d818c4ee09
* chore: be explicit about secrets needed for image build Instead of inheriting *all* the secrets we are only selectively giving the called workflows access to the secrets we actually need. Currently we only have one secret we use for image signing but in the future we may want to have a separate testing key we use to sign testing builds only made in PRs and things like that. We may want to look into setting things up in a way so production keys are only ever used when we push to ublue-os/aurora. This also happens to make the experience a little bit nicer in new forks as the workflow will fail right after the start when the SIGNING_SECRET wasn't set, as opposed to when signing the image. xref: https://github.com/ublue-os/aurora/issues/2528 * chore: remove secrets from generate-release parts I don't know why this exists, we don't need our cosign key in this part of the workflow.
40 lines
1 KiB
YAML
40 lines
1 KiB
YAML
name: Testing Images
|
|
on:
|
|
merge_group:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
paths-ignore:
|
|
- "**.md"
|
|
- ".github/workflows/moderator.yml"
|
|
- ".github/workflows/scorecard.yml"
|
|
workflow_call:
|
|
workflow_dispatch:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build-image-testing:
|
|
name: Build Testing Images
|
|
uses: ./.github/workflows/reusable-build.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
artifact-metadata: write
|
|
secrets:
|
|
SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
brand_name: ["aurora"]
|
|
with:
|
|
image_flavors: '["main", "nvidia-open"]'
|
|
brand_name: ${{ matrix.brand_name }}
|
|
stream_name: testing
|
|
# FIXME: MAIN has no arm builds in ublue-os/akmods yet
|
|
# https://github.com/ublue-os/akmods/pull/440
|
|
# architecture: '["aarch64","x86_64"]'
|
|
architecture: '["x86_64"]'
|
|
publish: ${{ github.event_name != 'pull_request' }}
|