aurora/.forgejo/workflows/build-arm64.yml

name: Build Aurora (arm64)

# Builds Aurora for arm64 from this tree and pushes it as
# forge.quinefoundation.com/quine-global-labs/aurora:stable-arm64 (plus
# stable-arm64-<date>). quine-global-labs/quine-linux's arm64 build is FROM
# it. A separate tag, not part of `stable`: build.yml pushes `stable` (amd64)
# daily and would drop an arm64 half each time.
#
# Upstream doesn't ship arm64 Aurora yet, and has no arm64 akmods, which is
# also where Aurora's kernel comes from. So this build uses Fedora's own
# aarch64 kernel, the one Kinoite ships, from a stand-in akmods image
# (.forgejo/akmods-arm64.sh), with no extra kmods.
#
# Runs natively on runner-arm64-linux (petersweb-infra, a Tart VM on the Mac
# mini), daily, an hour after build.yml. It builds this repo's main as
# build.yml last merged it, without merging upstream itself. (Until
# 2026-11-04 it ran weekly under QEMU emulation on runner-x86-linux; it
# still works there, slowly, through buildah-arm64.)
#
# Secret: REGISTRY_TOKEN, as build.yml. Variable (optional): REGISTRY_USER.
on:
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:

concurrency:
  group: aurora-arm64-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: forge.quinefoundation.com
  MIRRORS: https://forge.quinefoundation.com/quine-global-labs
  IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
  TAG: stable

jobs:
  build:
    runs-on: runner-arm64-linux
    timeout-minutes: 300
    steps:
      - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
        with:
          fetch-depth: 0

      - name: Build main as it is now
        # A scheduled run checks out the commit its schedule was registered
        # at, which can be behind main (see build.yml).
        if: github.event_name == 'schedule'
        run: |
          git fetch --no-tags origin main
          git checkout -B main FETCH_HEAD          

      - name: Point downloads at our mirrors
        # As build.yml.
        run: |
          files=$(grep -rlE 'github(usercontent)?\.com/(ublue-os/(akmods|countme)|rcaloras/bash-preexec|coreos/fedora-coreos-config)/' build_scripts)
          sed -i -E \
            -e "s#https://github\.com/ublue-os/akmods/raw/refs/heads/([^/]+)/#$MIRRORS/mirror-ublue-os-akmods/raw/branch/\1/#g" \
            -e "s#https://raw\.githubusercontent\.com/ublue-os/countme/([^/]+)/#$MIRRORS/mirror-ublue-os-countme/raw/branch/\1/#g" \
            -e "s#https://raw\.githubusercontent\.com/rcaloras/bash-preexec/([0-9a-f]{40})/#$MIRRORS/mirror-rcaloras-bash-preexec/raw/commit/\1/#g" \
            -e "s#https://raw\.githubusercontent\.com/coreos/fedora-coreos-config/refs/heads/([^/]+)/#$MIRRORS/mirror-coreos-fedora-coreos-config/raw/branch/\1/#g" \
            $files
          git update-index --skip-worktree $files          

      - name: Adapt the build scripts to arm64
        # 01-packages.sh: drop what Fedora builds for x86_64 only. Checked
        # against Fedora 44 + negativo17's aarch64 repos (2026-11-04): just
        # intel-compute-runtime.
        # 19-initramfs.sh: it asks rpm for kmod-v4l2loopback's files, which
        # fails without the package, and the stand-in akmods has no kmods.
        # "none" keeps dracut's --remove argument in place, naming no module.
        run: |
          sed -i -E '/^[[:space:]]*intel-compute-runtime[[:space:]]*$/d' build_scripts/base/01-packages.sh
          sed -i 's|^V4L2_PATH="$(rpm -ql kmod-v4l2loopback)"$|V4L2_PATH="$(rpm -q --quiet kmod-v4l2loopback \&\& rpm -ql kmod-v4l2loopback \|\| echo none)"|' build_scripts/base/19-initramfs.sh
          grep -q 'echo none' build_scripts/base/19-initramfs.sh
          git update-index --skip-worktree build_scripts/base/01-packages.sh build_scripts/base/19-initramfs.sh          

      - name: Log in to the registry
        env:
          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin

      - name: Vendor upstream images, and the arm64 akmods stand-in
        run: |
          org=$(just --evaluate base_image_org)
          name=$(just --evaluate base_image_name)
          ver=$(just fedora_version --image aurora --tag "$TAG" --flavor main)
          flavor=$(just akmods_flavor --tag "$TAG")
          mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
          .forgejo/vendor-images.sh "$org/$name:$ver" "${pinned[@]}"
          # The kernel Kinoite's arm64 image ships.
          kernel=$(skopeo --registries-conf /dev/null inspect --override-arch arm64 --override-os linux \
                     --no-tags --retry-times 3 "docker://$org/$name:$ver" | jq -er '.Labels["ostree.linux"]')
          echo "kernel: $kernel"
          # Quay's tag has been single-arch (amd64) for a while mid-publish.
          [[ $kernel == *.aarch64 ]] || { echo "::error::$org/$name:$ver has no arm64 image right now (kernel $kernel); try again later"; exit 1; }
          echo "KERNEL=$kernel" >>"$GITHUB_ENV"
          .forgejo/akmods-arm64.sh "$flavor" "$ver" "$kernel"          

      - name: Build
        # As build.yml, through a buildah that builds for linux/arm64, with
        # the kernel pinned to the stand-in's.
        run: >-
          env -u GITHUB_TOKEN
          GITHUB_REPOSITORY_OWNER=ublue-os
          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
          just BUILDAH="$PWD/.forgejo/buildah-arm64"
          build --image aurora --tag "$TAG" --flavor main --kernel-pin "$KERNEL"          

      - name: Push
        run: |
          podman image inspect --format '{{.Architecture}}' "localhost/aurora:$TAG"
          for t in "$TAG-arm64" "$TAG-arm64-$(date -u +%Y%m%d)"; do
            podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
            podman push --retry 5 "$IMAGE:$t"
          done          

      - name: Clean up
        if: always()
        # The runner's hourly sweep keeps a day of images; this build's are
        # done with now.
        run: |
          podman logout "$REGISTRY" || true
          podman image prune -af >/dev/null || true