From 447fa91e929e772a5987bdf5e26506268568b0b3 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Tue, 25 Nov 2025 12:00:24 +0530 Subject: [PATCH] init --- .gitattributes | 13 ++ .github/renovate.json5 | 6 + .github/workflows/build.yml | 53 ++++++ .github/workflows/release.yml | 69 ++++++++ .github/workflows/validate-brewfiles.yaml | 38 ++++ .gitignore | 13 ++ .pre-commit-config.yaml | 11 ++ AGENTS.md | 165 ++++++++++++++++++ Containerfile | 7 + Justfile | 3 + LICENSE | 201 ++++++++++++++++++++++ README.md | 56 ++++++ 12 files changed, 635 insertions(+) create mode 100644 .gitattributes create mode 100644 .github/renovate.json5 create mode 100644 .github/workflows/build.yml create mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/validate-brewfiles.yaml create mode 100644 .gitignore create mode 100644 .pre-commit-config.yaml create mode 100644 AGENTS.md create mode 100644 Containerfile create mode 100644 Justfile create mode 100644 LICENSE create mode 100644 README.md diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..97c14af --- /dev/null +++ b/.gitattributes @@ -0,0 +1,13 @@ +*.yml linguist-detectable=true +*.yml linguist-language=YAML + +*.yaml linguist-detectable=true +*.yaml linguist-language=YAML + +*.just linguist-detectable=true +*.just linguist-documentation=false +*.just linguist-language=Just + +*.json linguist-detectable=true +*.json linguist-documentation=false +*.json linguist-language=JSON diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 0000000..3b25e3e --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>ublue-os/renovate-config:org-inherited-config" + ] +} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..775a8db --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,53 @@ +name: Build +on: + pull_request: + branches: + - main + push: + branches: + - main + workflow_dispatch: + +env: + IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + IMAGE_NAME: aurora-oci + +jobs: + build_push: + name: Build and push image + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + + steps: + - name: Checkout + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + + - name: Build Image + id: build + run: | + buildah build -t ${{ env.IMAGE_NAME }}:latest -f ./Containerfile . + + - name: Login to GitHub Container Registry + if: github.event_name != 'pull_request' + run: | + echo "${{ secrets.GITHUB_TOKEN }}" | podman login -u "${{ github.actor }}" --password-stdin ghcr.io + + - name: Push Image + if: github.event_name != 'pull_request' + run: | + podman push ${{ env.IMAGE_NAME }}:latest ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:latest + + # - name: Install Cosign + # uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1 + # if: github.event_name != 'pull_request' + + # - name: Sign container image + # if: github.event_name != 'pull_request' + # run: | + # cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:latest + # env: + # COSIGN_EXPERIMENTAL: false + # COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..50ed21b --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,69 @@ +name: Monthly Release + +on: + schedule: + # Run on the 1st of every month at 00:00 UTC + - cron: '0 0 1 * *' + workflow_dispatch: + +permissions: + contents: write + +jobs: + release: + name: Create monthly snapshot release + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + fetch-depth: 0 + + - name: Generate release tag + id: tag + run: | + TAG="v$(date +'%Y.%m')" + echo "tag=${TAG}" >> "$GITHUB_OUTPUT" + echo "Release tag: ${TAG}" + + - name: Generate release notes + id: notes + run: | + TAG="${{ steps.tag.outputs.tag }}" + PREVIOUS_TAG=$(git tag --sort=-version:refname | head -n1) + + if [ -z "$PREVIOUS_TAG" ]; then + echo "First release - no previous tag found" + cat >> "$GITHUB_OUTPUT" <> "$GITHUB_OUTPUT" < taps.Brewfile + set -xeuo pipefail + brew bundle --file=./taps.Brewfile + if brew bundle exec whoami --file="$brewfile" | grep -F -e "${USER}" ; then + echo "✓ $brewfile is valid" + else + echo "✗ $brewfile validation failed" + exit 1 + fi + set +xeuo pipefail + echo "::endgroup::" + done diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..879fe1e --- /dev/null +++ b/.gitignore @@ -0,0 +1,13 @@ +*.iso +*.iso-CHECKSUM +flatpaks_with_deps +flatpak.* + +*_build +*_build.* +previous.manifest.json +changelog.md +output.env +version.txt + +devcontainer diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..28f0bd0 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,11 @@ +# .pre-commit-config.yaml + +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: check-json + - id: check-toml + - id: check-yaml + - id: end-of-file-fixer + - id: trailing-whitespace diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..fb32b11 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,165 @@ +# Bluefin-Common Copilot Instructions + +This document provides essential information for coding agents working with the bluefin-common repository. + +## Repository Overview + +**Bluefin-Common** is a shared OCI layer containing common configuration files used across all Bluefin variants (bluefin, bluefin-dx, bluefin-lts). + +- **Type**: Minimal OCI container layer (system files only) +- **Purpose**: Centralize shared configuration to reduce duplication across bluefin and bluefin-lts +- **Base**: Built from scratch with COPY directive +- **Languages**: Configuration files (JSON, shell scripts, markdown) +- **Build System**: GitHub Actions with podman/buildah + +## Repository Structure + +### Root Directory Files +- `Containerfile` - Multi-stage build (scratch → ctx stage with system_files) +- `cosign.pub` - Container signing public key (shared with bluefin/bluefin-lts) +- `README.md` - Basic repository description + +### Key Directories +- `system_files/` - All configuration files that get copied into bluefin images + - `etc/ublue-os/` - System configuration files (bling.json, fastfetch.json, setup.json) + - `usr/share/ublue-os/` - User-space configurations + - `firefox-config/` - Firefox default settings + - `flatpak-overrides/` - Flatpak app overrides + - `just/` - Just recipe additions + - `motd/` - Message of the day templates and tips + - `privileged-setup.hooks.d/` - Privileged setup hooks + - `system-setup.hooks.d/` - System setup hooks + - `user-setup.hooks.d/` - User setup hooks + +### GitHub Actions +- `.github/workflows/build.yml` - Simple build workflow using podman/buildah + +## Build Instructions + +### Prerequisites +This repository requires minimal tooling: +- **podman** and **buildah** (usually pre-installed on development systems) +- No Just, no pre-commit, no complex build dependencies + +### Build Commands + +**Build locally:** +```bash +# Build the container +buildah build -t bluefin-common:latest -f ./Containerfile . + +# Inspect the built image +podman images bluefin-common +``` + +**Test the image:** +```bash +# Copy files from the container to verify structure +podman create --name test bluefin-common:latest +podman cp test:/system_files ./test-output +podman rm test +tree ./test-output +``` + +### Build Process +1. GitHub Actions triggers on push to main or PR +2. `buildah build` creates image from `Containerfile` +3. Image is pushed to `ghcr.io/projectbluefin/bluefin-common:latest` +4. Bluefin and bluefin-lts reference this image with `COPY --from=ghcr.io/ublue-os/bluefin-common:latest` + +## Usage in Downstream Projects + +Bluefin and bluefin-lts use this layer in their Containerfiles: + +```dockerfile +FROM ghcr.io/ublue-os/bluefin-common:latest AS bluefin-common + +# Later in the build: +COPY --from=bluefin-common /system_files /desired/destination +``` + +## Making Changes + +### Modifying Configuration Files + +1. **Edit files in `system_files/`** - Maintain the existing directory structure +2. **Test locally** with buildah to ensure no syntax errors +3. **Create PR** - GitHub Actions will build and validate + +### Adding New Configuration Files + +1. Place files in the appropriate subdirectory under `system_files/` +2. Follow the existing path conventions: + - System configs: `system_files/etc/ublue-os/` + - User configs: `system_files/usr/share/ublue-os/` +3. Ensure file permissions are correct (executables for scripts) + +### Common Modification Patterns +- **Firefox configs**: Edit `system_files/usr/share/ublue-os/firefox-config/` +- **Setup hooks**: Modify scripts in `system_files/usr/share/ublue-os/*-setup.hooks.d/` +- **System settings**: Update JSON files in `system_files/etc/ublue-os/` +- **Just recipes**: Add/modify `.just` files in `system_files/usr/share/ublue-os/just/` + +## Validation + +### Manual Validation +```bash +# Check Containerfile syntax +buildah build --dry-run -f ./Containerfile . + +# Validate JSON files +find system_files -name "*.json" -exec sh -c 'echo "Checking {}"; cat {} | jq . > /dev/null' \; + +# Check shell script syntax +find system_files -name "*.sh" -exec bash -n {} \; +``` + +### GitHub Actions +The build workflow automatically: +- Builds the container with buildah +- Pushes to GHCR on merge to main +- Validates build succeeds on PRs + +## Development Guidelines + +### Making Changes +1. **Keep it simple** - This repo contains only configuration files +2. **Maintain structure** - Follow existing directory patterns +3. **Test locally** - Build with buildah before pushing +4. **No complex dependencies** - This is intentionally minimal + +### File Editing Best Practices +- **JSON files**: Validate syntax with `jq` before committing +- **Shell scripts**: Check syntax with `bash -n script.sh` +- **Keep files small** - Each file should have a single, clear purpose +- **Document changes** - Update comments in configuration files + +## Trust These Instructions + +**This repository is intentionally simple.** It contains only: +- Configuration files in `system_files/` +- A minimal Containerfile +- A simple GitHub Actions workflow + +There are no complex build systems, no package management, no multi-stage builds beyond the scratch→ctx pattern. + +## Other Rules + +- Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#specification) for all commits and PR titles +- Keep changes minimal and surgical +- This layer is used by both bluefin (ublue-os/bluefin) and bluefin-lts (ublue-os/bluefin-lts) +- Changes here affect all downstream Bluefin variants + +## Attribution Requirements + +AI agents must disclose what tool and model they are using in the "Assisted-by" commit footer: + +```text +Assisted-by: [Model Name] via [Tool Name] +``` + +Example: + +```text +Assisted-by: Claude 3.5 Sonnet via GitHub Copilot +``` diff --git a/Containerfile b/Containerfile new file mode 100644 index 0000000..39e40d1 --- /dev/null +++ b/Containerfile @@ -0,0 +1,7 @@ +FROM scratch AS ctx +COPY /brew /brew +COPY /flatpaks /flatpaks +COPY /just /just +COPY /logos /logos +COPY /system_files /system_files + diff --git a/Justfile b/Justfile new file mode 100644 index 0000000..1db9896 --- /dev/null +++ b/Justfile @@ -0,0 +1,3 @@ +# Build the aurora-oci container locally +build: + buildah build -t aurora-oci:latest -f ./Containerfile . diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..261eeb9 --- /dev/null +++ b/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md new file mode 100644 index 0000000..c8585c5 --- /dev/null +++ b/README.md @@ -0,0 +1,56 @@ +# bluefin-common + +Shared OCI layer containing common configuration files used across all Bluefin variants (bluefin, bluefin-dx, bluefin-lts). + +## What's Inside + +This layer contains two main configuration directories: + +### `/etc/ublue-os/` - System Configuration +- Bling - CLI theming settings +- Fastfetch settings - System information display configuration +- Setup configuration - First-boot and system setup parameters + +### `/usr/share/ublue-os/` - User-Space Configuration +- Firefox defaults - Pre-configured Firefox settings +- Flatpak overrides - Application-specific Flatpak configurations +- Just recipes - Additional command recipes for system management +- MOTD templates - Message of the day and tips +- Setup hooks - Scripts for privileged, system, and user setup stages + +## Usage in Containerfile + +Reference this layer as a build stage and copy the directories you need: + +### Copy everything: +```dockerfile +FROM ghcr.io/ublue-os/bluefin-common:latest AS bluefin-common + +# Copy all system files +COPY --from=bluefin-common /system_files / +``` + +### Copy only system configuration: + +This is what Aurora should use, gives shares the common set of files and keeps the images opinions seperate. + +```dockerfile +FROM ghcr.io/ublue-os/bluefin-common:latest AS bluefin-common + +# Copy only /etc configuration +COPY --from=bluefin-common /system_files/etc /etc +``` + +### Copy only the image opinion: +```dockerfile +FROM ghcr.io/ublue-os/bluefin-common:latest AS bluefin-common + +# Copy only /usr/share configuration +COPY --from=bluefin-common /system_files/usr /usr +``` + +## Building Locally + +```bash +just build +```