70a5717120
A daily schedule (and Run workflow) first merges github.com/ublue-os/aurora main into ours and pushes the merge, then builds and publishes, picking up upstream's changes and the day's Fedora package updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
83 lines
3.2 KiB
YAML
83 lines
3.2 KiB
YAML
name: Build Aurora
|
|
|
|
# Builds Aurora from this tree (`just build`, the same command upstream's
|
|
# GitHub workflows run) and pushes it to this forge's registry as
|
|
# forge.quinefoundation.com/quine-global-labs/aurora: `stable`, plus
|
|
# `stable-<date>` and the commit. quine-global-labs/quine-linux builds FROM it.
|
|
#
|
|
# This directory existing is also what keeps Forgejo from running upstream's
|
|
# .github/workflows, which it falls back to when there's no .forgejo/workflows.
|
|
#
|
|
# Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
|
|
# hosts/runner-x86-linux), which has just, buildah, skopeo, cosign, yq and jq.
|
|
#
|
|
# Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
|
|
# Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
|
|
|
|
# Daily (and on "Run workflow"), it first merges upstream's main
|
|
# (github.com/ublue-os/aurora) into ours and pushes the merge, then builds:
|
|
# upstream's changes, plus the day's Fedora package updates, which Aurora's
|
|
# build resolves at build time. quine-global-labs/quine-linux builds on the
|
|
# result two hours later. A push made with the job's own token doesn't start
|
|
# another run, so the merge and the build happen in this one. A conflict
|
|
# fails the run before anything is pushed.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: '0 5 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: aurora-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
REGISTRY: forge.quinefoundation.com
|
|
IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
|
|
TAG: stable
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: runner-x86-linux
|
|
timeout-minutes: 300
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Merge upstream
|
|
if: github.event_name != 'push'
|
|
run: |
|
|
git config user.name "forgejo-actions"
|
|
git config user.email "actions@forge.quinefoundation.com"
|
|
git fetch --no-tags https://github.com/ublue-os/aurora.git main
|
|
before=$(git rev-parse HEAD)
|
|
git merge --no-edit -m "Merge upstream ublue-os/aurora main" FETCH_HEAD
|
|
if [ "$(git rev-parse HEAD)" != "$before" ]; then
|
|
git push origin HEAD:main
|
|
else
|
|
echo "Already up to date with upstream."
|
|
fi
|
|
|
|
- name: Build
|
|
# Aurora reads its own past tags from ghcr.io/$GITHUB_REPOSITORY_OWNER
|
|
# and hands $GITHUB_TOKEN to GitHub's API. On Forgejo Actions those
|
|
# are this org and a Forgejo token, so: ublue-os, and no token.
|
|
run: >-
|
|
env -u GITHUB_TOKEN
|
|
GITHUB_REPOSITORY_OWNER=ublue-os
|
|
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
|
|
just build --image aurora --tag "$TAG" --flavor main
|
|
|
|
- name: Push
|
|
env:
|
|
REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
|
|
for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
|
|
podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
|
|
podman push --retry 5 "$IMAGE:$t"
|
|
done
|
|
podman logout "$REGISTRY"
|