Instead we can define an environment variable for github actions.
For things where we can't, globs/regex is probably good enough.
When we branch/stabilize "stable-f45" then we will delete the old one
anyway, so we shouldn't be in a situation where we'll get spammed with
like 3 PRs.
The only remaining things where it's hardcoded is the pull config and
docs.
* chore: be explicit about secrets needed for image build
Instead of inheriting *all* the secrets we are only selectively giving
the called workflows access to the secrets we actually need. Currently
we only have one secret we use for image signing but in the future we
may want to have a separate testing key we use to sign testing builds
only made in PRs and things like that.
We may want to look into setting things up in a way so production keys
are only ever used when we push to ublue-os/aurora.
This also happens to make the experience a little bit nicer in new forks
as the workflow will fail right after the start when the SIGNING_SECRET
wasn't set, as opposed to when signing the image.
xref: https://github.com/ublue-os/aurora/issues/2528
* chore: remove secrets from generate-release parts
I don't know why this exists, we don't need our cosign key in this part
of the workflow.
* refactor(ci): initial work for using flag/arg-based workflow
The goal of this is to make the buildsystem function like any other CLI
program. The only recipes I haven't touched in this PR are the very
simple recipes like verify-container, retag-nvidia-ghcr and
login-registry. In the future I want to split up this Justfile in
multiple smaller ones where it feels right to do that.
resolves: https://github.com/ublue-os/aurora/issues/2436
* document minimum just version
* build recipe
* feat: redo the way we do kernel pins
This allows an independent pinning of kernels for future ARM builds
regardless of x86. Probably the way we should have done it from the
beginning.
* get rid of build-ghcr and build-pipeline related things
We are not using the build-pipeline recipe anywhere right now. I think a
build-rechunk recipe is good enough for now.
I think build-ghcr doesn't make any sense anymore as it's now just a
single additional flag. The rechunk recipe with chunkah currently
doesn't alter any behavior when run in ghcr so we can delete this. But
this will likely change when chunkah implements some form of passing a
previous manifest.
I want to do a recipe at some point which replaces the general idea of
the pipeline recipe and is as close to github as possible. Build ->
Rechunk -> Secureboot-> tag + push an image to a local registry bootc
install.
* do deprecated build-chunked-oci recipe
* remove build-pipeline parts of ostree-rechunk
* export oci
* load rootful recipe
currently not used in CI as we are running everything as root.
* secureboot
* generate-point
* gen-sbom
* package cache
* bootc install
* some remaining shebangs
best practice to use env bash here instead
* push recipe
* redo generate-build-tags and tag-images
I removed the version input here. This has been broken for probably a
very long time, this didn't do anything for months at least, oldest log
I could find here:
```
Error: no such object: "aurora:latest"
Tags for this Action...
latest latest-43.20260424 latest-20260424 43 43-43.20260424 43-20260424
```
Kernel input is now done through just, so no reason to pass that, no
idea why we had that here in the first place.
* fix kernel pin for build-rechunk
This convenience recipe needs to take all the options from the build one
Chunkah is actively maintained and the algorithm seems to be more stable
for the layer plan which results in smaller sizes for weekly updates
compared to rpm-ostree. Although it looks like daily updates are
slightly bigger for the time being.
In the future there may be a way to consume previous build manifests as
well to further shrink down image sizes.
I am not deleting the old build-chunked-oci code yet, to make this PR
easier to revert in case we have to.
Rpm-ostree is basically the only blocker for rootless CI, which is
generally what we should be doing, PolP and all that. Now we only need
root privileges for bootc install. Althought to keep this PR more simple
I will implement this later.
It seems like bootc install needs more space now, not sure exactly why
that happens but seems to be related due to pruned /sysroot.
xref https://github.com/ublue-os/aurora/issues/2324
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
* feat(ci): testing stream
* feat(ci): workaround for scheduled stable build on non-default branch
* feat(renovate): initial config for testing stream
We want to get builds that are triggered by kinoite updates from
renovate but promote changes like get-aurora-dev/common and
ublue-os/brew from main to the stable branch, while still receiving
updates for things like github actions.
This is probably the right way to handle the differentiation of PR and
production runs instead of doing it via the not a pull request
condition.
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
* feat(ci): stop building stable-daily images
These do not make super much sense, this is in preparation for the
testing branches so we don't build too many images.
We will still build stable images in PRs to find out if things are
broken on those images only.
To not break existing users, point this to `:stable` instead,
effectively lying about the cadence now. We have to do it this way
because stable-daily has ZFS and `:latest` doesn't to avoid breaking
that use case. In the future when we have removed ZFS we can point this
to `:latest`.
* fix: only publish :stable on schedule
We do not want to publish stable on every PR merge
---------
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
Over time the layer plan due to reuse of the previous build's rechunking
plan might become undesirable/inefficient or due to bugs in rpm-ostree
itself that would trigger issues in the rechunker during the build might
force us to reset the layer plan where we do not consume our previous
build.
* chore: use lightweight ubuntu-slim for moderator
See: https://github.com/ublue-os/aurora/issues/1728
* chore: do not build when moderator.yml changed
remove files that are in get-aurora-dev/{common,iso}
* chore: remove ai slop
* feat: font shadow parity with bluefin
* chore: remove unused banner
* feat: enable color for light mode
* chore: rename first category
* chore: delete unused
* feat: redo basically everything
* feat: make media section more orange
* fix(ci): don't rebuild on entire bazaar dir change
* chore(ci): Turn back weeklies on Tuesdays
Turns weeklies back on but now they build on tuesdays instead of sunday
* modify the time actually to night
Fedora 43 launches next tuesday (28th). Turning of weekly builds for the
time being so wen can land the bigger PRs.
Will run manual weekly build for stable today instead of saturday/sunday
* add aurora copr for anaconda live stuff
* fix(iso): Handle platform differences
* feat(iso): Live ISO using anaconda as the installer
* fix(iso): anaconda artifact name (#2539)
* fix: improve the live anaconda hook
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* add a pull request run if the configure script changes
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* set a funny name
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* fixups
* fixup! set a funny name
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* reorder
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* make our own profiles
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* desktop icon, don't constantly rebuild images
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* figure out how to get libblockdev-btrfs on lts
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* fix: remove gts workflow
* add flatpaks for ISO
* small fixes
* remove the unneeded LTS workflow
* don't hide the parts of the installer
* few small fixes
* remove google fonts from live iso
* remove motd and brew from iso
* un-break building
* add -live notion to ISOs
* ignore image builds
---------
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: Niklas <40402114+NiHaiden@users.noreply.github.com>
* fix(iso): Get Anaconda ISOs updated (#2485)
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: m2 <69128853+m2Giles@users.noreply.github.com>
* fixup
* remove unneeded comment
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
* iso naming to way it was
* fix iso workflow naming
* remove the unneeded iso build from HWE image workflow
* same for stable
* rename stable iso workflow
---------
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: Jorge O. Castro <jorge.castro@gmail.com>
Co-authored-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
