538 lines
23 KiB
YAML
538 lines
23 KiB
YAML
name: Reusable Build and Push
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
fedora_version:
|
|
description: "The Fedora Version: gts, stable, or latest"
|
|
required: true
|
|
type: string
|
|
brand_name:
|
|
description: "'aurora' or 'bluefin'"
|
|
required: true
|
|
type: string
|
|
rechunk:
|
|
description: "Rechunk the image"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
outputs:
|
|
images:
|
|
description: "An array of images built and pushed to the registry"
|
|
value: ${{ jobs.check.outputs.images }}
|
|
env:
|
|
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build_container:
|
|
name: image
|
|
runs-on: ubuntu-24.04
|
|
continue-on-error: false
|
|
outputs:
|
|
image_full: ${{ steps.generate-outputs.outputs.image }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
image_flavor:
|
|
- main
|
|
- nvidia
|
|
- asus
|
|
- asus-nvidia
|
|
- surface
|
|
- surface-nvidia
|
|
base_name:
|
|
- ${{ inputs.brand_name }}
|
|
- ${{ inputs.brand_name }}-dx
|
|
fedora_version:
|
|
- ${{ inputs.fedora_version }}
|
|
exclude:
|
|
- fedora_version: gts
|
|
image_flavor: asus
|
|
- fedora_version: gts
|
|
image_flavor: asus-nvidia
|
|
- fedora_version: stable
|
|
image_flavor: asus
|
|
- fedora_version: stable
|
|
image_flavor: asus-nvidia
|
|
- fedora_version: stable
|
|
image_flavor: surface
|
|
- fedora_version: stable
|
|
image_flavor: surface-nvidia
|
|
- fedora_version: beta
|
|
image_flavor: asus
|
|
- fedora_version: beta
|
|
image_flavor: asus-nvidia
|
|
- fedora_version: beta
|
|
image_flavor: surface
|
|
- fedora_version: beta
|
|
image_flavor: surface-nvidia
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
|
|
|
|
- name: Matrix Variables
|
|
run: |
|
|
# IMAGE_NAME
|
|
if [[ "${{ matrix.image_flavor }}" == "main" ]]; then
|
|
echo "IMAGE_NAME=${{ matrix.base_name }}" >> $GITHUB_ENV
|
|
else
|
|
echo "IMAGE_NAME=${{ format('{0}-{1}', matrix.base_name, matrix.image_flavor) }}" >> $GITHUB_ENV
|
|
fi
|
|
|
|
# BASE_IMAGE_NAME
|
|
if [[ "${{ matrix.base_name }}" =~ "bluefin" ]]; then
|
|
echo "BASE_IMAGE_NAME"="silverblue" >> $GITHUB_ENV
|
|
elif [[ "${{ matrix.base_name }}" =~ "aurora" ]]; then
|
|
echo "BASE_IMAGE_NAME"="kinoite" >> $GITHUB_ENV
|
|
fi
|
|
|
|
# TARGET_NAME
|
|
if [[ "${{ matrix.base_name }}" =~ "dx" ]]; then
|
|
echo "TARGET_NAME"="dx" >> $GITHUB_ENV
|
|
else
|
|
echo "TARGET_NAME"="base" >> $GITHUB_ENV
|
|
fi
|
|
|
|
# AKMODS_FLAVOR
|
|
if [[ "${{ matrix.image_flavor }}" =~ "asus" ]]; then
|
|
echo "AKMODS_FLAVOR=asus" >> $GITHUB_ENV
|
|
elif [[ "${{ matrix.image_flavor }}" =~ "surface" ]]; then
|
|
echo "AKMODS_FLAVOR=surface" >> $GITHUB_ENV
|
|
elif [[ "${{ matrix.fedora_version }}" =~ stable|gts ]]; then
|
|
echo "AKMODS_FLAVOR=coreos-stable" >> $GITHUB_ENV
|
|
elif [[ "${{ matrix.fedora_version }}" == "latest" ]]; then
|
|
echo "AKMODS_FLAVOR=fsync" >> $GITHUB_ENV
|
|
else
|
|
echo "AKMODS_FLAVOR=main" >> $GITHUB_ENV
|
|
fi
|
|
|
|
# Env for matrix.image_flavor
|
|
if [[ "${{ matrix.image_flavor }}" == "nvidia" && \
|
|
"${{ matrix.fedora_version }}" != "beta" ]]; then
|
|
echo "image_flavor=main" >> $GITHUB_ENV
|
|
echo "nvidia_type=nvidia" >> $GITHUB_ENV
|
|
elif [[ "${{ matrix.image_flavor }}" == "main" && \
|
|
"${{ matrix.fedora_version }}" != "beta" ]]; then
|
|
echo "image_flavor=${{ matrix.image_flavor }}" >> $GITHUB_ENV
|
|
echo "nvidia_type=main" >> $GITHUB_ENV
|
|
else
|
|
echo "image_flavor=${{ matrix.image_flavor }}" >> $GITHUB_ENV
|
|
fi
|
|
|
|
- name: Get Current Fedora Version
|
|
id: labels
|
|
uses: Wandalen/wretry.action@6feedb7dedadeb826de0f45ff482b53b379a7844 # v3.5.0
|
|
with:
|
|
attempt_limit: 3
|
|
attempt_delay: 15000
|
|
command: |
|
|
set -eox pipefail
|
|
if [[ ${{ matrix.fedora_version }} == "stable" ]]; then
|
|
KERNEL_RELEASE=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:stable | jq -r '.Labels["ostree.linux"]')
|
|
elif [[ ${{ matrix.fedora_version }} == "gts" && ${{ env.AKMODS_FLAVOR }} != "surface" ]]; then
|
|
coreos_kernel_release=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:stable | jq -r '.Labels["ostree.linux"]')
|
|
coreos_fedora_version=$(echo $coreos_kernel_release | grep -oP 'fc\K[0-9]+')
|
|
fedora_version=$(($coreos_fedora_version - 1))
|
|
KERNEL_RELEASE=$(skopeo inspect docker://ghcr.io/ublue-os/coreos-stable-kernel:${fedora_version} | jq -r '.Labels["ostree.linux"]')
|
|
else
|
|
base_kernel_release=$(skopeo inspect docker://ghcr.io/ublue-os/silverblue-${{ env.image_flavor }}:${{ matrix.fedora_version }} | jq -r '.Labels["ostree.linux"]')
|
|
base_fedora_version=$(echo $base_kernel_release | grep -oP 'fc\K[0-9]+')
|
|
KERNEL_RELEASE=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.AKMODS_FLAVOR }}-kernel:${base_fedora_version} | jq -r '.Labels["ostree.linux"]')
|
|
fi
|
|
fedora_version=$(echo $KERNEL_RELEASE | grep -oP 'fc\K[0-9]+')
|
|
echo "kernel_release=$KERNEL_RELEASE" >> $GITHUB_ENV
|
|
echo "fedora_version=$fedora_version" >> $GITHUB_ENV
|
|
ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ env.BASE_IMAGE_NAME }}-${{ env.image_flavor }}:$fedora_version | jq -r '.Labels["org.opencontainers.image.version"]')
|
|
if [ -z "$ver" ] || [ "null" = "$ver" ]; then
|
|
echo "inspected image version must not be empty or null"
|
|
exit 1
|
|
fi
|
|
echo "VERSION=$ver" >> $GITHUB_ENV
|
|
|
|
- name: Verify base image
|
|
uses: EyeCantCU/cosign-action/verify@58722a084c82190b57863002d494c91eabbe9e79 # v0.3.0
|
|
with:
|
|
containers: ${{ env.BASE_IMAGE_NAME}}-${{ env.image_flavor }}:${{ env.fedora_version }}
|
|
|
|
- name: Verify Akmods
|
|
uses: EyeCantCU/cosign-action/verify@58722a084c82190b57863002d494c91eabbe9e79 # v0.3.0
|
|
with:
|
|
containers: akmods:${{ env.AKMODS_FLAVOR}}-${{ env.fedora_version }}
|
|
|
|
- name: Verify Nvidia
|
|
uses: EyeCantCU/cosign-action/verify@58722a084c82190b57863002d494c91eabbe9e79 # v0.3.0
|
|
with:
|
|
containers: akmods-nvidia:${{ env.AKMODS_FLAVOR}}-${{ env.fedora_version }}
|
|
|
|
- name: Verify ZFS
|
|
uses: EyeCantCU/cosign-action/verify@58722a084c82190b57863002d494c91eabbe9e79 # v0.3.0
|
|
with:
|
|
containers: akmods-zfs:coreos-stable-${{ env.fedora_version }}
|
|
|
|
- name: Verify Kernel Cache
|
|
uses: EyeCantCU/cosign-action/verify@58722a084c82190b57863002d494c91eabbe9e79 # v0.3.0
|
|
with:
|
|
containers: ${{ env.AKMODS_FLAVOR }}-kernel:${{ env.kernel_release }}
|
|
|
|
- name: Verify Kernel Version Matches
|
|
uses: Wandalen/wretry.action@6feedb7dedadeb826de0f45ff482b53b379a7844 # v3.5.0
|
|
with:
|
|
attempt_limit: 3
|
|
attempt_delay: 15000
|
|
command: |
|
|
set -x
|
|
akmods_version=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:${{ env.AKMODS_FLAVOR }}-${{ env.fedora_version }} | jq -r '.Labels["ostree.linux"]')
|
|
if [[ "${akmods_version}" == "${{ env.kernel_release }}" ]]; then
|
|
echo "Kernel Versions Match"
|
|
else
|
|
echo "Kernel Version do Not Match"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Maximize build space
|
|
uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
|
|
with:
|
|
remove-codeql: true
|
|
|
|
- name: Check just syntax
|
|
uses: ublue-os/just-action@bda593098a84a84973b002b4377709166a68be52 # v2
|
|
|
|
- name: Generate tags
|
|
id: generate-tags
|
|
shell: bash
|
|
run: |
|
|
# Generate a timestamp for creating an image version history
|
|
TIMESTAMP="$(date +%Y%m%d)"
|
|
FEDORA_VERSION="${{ matrix.fedora_version }}"
|
|
|
|
if [[ "${{ matrix.fedora_version }}" == "stable" ]]; then
|
|
IS_LATEST_VERSION=false
|
|
IS_STABLE_VERSION=true
|
|
IS_GTS_VERSION=false
|
|
IS_COREOS=true
|
|
elif [[ "${{ matrix.fedora_version }}" == "gts" ]]; then
|
|
IS_LATEST_VERSION=false
|
|
IS_STABLE_VERSION=true
|
|
IS_GTS_VERSION=true
|
|
IS_COREOS=false
|
|
elif [[ "${{ matrix.fedora_version }}" == "latest" ]]; then
|
|
IS_LATEST_VERSION=true
|
|
IS_STABLE_VERSION=true
|
|
IS_GTS_VERSION=false
|
|
IS_COREOS=false
|
|
elif [[ "${{ matrix.fedora_version }}" == "beta" ]]; then
|
|
IS_LATEST_VERSION=false
|
|
IS_STABLE_VERSION=false
|
|
IS_GTS_VERSION=false
|
|
IS_COREOS=false
|
|
fi
|
|
|
|
COMMIT_TAGS=()
|
|
BUILD_TAGS=()
|
|
|
|
# Have tags for tracking builds during pull request
|
|
SHA_SHORT="${GITHUB_SHA::7}"
|
|
COMMIT_TAGS+=("pr-${{ github.event.number }}-${FEDORA_VERSION}")
|
|
COMMIT_TAGS+=("${SHA_SHORT}-${FEDORA_VERSION}")
|
|
if [[ "$IS_LATEST_VERSION" == "true" ]] && \
|
|
[[ "$IS_STABLE_VERSION" == "true" ]]; then
|
|
COMMIT_TAGS+=("pr-${{ github.event.number }}")
|
|
COMMIT_TAGS+=("${SHA_SHORT}")
|
|
fi
|
|
|
|
if [[ ${{ matrix.fedora_version }} == "stable" ]]; then
|
|
BUILD_TAGS=("${FEDORA_VERSION}" "${FEDORA_VERSION}-${TIMESTAMP}")
|
|
else
|
|
BUILD_TAGS=("${{ env.fedora_version }}" "${{ env.fedora_version }}-${TIMESTAMP}")
|
|
fi
|
|
|
|
if [[ ${{ github.ref_name }} == "testing" ]]; then
|
|
if [[ ${{ matrix.fedora_version }} == "stable" ]]; then
|
|
BUILD_TAGS=("${FEDORA_VERSION}-testing" "${FEDORA_VERSION}-testing-${TIMESTAMP}")
|
|
else
|
|
BUILD_TAGS=("${{ env.fedora_version }}-testing" "${{ env.fedora_version }}-testing-${TIMESTAMP}")
|
|
fi
|
|
if [[ "$IS_LATEST_VERSION" == "true" ]] && \
|
|
[[ "$IS_STABLE_VERSION" == "true" ]]; then
|
|
BUILD_TAGS+=("testing")
|
|
echo "DEFAULT_TAG=testing" >> $GITHUB_ENV
|
|
elif [[ "$IS_GTS_VERSION" == "true" ]]; then
|
|
BUILD_TAGS+=("gts-testing")
|
|
echo "DEFAULT_TAG=gts-testing" >> $GITHUB_ENV
|
|
elif [[ "$IS_COREOS" == "true" ]]; then
|
|
echo "DEFAULT_TAG=stable-testing" >> $GITHUB_ENV
|
|
fi
|
|
else
|
|
if [[ "$IS_LATEST_VERSION" == "true" ]] && \
|
|
[[ "$IS_STABLE_VERSION" == "true" ]]; then
|
|
BUILD_TAGS+=("latest")
|
|
echo "DEFAULT_TAG=latest" >> $GITHUB_ENV
|
|
elif [[ "$IS_GTS_VERSION" == "true" ]]; then
|
|
BUILD_TAGS+=("gts")
|
|
echo "DEFAULT_TAG=gts" >> $GITHUB_ENV
|
|
elif [[ "$IS_COREOS" == "true" ]]; then
|
|
echo "DEFAULT_TAG=stable" >> $GITHUB_ENV
|
|
fi
|
|
fi
|
|
|
|
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
|
echo "Generated the following commit tags: "
|
|
for TAG in "${COMMIT_TAGS[@]}"; do
|
|
echo "${TAG}"
|
|
done
|
|
alias_tags=("${COMMIT_TAGS[@]}")
|
|
echo "DEFAULT_TAG=${SHA_SHORT}-${FEDORA_VERSION}" >> $GITHUB_ENV
|
|
else
|
|
alias_tags=("${BUILD_TAGS[@]}")
|
|
fi
|
|
echo "Generated the following build tags: "
|
|
for TAG in "${BUILD_TAGS[@]}"; do
|
|
echo "${TAG}"
|
|
done
|
|
echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
|
|
|
|
# Build metadata
|
|
- name: Image Metadata
|
|
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
|
|
id: meta
|
|
with:
|
|
images: |
|
|
${{ env.IMAGE_NAME }}
|
|
labels: |
|
|
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
|
|
org.opencontainers.image.version=${{ env.VERSION }}
|
|
org.opencontainers.image.description=An interpretation of the Ubuntu spirit built on Fedora technology
|
|
ostree.linux=${{ env.kernel_release }}
|
|
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/bluefin/bluefin/README.md
|
|
io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4
|
|
|
|
- name: Define env.SHA_HEAD_SHORT
|
|
run: |
|
|
echo "SHA_HEAD_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV
|
|
|
|
- name: Pull images
|
|
if: github.event_name == 'pull_request' && ( matrix.image_flavor == 'main' || matrix.image_flavor == 'nvidia' ) || github.event_name != 'pull_request'
|
|
uses: Wandalen/wretry.action@6feedb7dedadeb826de0f45ff482b53b379a7844 # v3.5.0
|
|
with:
|
|
attempt_limit: 3
|
|
attempt_delay: 15000
|
|
command: |
|
|
# pull the base image used for FROM in containerfile so
|
|
# we can retry on that unfortunately common failure case
|
|
sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.BASE_IMAGE_NAME }}-${{ env.image_flavor }}:${{ env.fedora_version }}
|
|
sudo podman pull ${{ env.IMAGE_REGISTRY }}/akmods:${{ env.AKMODS_FLAVOR }}-${{ env.fedora_version }}
|
|
sudo podman pull ${{ env.IMAGE_REGISTRY }}/akmods-nvidia:${{ env.AKMODS_FLAVOR }}-${{ env.fedora_version }}
|
|
sudo podman pull ${{ env.IMAGE_REGISTRY }}/akmods-zfs:coreos-stable-${{ env.fedora_version }}
|
|
sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.AKMODS_FLAVOR }}-kernel:${{ env.kernel_release }}
|
|
|
|
- name: Build Image
|
|
id: build_image
|
|
if: github.event_name == 'pull_request' && ( matrix.image_flavor == 'main' || matrix.image_flavor == 'nvidia' ) || github.event_name != 'pull_request'
|
|
run: |
|
|
set -euox pipefail
|
|
|
|
BUILD_ARGS=()
|
|
BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${{ env.BASE_IMAGE_NAME }}")
|
|
BUILD_ARGS+=("--build-arg" "IMAGE_NAME=${{ env.IMAGE_NAME }}")
|
|
BUILD_ARGS+=("--build-arg" "IMAGE_FLAVOR=${{ env.image_flavor }}")
|
|
BUILD_ARGS+=("--build-arg" "IMAGE_VENDOR=${{ github.repository_owner }}")
|
|
BUILD_ARGS+=("--build-arg" "FEDORA_MAJOR_VERSION=${{ env.fedora_version }}")
|
|
BUILD_ARGS+=("--build-arg" "TARGET_BASE=${{ env.TARGET_BASE }}")
|
|
BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${{ env.AKMODS_FLAVOR }}")
|
|
BUILD_ARGS+=("--build-arg" "NVIDIA_TYPE=${{ env.nvidia_type }}")
|
|
BUILD_ARGS+=("--build-arg" "KERNEL=${{ env.kernel_release }}")
|
|
BUILD_ARGS+=("--build-arg" "UBLUE_IMAGE_TAG=${{ matrix.fedora_version }}")
|
|
BUILD_ARGS+=("--build-arg" "SHA_HEAD_SHORT=${{ env.SHA_HEAD_SHORT }}")
|
|
|
|
TAG_ARGS=()
|
|
IFS=' ' read -r -a tags_array <<< "${{ steps.generate-tags.outputs.alias_tags }}"
|
|
for tag in "${tags_array[@]}"; do
|
|
TAG_ARGS+=("--tag" "${{ env.IMAGE_NAME }}:${tag}")
|
|
done
|
|
|
|
LABEL_ARGS=()
|
|
IFS=' ' read -r -a labels_array <<< "${{ steps.meta.outputs.labels }}"
|
|
for label in "${labels_array[@]}"; do
|
|
LABEL_ARGS+=("--label" "${label}")
|
|
done
|
|
|
|
sudo podman build --format docker --target ${{ env.TARGET_NAME }} \
|
|
"${BUILD_ARGS[@]}" \
|
|
"${TAG_ARGS[@]}" \
|
|
"${LABEL_ARGS[@]}" \
|
|
.
|
|
|
|
sudo podman image ls
|
|
|
|
echo "image=${{ env.IMAGE_NAME }}" >> $GITHUB_OUTPUT
|
|
echo "tags=${{ steps.generate-tags.outputs.alias_tags }}" >> $GITHUB_OUTPUT
|
|
|
|
|
|
- name: Check Secureboot
|
|
if: github.event_name == 'pull_request' && ( matrix.image_flavor == 'main' || matrix.image_flavor == 'nvidia' ) || github.event_name != 'pull_request'
|
|
shell: bash
|
|
run: |
|
|
set -x
|
|
if [[ ! $(command -v sbverify) || ! $(command -v curl) || ! $(command -v openssl) ]]; then
|
|
sudo apt update
|
|
sudo apt install sbsigntool curl openssl
|
|
fi
|
|
sudo podman run -d --rm --name ${{env.IMAGE_NAME}}-$(echo "${{ steps.generate-tags.outputs.alias_tags }}" | cut -d " " -f 1) "${{ env.IMAGE_NAME }}":$(echo "${{ steps.generate-tags.outputs.alias_tags }}" | cut -d " " -f 1) sleep 1000
|
|
sudo podman cp ${{env.IMAGE_NAME}}-$(echo "${{ steps.generate-tags.outputs.alias_tags }}" | cut -d " " -f 1):/usr/lib/modules/${{ env.kernel_release }}/vmlinuz .
|
|
sudo podman rm -f ${{env.IMAGE_NAME}}-$(echo "${{ steps.generate-tags.outputs.alias_tags }}" | cut -d " " -f 1) || true
|
|
sudo kill -9 $(sudo podman inspect --format '{{.State.Pid}}' ${{env.IMAGE_NAME}}-$(echo "${{ steps.generate-tags.outputs.alias_tags }}" | cut -d " " -f 1)) || true
|
|
sbverify --list vmlinuz
|
|
curl --retry 3 -Lo kernel-sign.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key.der
|
|
curl --retry 3 -Lo akmods.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key_2.der
|
|
openssl x509 -in kernel-sign.der -out kernel-sign.crt
|
|
openssl x509 -in akmods.der -out akmods.crt
|
|
sbverify --cert kernel-sign.crt vmlinuz || exit 1
|
|
sbverify --cert akmods.crt vmlinuz || exit 1
|
|
|
|
# Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
|
|
# https://github.com/macbre/push-to-ghcr/issues/12
|
|
- name: Lowercase Registry
|
|
id: registry_case
|
|
uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
|
|
with:
|
|
string: ${{ env.IMAGE_REGISTRY }}
|
|
|
|
- name: Rechunk Image
|
|
id: rechunk
|
|
if: inputs.rechunk == true && github.event_name != 'pull_request'
|
|
uses: hhd-dev/rechunk@v0.8.6
|
|
with:
|
|
rechunk: ghcr.io/hhd-dev/rechunk:v0.8.6
|
|
ref: ${{ steps.build_image.outputs.image }}:${{ env.DEFAULT_TAG }}
|
|
skip_compression: 'true'
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
prev-ref: ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}:${{ env.DEFAULT_TAG }}
|
|
|
|
# Overwrite the image with the chuncked image
|
|
- name: Load Rechunked Image
|
|
if: inputs.rechunk == true && github.event_name != 'pull_request'
|
|
run: |
|
|
sudo podman rmi $(sudo podman image ls -qa) --force
|
|
IMAGE=$(sudo podman pull ${{ steps.rechunk.outputs.ref }})
|
|
sudo rm -rf ${{ steps.rechunk.outputs.output }}
|
|
for tag in ${{ steps.build_image.outputs.tags }}; do
|
|
sudo podman tag $IMAGE ${{ env.IMAGE_NAME }}:${tag}
|
|
done
|
|
|
|
- name: Login to GitHub Container Registry
|
|
if: github.event_name != 'pull_request'
|
|
run: |
|
|
echo ${{ secrets.GITHUB_TOKEN }} | podman login ghcr.io -u ${{ github.actor }} --password-stdin
|
|
echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
|
|
|
|
- name: Push to GHCR
|
|
id: push
|
|
if: github.event_name != 'pull_request'
|
|
run: |
|
|
set -euox pipefail
|
|
|
|
for tag in ${{ steps.build_image.outputs.tags }}; do
|
|
sudo podman push ${{ env.IMAGE_NAME }}:${tag} ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${tag}
|
|
done
|
|
digest=$(skopeo inspect docker://${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} --format '{{.Digest}}')
|
|
echo "digest=${digest}" >> $GITHUB_OUTPUT
|
|
|
|
# Sign container
|
|
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
|
|
if: github.event_name != 'pull_request'
|
|
|
|
- name: Sign container image
|
|
if: github.event_name != 'pull_request'
|
|
run: |
|
|
cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
|
|
env:
|
|
TAGS: ${{ steps.push.outputs.digest }}
|
|
COSIGN_EXPERIMENTAL: false
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
|
|
|
- name: Generate file containing outputs
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
DIGEST: ${{ steps.push.outputs.digest }}
|
|
IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
IMAGE_NAME: ${{ env.IMAGE_NAME }}
|
|
IMAGE_FLAVOR: ${{ env.image_flavor }}
|
|
FEDORA_VERSION: ${{ matrix.fedora_version }}
|
|
run: echo "${IMAGE_REGISTRY}@${DIGEST}" > "${IMAGE_NAME}-${IMAGE_FLAVOR}-${FEDORA_VERSION}.txt"
|
|
|
|
- name: Upload artifact
|
|
if: github.event_name != 'pull_request'
|
|
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
|
|
with:
|
|
name: image-${{ env.IMAGE_NAME }}-${{ env.image_flavor }}-${{ matrix.fedora_version }}
|
|
retention-days: 1
|
|
if-no-files-found: error
|
|
path: |
|
|
${{ env.IMAGE_NAME }}-${{ env.image_flavor }}-${{ matrix.fedora_version }}.txt
|
|
|
|
check:
|
|
name: Check all ${{ inputs.brand_name }} ${{ inputs.fedora_version }} builds successful
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
needs: [build_container]
|
|
outputs:
|
|
images: ${{ steps.generate-outputs.outputs.images }}
|
|
steps:
|
|
- name: Download artifacts
|
|
if: github.event_name != 'pull_request'
|
|
id: download-artifacts
|
|
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
|
|
with:
|
|
pattern: image-*
|
|
merge-multiple: true
|
|
|
|
- name: Create output
|
|
if: github.event_name != 'pull_request'
|
|
id: generate-outputs
|
|
env:
|
|
JOBS: ${{ toJson(needs) }}
|
|
ARTIFACT_PATH: ${{ steps.download-artifacts.outputs.download-path }}
|
|
run: |
|
|
# Initialize the array
|
|
images=()
|
|
|
|
# Populate the array with each line from each file in the artifacts directory
|
|
for file in $ARTIFACT_PATH/*; do
|
|
while IFS= read -r line; do
|
|
images+=("$line")
|
|
done < "$file"
|
|
done
|
|
|
|
# Create the GITHUB_OUTPUT in the format '["image1", "image2", ...]'
|
|
echo "images=$(printf '%s\n' "${images[@]}" | jq -R -s -c 'split("\n") | .[:-1]')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Check Jobs
|
|
env:
|
|
JOBS: ${{ toJson(needs) }}
|
|
run: |
|
|
echo "Job status:"
|
|
echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'
|
|
|
|
for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
|
|
if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
|
|
echo ""
|
|
echo "Status check not okay!"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
build_iso:
|
|
name: iso
|
|
needs: [check]
|
|
if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && (github.ref_name == 'main' || github.ref_name == 'testing') && inputs.fedora_version != 'beta' && inputs.fedora_version != 'latest'
|
|
# Eventually would be nice for building images in PRs
|
|
#if: ${{ endsWith(github.event.pull_request.title, '[ISO]') }}
|
|
uses: ./.github/workflows/reusable-build-iso.yml
|
|
secrets: inherit
|
|
with:
|
|
brand_name: ${{ inputs.brand_name }}
|
|
fedora_version: ${{ inputs.fedora_version }}
|