STREAM_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" --tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
- name: Export to OCI Archive - name: Export to OCI Archive
if: github.event_name == 'pull_request' if: github.event_name == 'pull_request'
@ -251,9 +257,10 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: | run: |
sudo -E $(command -v just) export-oci "${MATRIX_BASE_NAME}" \ sudo -E $(command -v just) export-oci \
"${MATRIX_STREAM_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" --tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
- name: Upload OCI Archive as Artifact - name: Upload OCI Archive as Artifact
if: github.event_name == 'pull_request' if: github.event_name == 'pull_request'
@ -276,10 +283,11 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: | run: |
sudo -E $(command -v just) disk-image "${MATRIX_BASE_NAME}" \ sudo -E $(command -v just) disk-image \
"${MATRIX_STREAM_NAME}" \ --image"${MATRIX_BASE_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --tag "${MATRIX_STREAM_NAME}" \
1 --flavor "${MATRIX_IMAGE_FLAVOR}" \
--ghcr
- name: PR Testing Instructions - name: PR Testing Instructions
if: github.event_name == 'pull_request' if: github.event_name == 'pull_request'
@ -299,20 +307,17 @@ jobs:
MATRIX_BASE_NAME: "${{ matrix.base_name }}" MATRIX_BASE_NAME: "${{ matrix.base_name }}"
MATRIX_STREAM_NAME: "${{ matrix.stream_name }}" MATRIX_STREAM_NAME: "${{ matrix.stream_name }}"
MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}" MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}"
INPUTS_KERNEL_PIN: "${{ inputs.kernel_pin }}"
IMAGE_NAME: ${{ env.IMAGE_NAME }} IMAGE_NAME: ${{ env.IMAGE_NAME }}
GITHUB_EVENT_NAME: ${{ github.event_name }} GITHUB_EVENT_NAME: ${{ github.event_name }}
GITHUB_EVENT_NUMBER: ${{ github.event.number }} GITHUB_EVENT_NUMBER: ${{ github.event.number }}
run: | run: |
alias_tags="$(just generate-build-tags \ alias_tags="$(just generate-build-tags \
"${MATRIX_BASE_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_STREAM_NAME}" \ --tag "${MATRIX_STREAM_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --flavor "${MATRIX_IMAGE_FLAVOR}" \
"${INPUTS_KERNEL_PIN}" \ --ghcr \
"1" \ --github-event "${GITHUB_EVENT_NAME}" \
"$(podman inspect ${IMAGE_NAME}:${MATRIX_STREAM_NAME} | jq -r '.[].Config.Labels["org.opencontainers.image.version"]')" \ --github-number "${GITHUB_EVENT_NUMBER}")"
"${GITHUB_EVENT_NAME}" \
"${GITHUB_EVENT_NUMBER}")"
echo "Tags for this Action..." echo "Tags for this Action..."
echo "$alias_tags" echo "$alias_tags"
@ -327,9 +332,10 @@ jobs:
ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }} ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }}
run: | run: |
set -eoux pipefail set -eoux pipefail
sudo -E $(command -v just) tag-images "${IMAGE_NAME}" \ sudo -E $(command -v just) tag-images \
"${MATRIX_STREAM_NAME}" \ --image "${IMAGE_NAME}" \
"${ALIAS_TAGS}" --default-tag "${MATRIX_STREAM_NAME}" \
--tags "${ALIAS_TAGS}"
- name: Login to GitHub Container Registry - name: Login to GitHub Container Registry
if: inputs.publish if: inputs.publish
@ -364,13 +370,13 @@ jobs:
set -euox pipefail set -euox pipefail
sudo -E $(command -v just) push-image \ sudo -E $(command -v just) push-image \
"${MATRIX_BASE_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_STREAM_NAME}" \ --tag "${MATRIX_STREAM_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --flavor "${MATRIX_IMAGE_FLAVOR}" \
"1" \ --ghcr \
"${IMAGE_REGISTRY}" \ --registry "${IMAGE_REGISTRY}" \
"1" \ --temp-push \
"${TEMP_PUSH_TAG}" --temp-push-tag "${TEMP_PUSH_TAG}"
digest=$(< /tmp/digestfile) digest=$(< /tmp/digestfile)
echo "digest=${digest}" >> $GITHUB_OUTPUT echo "digest=${digest}" >> $GITHUB_OUTPUT
@ -404,11 +410,11 @@ jobs:
set -euox pipefail set -euox pipefail
sudo -E $(command -v just) push-image \ sudo -E $(command -v just) push-image \
"${MATRIX_BASE_NAME}" \ --image "${MATRIX_BASE_NAME}" \
"${MATRIX_STREAM_NAME}" \ --tag "${MATRIX_STREAM_NAME}" \
"${MATRIX_IMAGE_FLAVOR}" \ --flavor "${MATRIX_IMAGE_FLAVOR}" \
"1" \ --ghcr \
"${IMAGE_REGISTRY}" --registry "${IMAGE_REGISTRY}"
digest=$(< /tmp/digestfile) digest=$(< /tmp/digestfile)
echo "digest=${digest}" >> $GITHUB_OUTPUT echo "digest=${digest}" >> $GITHUB_OUTPUT

387
Justfile
View file

@ -1,3 +1,4 @@
# Min just version 1.46.0 https://github.com/casey/just/issues/2290
export repo_organization := env("GITHUB_REPOSITORY_OWNER", "ublue-os") export repo_organization := env("GITHUB_REPOSITORY_OWNER", "ublue-os")
export base_image_org := env("BASE_IMAGE_ORG", "quay.io/fedora-ostree-desktops") export base_image_org := env("BASE_IMAGE_ORG", "quay.io/fedora-ostree-desktops")
export base_image_name := env("BASE_IMAGE_NAME", "kinoite") export base_image_name := env("BASE_IMAGE_NAME", "kinoite")
@ -62,7 +63,7 @@ default:
# Check Just Syntax # Check Just Syntax
[group('Just')] [group('Just')]
check: check:
#!/usr/bin/bash #!/usr/bin/env bash
find . -type f -name "*.just" | while read -r file; do find . -type f -name "*.just" | while read -r file; do
echo "Checking syntax: $file" echo "Checking syntax: $file"
{{ just }} --fmt --check -f $file {{ just }} --fmt --check -f $file
@ -73,7 +74,7 @@ check:
# Fix Just Syntax # Fix Just Syntax
[group('Just')] [group('Just')]
fix: fix:
#!/usr/bin/bash #!/usr/bin/env bash
find . -type f -name "*.just" | while read -r file; do find . -type f -name "*.just" | while read -r file; do
echo "Checking syntax: $file" echo "Checking syntax: $file"
{{ just }} --fmt -f $file {{ just }} --fmt -f $file
@ -84,7 +85,7 @@ fix:
# Clean Repo # Clean Repo
[group('Utility')] [group('Utility')]
clean: clean:
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
rm -f changelog.md rm -f changelog.md
rm -f output.env rm -f output.env
@ -92,11 +93,14 @@ clean:
rm -f /tmp/aurora*-tags.json rm -f /tmp/aurora*-tags.json
# Check if valid combo # Check if valid combo
[group('Utility')] [arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[private] [private]
validate $image $tag $flavor: validate $image $tag $flavor:
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
declare -A images={{ images }} declare -A images={{ images }}
declare -A tags={{ tags }} declare -A tags={{ tags }}
declare -A flavors={{ flavors }} declare -A flavors={{ flavors }}
@ -120,26 +124,56 @@ validate $image $tag $flavor:
fi fi
# Build Image # Build Image
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("image", long="image", short="i")]
[arg("kernel_pin", long="kernel-pin")]
[arg("rechunk", long="rechunk", value="true")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline="0" $kernel_pin="": build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false" $kernel_pin="":
#!/usr/bin/bash #!/usr/bin/env bash
echo "::group:: Build Prep"
set -eoux pipefail set -eoux pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate "${image}" "${tag}" "${flavor}"
# Image Name image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) akmods_flavor=$({{ just }} akmods_flavor --tag "${tag}")
akmods_flavor=$({{ just }} akmods_flavor {{ tag }}) fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
# Verify Base Image with cosign # Verify Base Image with cosign
{{ just }} verify-container quay.io-fedora-ostree-desktops.pub ${base_image_org}/${base_image_name}:${fedora_version} {{ just }} verify-container quay.io-fedora-ostree-desktops.pub ${base_image_org}/${base_image_name}:${fedora_version}
# Kernel Release/Pin # Here we pin our kernels to workaround regressions!
# skopeo list-tags docker://ghcr.io/ublue-os/akmods | jq -r '.Tags | map(select(contains("coreos-stable-44")))'
ARCH=$(arch)
case "${tag}" in
stable)
if [[ "${ARCH}" == "x86_64" ]]; then
# <Here is a link why we have it pinned>
kernel_pin=""
elif [[ "${ARCH}" == "aarch64" ]]; then
kernel_pin=""
fi
;;
latest)
if [[ "${ARCH}" == "x86_64" ]]; then
kernel_pin=""
elif [[ "${ARCH}" == "aarch64" ]]; then
kernel_pin=""
fi
;;
testing)
if [[ "${ARCH}" == "x86_64" ]]; then
kernel_pin=""
elif [[ "${ARCH}" == "aarch64" ]]; then
kernel_pin=""
fi
;;
esac
if [[ -z "${kernel_pin:-}" ]]; then if [[ -z "${kernel_pin:-}" ]]; then
kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]') kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]')
else else
@ -175,7 +209,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
ver="${tag}-${fedora_version}.${TIMESTAMP}" ver="${tag}-${fedora_version}.${TIMESTAMP}"
fi fi
POINT=$({{ just }} generate-point {{ image }} {{ tag }} {{ flavor }}) POINT=$({{ just }} generate-point --image "${image}" --tag "${tag}" --flavor "${flavor}")
ver="${ver}.$POINT" ver="${ver}.$POINT"
# Build Arguments # Build Arguments
@ -225,8 +259,6 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
fi fi
LABELS+=("--label" "ostree.linux=${kernel_release}") LABELS+=("--label" "ostree.linux=${kernel_release}")
echo "::endgroup::"
case "${akmods_flavor}" in case "${akmods_flavor}" in
"coreos-stable") BUILD_ARGS+=("--cpp-flag=-DZFS") ;; "coreos-stable") BUILD_ARGS+=("--cpp-flag=-DZFS") ;;
esac esac
@ -256,44 +288,24 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
${BUILDAH} build "${PODMAN_BUILD_ARGS[@]}" . ${BUILDAH} build "${PODMAN_BUILD_ARGS[@]}" .
echo "::endgroup::" echo "::endgroup::"
# Rechunk the image if we are running inside ghcr or set the variable locally
if [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" && "{{ pipeline }}" == "1" ]]; then
${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" 1 1
elif [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" ]]; then
${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" 1
elif [[ "{{ rechunk }}" == "1" ]]; then
{{ just }} rechunk "${image}" "${tag}" "${flavor}"
fi
# Build Image and Rechunk # Build Image and Rechunk
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("kernel_pin", long="kernel-pin")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
build-rechunk image="aurora" tag="latest" flavor="main" kernel_pin="": build-rechunk $image="aurora" $tag="latest" $flavor="main" kernel_pin="": (build image tag flavor kernel_pin) (rechunk image tag flavor)
@{{ just }} build {{ image }} {{ tag }} {{ flavor }} 1 0 0 {{ kernel_pin }}
# Build Image with GHCR Flag
[group('Image')]
build-ghcr image="aurora" tag="latest" flavor="main" kernel_pin="":
#!/usr/bin/bash
if [[ "${UID}" -gt "0" ]]; then
echo "Must Run with sudo or as root..."
exit 1
fi
{{ just }} build {{ image }} {{ tag }} {{ flavor }} 0 1 0 {{ kernel_pin }}
# Build Image for Pipeline:
[group('Image')]
build-pipeline image="aurora" tag="latest" flavor="main" kernel_pin="":
#!/usr/bin/bash
${SUDOIF} {{ just }} build {{ image }} {{ tag }} {{ flavor }} 1 1 1 {{ kernel_pin }}
# Rechunk Image # Rechunk Image
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": rechunk $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
{{ just }} validate {{ image }} {{ tag }} {{ flavor }} {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
export CHUNKAH_CONFIG_STR=$(${PODMAN} inspect "${image_name}:${tag}") export CHUNKAH_CONFIG_STR=$(${PODMAN} inspect "${image_name}:${tag}")
@ -310,25 +322,27 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0":
--tag "${image_name}:${tag}" | ${PODMAN} load --tag "${image_name}:${tag}" | ${PODMAN} load
# build-chunked-oci # build-chunked-oci
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("image", long="image", short="i")]
[arg("previous_build", long="previous-build", value="true")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
ostree-rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0" previous_build="0": ostree-rechunk $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $previous_build="false":
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate "${image}" "${tag}" "${flavor}" image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
# Image Name if [[ "{{ ghcr }}" == "false" ]]; then
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) {{ just }} load-rootful --image "${image}" --tag "${tag}" --flavor "${flavor}"
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}')
if [[ "{{ ghcr }}" == "0" ]]; then
{{ just }} load-rootful "${image}" "${tag}" "${flavor}"
fi fi
# TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+ # TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+
# so we don't have to pull an old image + rename it # so we don't have to pull an old image + rename it
if [[ "{{ previous_build }}" == "1" ]]; then if [[ "${previous_build}" == "true" ]]; then
PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${tag}" PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${tag}"
# https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529 # https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529
@ -339,9 +353,9 @@ ostree-rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0
fi fi
fi fi
if [[ "{{ ghcr }}" == "1" ]]; then if [[ "${ghcr}" == "true" ]]; then
CHUNKED_IMAGE="${image_name}:${tag}" CHUNKED_IMAGE="${image_name}:${tag}"
if [[ "{{ previous_build }}" == "1" ]]; then if [[ "${previous_build}" == "true" ]]; then
CHUNKED_IMAGE="${PREVIOUS_IMAGE}" CHUNKED_IMAGE="${PREVIOUS_IMAGE}"
fi fi
else else
@ -366,27 +380,22 @@ ostree-rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0
--output containers-storage:${CHUNKED_IMAGE} --output containers-storage:${CHUNKED_IMAGE}
# rename the image to localhost # rename the image to localhost
if [[ "{{ ghcr }}" == "1" && "{{ previous_build }}" == "1" ]]; then if [[ "${ghcr}" == "true" && "${previous_build}" == "true" ]]; then
${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "${image_name}:${tag}" ${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "${image_name}:${tag}"
${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE} ${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE}
fi fi
# Pipeline Checks
if [[ {{ pipeline }} == "1" && -n "${SUDO_USER:-}" ]]; then
sudo -u "${SUDO_USER}" {{ just }} secureboot "${image}" "${tag}" "${flavor}"
fi
# For Privileged operations # For Privileged operations
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
load-rootful $image="aurora" $tag="latest" $flavor="main": load-rootful $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -oux pipefail set -oux pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate {{ image }} {{ tag }} {{ flavor }} image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
if [[ ! "$(id -u)" == 0 ]]; then if [[ ! "$(id -u)" == 0 ]]; then
ID=$(${PODMAN} images --filter reference="${image_name}:${tag}" --format "'{{ '{{.ID}}' }}'") ID=$(${PODMAN} images --filter reference="${image_name}:${tag}" --format "'{{ '{{.ID}}' }}'")
@ -397,33 +406,32 @@ load-rootful $image="aurora" $tag="latest" $flavor="main":
fi fi
# Generate OCI Archive for PR Testing # Generate OCI Archive for PR Testing
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Utility')] [group('Utility')]
export-oci $image="aurora" $tag="latest" $flavor="main": export-oci $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -oux pipefail set -oux pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate {{ image }} {{ tag }} {{ flavor }} image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
ARCHIVE_NAME="${image_name}"-"$(arch)".oci ARCHIVE_NAME="${image_name}"-"$(arch)".oci
${PODMAN} push --compression-format=zstd --compression-level=3 "${image_name}:${tag}" oci-archive:"${ARCHIVE_NAME}" ${PODMAN} push --compression-format=zstd --compression-level=3 "${image_name}:${tag}" oci-archive:"${ARCHIVE_NAME}"
# Run Container # Run Container
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Image')] [group('Image')]
run $image="aurora" $tag="latest" $flavor="main": run $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate "${image}" "${tag}" "${flavor}" image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
# Check if image exists # Check if image exists
ID=$(${PODMAN} images --filter reference="${image_name}:${tag}" --format "'{{ '{{.ID}}' }}'") ID=$(${PODMAN} images --filter reference="${image_name}:${tag}" --format "'{{ '{{.ID}}' }}'")
if [[ -z "$ID" ]]; then if [[ -z "$ID" ]]; then
@ -436,14 +444,14 @@ run $image="aurora" $tag="latest" $flavor="main":
# Test Changelogs # Test Changelogs
[group('Changelogs')] [group('Changelogs')]
changelogs branch="stable" handwritten="": changelogs branch="stable" handwritten="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
python3 ./.github/changelogs.py "{{ branch }}" ./output.env ./changelog.md --workdir . --handwritten "{{ handwritten }}" python3 ./.github/changelogs.py "{{ branch }}" ./output.env ./changelog.md --workdir . --handwritten "{{ handwritten }}"
# Verify Container with Cosign # Verify Container with Cosign
[group('Utility')] [group('Utility')]
verify-container key="" container="": verify-container key="" container="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
# Get Cosign if Needed # Get Cosign if Needed
@ -468,16 +476,16 @@ verify-container key="" container="":
fi fi
# Secureboot Check # Secureboot Check
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Utility')] [group('Utility')]
secureboot $image="aurora" $tag="latest" $flavor="main": secureboot $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
# Validate {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
{{ just }} validate "${image}" "${tag}" "${flavor}" image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
# Image Name
image_name=$({{ just }} image_name ${image} ${tag} ${flavor})
# Get the vmlinuz to check # Get the vmlinuz to check
kernel_release=$(${PODMAN} inspect "${image_name}":"${tag}" | jq -r '.[].Config.Labels["ostree.linux"]') kernel_release=$(${PODMAN} inspect "${image_name}":"${tag}" | jq -r '.[].Config.Labels["ostree.linux"]')
@ -519,11 +527,15 @@ secureboot $image="aurora" $tag="latest" $flavor="main":
exit "$returncode" exit "$returncode"
# Get Fedora Version of an image # Get Fedora Version of an image
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[private] [private]
fedora_version image="aurora" tag="latest" flavor="main" $kernel_pin="": fedora_version image="aurora" tag="latest" flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
{{ just }} validate {{ image }} {{ tag }} {{ flavor }}
{{ just }} validate --image {{ image }} --tag {{ tag }} --flavor {{ flavor }}
# Determine Version # Determine Version
if [[ "{{ tag }}" =~ stable ]]; then if [[ "{{ tag }}" =~ stable ]]; then
@ -536,15 +548,15 @@ fedora_version image="aurora" tag="latest" flavor="main" $kernel_pin="":
echo "${VERSION}" echo "${VERSION}"
[arg("tag", long="tag", short="t")]
[private] [private]
akmods_flavor $tag="latest": akmods_flavor tag="latest":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
if [[ "${tag}" =~ stable ]]; then if [[ "{{ tag }}" =~ stable ]]; then
akmods_flavor="coreos-stable" akmods_flavor="coreos-stable"
elif [[ "${tag}" =~ testing ]]; then elif [[ "{{ tag }}" =~ testing ]]; then
akmods_flavor="main" akmods_flavor="main"
else else
akmods_flavor="main" akmods_flavor="main"
@ -553,53 +565,62 @@ akmods_flavor $tag="latest":
echo "${akmods_flavor}" echo "${akmods_flavor}"
# Image Name # Image Name
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[private] [private]
image_name image="aurora" tag="latest" flavor="main": image_name image="aurora" tag="latest" flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eoux pipefail
{{ just }} validate {{ image }} {{ tag }} {{ flavor }}
{{ just }} validate --image {{ image }} --tag {{ tag }} --flavor {{ flavor }}
if [[ "{{ flavor }}" =~ main ]]; then if [[ "{{ flavor }}" =~ main ]]; then
image_name={{ image }} image_name={{ image }}
else else
image_name="{{ image }}-{{ flavor }}" image_name="{{ image }}-{{ flavor }}"
fi fi
echo "${image_name}" echo "${image_name}"
# Generate Tags # Generate Tags
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("github_event", long="github-event")]
[arg("github_number", long="github-number")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[arg("version", long="version")]
[group('Utility')] [group('Utility')]
generate-build-tags image="aurora" tag="latest" flavor="main" kernel_pin="" ghcr="0" $version="" github_event="" github_number="": generate-build-tags $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $version="" $github_event="" $github_number="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eoux pipefail
FEDORA_VERSION="$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')" FEDORA_VERSION=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
IMAGE_NAME=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) IMAGE_NAME=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
TIMESTAMP="$(date +%Y%m%d)" TIMESTAMP="$(date +%Y%m%d)"
if [[ -z "${version:-}" ]]; then version="${FEDORA_VERSION}.${TIMESTAMP}"
version="{{ tag }}-${FEDORA_VERSION}.${TIMESTAMP}"
fi
version=${version#{{ tag }}-}
BUILD_TAGS=() BUILD_TAGS=()
COMMIT_TAGS=() COMMIT_TAGS=()
# Commit Tags # Commit Tags
github_number="{{ github_number }}" github_number="${github_number}"
SHA_SHORT="$(git rev-parse --short HEAD)" SHA_SHORT="$(git rev-parse --short HEAD)"
if [[ "{{ ghcr }}" == "1" ]]; then if [[ "${ghcr}" == "true" ]]; then
COMMIT_TAGS+=(pr-${github_number:-}-{{ tag }}-${version}) COMMIT_TAGS+=(pr-${github_number:-}-${tag}-${version})
COMMIT_TAGS+=(${SHA_SHORT}-{{ tag }}-${version}) COMMIT_TAGS+=(${SHA_SHORT}-${tag}-${version})
fi fi
POINT=$({{ just }} generate-point {{ image }} {{ tag }} {{ flavor }}) POINT=$({{ just }} generate-point --image "${image}" --tag "${tag}" --flavor "${flavor}")
# These are always used regardless of the stream # These are always used regardless of the stream
COMMON_TAGS=() COMMON_TAGS=()
COMMON_TAGS+=("{{ tag }}") COMMON_TAGS+=("${tag}")
COMMON_TAGS+=("{{ tag }}-${version}") COMMON_TAGS+=("${tag}-${version}")
COMMON_TAGS+=("{{ tag }}-${version:3}") COMMON_TAGS+=("${tag}-${version:3}")
COMMON_TAGS+=("{{ tag }}-${version}.${POINT}") COMMON_TAGS+=("${tag}-${version}.${POINT}")
COMMON_TAGS+=("{{ tag }}-${version:3}.${POINT}") COMMON_TAGS+=("${tag}-${version:3}.${POINT}")
BUILD_TAGS=("${COMMON_TAGS[@]}" "${BUILD_TAGS[@]}") BUILD_TAGS=("${COMMON_TAGS[@]}" "${BUILD_TAGS[@]}")
@ -622,7 +643,7 @@ generate-build-tags image="aurora" tag="latest" flavor="main" kernel_pin="" ghcr
BUILD_TAGS+=("${FEDORA_VERSION}-${version:3}.${POINT}") BUILD_TAGS+=("${FEDORA_VERSION}-${version:3}.${POINT}")
fi fi
github_event="{{ github_event }}" github_event="${github_event}"
if [[ "${github_event}" == "pull_request" ]]; then if [[ "${github_event}" == "pull_request" ]]; then
alias_tags=("${COMMIT_TAGS[@]}") alias_tags=("${COMMIT_TAGS[@]}")
@ -633,12 +654,16 @@ generate-build-tags image="aurora" tag="latest" flavor="main" kernel_pin="" ghcr
echo "${alias_tags[*]}" echo "${alias_tags[*]}"
# Get Index Point for multiple daily images # Get Index Point for multiple daily images
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[private] [private]
generate-point image="aurora" tag="latest" flavor="main": generate-point $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
IMAGE_NAME=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
IMAGE_NAME=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
TIMESTAMP="$(date +%Y%m%d)" TIMESTAMP="$(date +%Y%m%d)"
tags="/tmp/${IMAGE_NAME}-tags.json" tags="/tmp/${IMAGE_NAME}-tags.json"
@ -647,10 +672,10 @@ generate-point image="aurora" tag="latest" flavor="main":
skopeo list-tags docker://ghcr.io/{{ repo_organization }}/${IMAGE_NAME} > "${tags}" skopeo list-tags docker://ghcr.io/{{ repo_organization }}/${IMAGE_NAME} > "${tags}"
fi fi
if [[ $(jq --arg tag "{{ tag }}" --arg timestamp "${TIMESTAMP}" 'any(.Tags[]; contains($tag + "-" + $timestamp))' < "${tags}") == "true" ]]; then if [[ $(jq --arg tag "${tag}" --arg timestamp "${TIMESTAMP}" 'any(.Tags[]; contains($tag + "-" + $timestamp))' < "${tags}") == "true" ]]; then
# our image already exists, so find the highest POINT # our image already exists, so find the highest POINT
POINT=$(jq -r --arg tag "{{ tag }}" --arg timestamp "${TIMESTAMP}" \ POINT=$(jq -r --arg tag "${tag}" --arg timestamp "${TIMESTAMP}" \
'($tag + "-" + $timestamp) as $base | [ .Tags[] | select(startswith($base + ".")) ] | sort_by(split(".")[-1] '($tag + "-" + $timestamp) as $base | [ .Tags[] | select(startswith($base + ".")) ] | sort_by(split(".")[-1]
| tonumber) | tonumber)
|.[-1] | if . == null then "1" else split(".")[-1] end' < "${tags}") |.[-1] | if . == null then "1" else split(".")[-1] end' < "${tags}")
@ -665,30 +690,38 @@ generate-point image="aurora" tag="latest" flavor="main":
echo "${POINT}" echo "${POINT}"
# Tag Images # Tag Images
[arg("default_tag", long="default-tag")]
[arg("image", long="image", short="i")]
[arg("tags", long="tags")]
[group('Utility')] [group('Utility')]
tag-images image_name="" default_tag="" tags="": tag-images $image="" $default_tag="" $tags="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eoux pipefail
# Get Image, and untag # Get Image, and untag
IMAGE=$(${PODMAN} inspect {{ image_name }}:{{ default_tag }} | jq -r .[].Id) IMAGE=$(${PODMAN} inspect "${image}:${default_tag}" | jq -r .[].Id)
${PODMAN} untag localhost/{{ image_name }}:{{ default_tag }} ${PODMAN} untag localhost/"${image}:${default_tag}"
# Tag Image # Tag Image
for tag in {{ tags }}; do # Do not quote this, we want word splitting here
${PODMAN} tag $IMAGE {{ image_name }}:${tag} for tag in ${tags}; do
${PODMAN} tag $IMAGE ${image}:${tag}
done done
# Show Images # Show Images
${PODMAN} images ${PODMAN} images
# Extract Container and generate SBOM # Extract Container and generate SBOM
[arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Utility')] [group('Utility')]
gen-sbom $image="aurora" $tag="latest" $flavor="main" $syft_cmd="syft": gen-sbom $image="aurora" $tag="latest" $flavor="main" $syft_cmd="syft":
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
image_name=$({{ just }} image_name '{{ image }}' '{{ tag }}' '{{ flavor }}') {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
OUT_DIR="sbom_out/${image_name}" OUT_DIR="sbom_out/${image_name}"
mkdir -p "${OUT_DIR}" mkdir -p "${OUT_DIR}"
@ -711,22 +744,27 @@ gen-sbom $image="aurora" $tag="latest" $flavor="main" $syft_cmd="syft":
rm -rf "${ROOTFS}" rm -rf "${ROOTFS}"
# DNF CI package cache # DNF CI package cache
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("github_event", long="github-event")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Utility')] [group('Utility')]
[private] [private]
setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $github_event="0": setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $github_event="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eou pipefail set -eou pipefail
image_name=$({{ just }} image_name '{{ image }}' '{{ tag }}' '{{ flavor }}') image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}') fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
ALLOW_CACHE_WRITE="false" ALLOW_CACHE_WRITE="false"
BLESSED_IMAGE=aurora-dx BLESSED_IMAGE=aurora-dx
if [[ "${image_name}" == "${BLESSED_IMAGE}" ]] && \ if [[ "${image_name}" == "${BLESSED_IMAGE}" ]] && \
[[ "{{ ghcr }}" == "1" ]] && \ [[ "${ghcr}" == "true" ]] && \
[[ "${github_event}" == "workflow_dispatch" || "${github_event}" == "schedule" ]]; then [[ "${github_event}" == "workflow_dispatch" || "${github_event}" == "schedule" ]]; then
ALLOW_CACHE_WRITE="true" ALLOW_CACHE_WRITE="true"
fi fi
@ -735,13 +773,16 @@ setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $github_event
echo "${CACHE_NAME}" "${ALLOW_CACHE_WRITE}" echo "${CACHE_NAME}" "${ALLOW_CACHE_WRITE}"
[group('Utility')] [arg("flavor", long="flavor", short="f")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[private] [private]
bootc $image="aurora" $tag="latest" $flavor="main" *ARGS: bootc $image="aurora" $tag="latest" $flavor="main" *ARGS:
#!/usr/bin/env bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
BOOTC_INSTALL_OPTIONS=() BOOTC_INSTALL_OPTIONS=()
BOOTC_INSTALL_OPTIONS+=("-v" "/var/lib/containers:/var/lib/containers" "-v" "/etc/containers:/etc/containers") BOOTC_INSTALL_OPTIONS+=("-v" "/var/lib/containers:/var/lib/containers" "-v" "/etc/containers:/etc/containers")
@ -759,13 +800,18 @@ bootc $image="aurora" $tag="latest" $flavor="main" *ARGS:
"${image_name}:${tag}" bootc {{ ARGS }} "${image_name}:${tag}" bootc {{ ARGS }}
# Create bootable image # Create bootable image
[arg("backend", long="backend")]
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("image", long="image", short="i")]
[arg("tag", long="tag", short="t")]
[group('Utility')] [group('Utility')]
disk-image $image="aurora" $tag="latest" $flavor="main" ghcr="0" $backend="ostree": disk-image $image="aurora" $tag="latest" $flavor="main" ghcr="false" $backend="ostree":
#!/usr/bin/env bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
# this is enough for base aurora to make it more likely to run in CI # this is enough for base aurora to make it more likely to run in CI
if [[ "{{ ghcr }}" == "1" ]]; then if [[ "${ghcr}" == "true" ]]; then
# absurd size so it will always be enough for the image # absurd size so it will always be enough for the image
IMG_SIZE=35G IMG_SIZE=35G
else else
@ -801,9 +847,16 @@ disk-image $image="aurora" $tag="latest" $flavor="main" ghcr="0" $backend="ostre
# Once https://github.com/containers/podman/issues/27796 is resolved # Once https://github.com/containers/podman/issues/27796 is resolved
# Push Image to Registry # Push Image to Registry
[arg("flavor", long="flavor", short="f")]
[arg("ghcr", long="ghcr", value="true")]
[arg("image", long="image", short="i")]
[arg("registry", long="registry")]
[arg("tag", long="tag", short="t")]
[arg("temp_push", long="temp-push", value="true")]
[arg("temp_push_tag", long="temp-push-tag")]
[group('Utility')] [group('Utility')]
push-image $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $image_registry="" $temp_push="0" $temp_push_tag="": push-image $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $registry="" $temp_push="false" $temp_push_tag="":
#!/usr/bin/bash #!/usr/bin/env bash
set -eoux pipefail set -eoux pipefail
PUSH_CMD_ARGS=() PUSH_CMD_ARGS=()
@ -815,25 +868,25 @@ push-image $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $image_registr
PUSH_CMD=""${PODMAN}" push "${PUSH_CMD_ARGS[@]}"" PUSH_CMD=""${PODMAN}" push "${PUSH_CMD_ARGS[@]}""
image_name=$({{ just }} image_name '{{ image }}' '{{ tag }}' '{{ flavor }}') image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
alias_tags=$({{ just }} generate-build-tags '{{ image }}' '{{ tag }}' '{{ flavor }}') alias_tags=$({{ just }} generate-build-tags --image "${image}" --tag "${tag}" --flavor "${flavor}")
if [[ "{{ ghcr }}" == "1" && -n "${image_registry}" ]]; then if [[ "${ghcr}" == "true" && -n "${registry}" ]]; then
if [[ "${temp_push}" == "0" ]]; then if [[ "${temp_push}" == "false" ]]; then
for tag in ${alias_tags}; do for tag in ${alias_tags}; do
${PUSH_CMD} ${image_name}:${tag} ${image_registry}/${image_name}:${tag} ${PUSH_CMD} ${image_name}:${tag} ${registry}/${image_name}:${tag}
# We need to push twice to workaround https://github.com/containers/podman/issues/27796 # We need to push twice to workaround https://github.com/containers/podman/issues/27796
${PUSH_CMD} ${image_name}:${tag} ${image_registry}/${image_name}:${tag} ${PUSH_CMD} ${image_name}:${tag} ${registry}/${image_name}:${tag}
cat /tmp/digestfile cat /tmp/digestfile
done done
elif [[ "${temp_push}" == "1" ]]; then elif [[ "${temp_push}" == "true" ]]; then
${PUSH_CMD} ${image_name}:${tag} ${image_registry}/${image_name}:${temp_push_tag}-${tag} ${PUSH_CMD} ${image_name}:${tag} ${registry}/${image_name}:${temp_push_tag}-${tag}
# We need to push twice to workaround https://github.com/containers/podman/issues/27796 # We need to push twice to workaround https://github.com/containers/podman/issues/27796
# If we don't do this then the digest changes and we are only signing this specific tag # If we don't do this then the digest changes and we are only signing this specific tag
${PUSH_CMD} ${image_name}:${tag} ${image_registry}/${image_name}:${temp_push_tag}-${tag} ${PUSH_CMD} ${image_name}:${tag} ${registry}/${image_name}:${temp_push_tag}-${tag}
fi fi
else else
@ -844,7 +897,7 @@ push-image $image="aurora" $tag="latest" $flavor="main" $ghcr="0" $image_registr
# Login to Container Registry # Login to Container Registry
[group('Utility')] [group('Utility')]
login-registry bin="" registry="": login-registry bin="" registry="":
#!/bin/bash #!/usr/bin/env bash
set -euxo pipefail set -euxo pipefail
{{ retry_function }} {{ retry_function }}
@ -865,7 +918,7 @@ login-registry bin="" registry="":
# Retag images on GHCR # Retag images on GHCR
[group('Admin')] [group('Admin')]
retag-nvidia-on-ghcr working_tag="" stream="" dry_run="1": retag-nvidia-on-ghcr working_tag="" stream="" dry_run="1":
#!/bin/bash #!/usr/bin/env bash
set -euxo pipefail set -euxo pipefail
skopeo="echo === skopeo" skopeo="echo === skopeo"
if [[ "{{ dry_run }}" -ne 1 ]]; then if [[ "{{ dry_run }}" -ne 1 ]]; then