mirror-get-aurora-dev-iso/.github/workflows/reusable-build-iso-anaconda.yml

---
name: Reusable Build
on:
  workflow_call:
    inputs:
      upload_artifacts:
        description: 'Upload ISOs as job artifacts'
        type: boolean
        default: false
      upload_r2:
        description: 'Upload ISOs to Cloudflare R2'
        type: boolean
        default: true
      image_version:
        description: 'Image version/tag to build (e.g. stable, testing)'
        type: string
        default: stable
      hook_script:
        description: 'Path to the ISO post-rootfs hook script'
        type: string
        default: iso_files/configure_iso_anaconda.sh

env:
  IMAGE_REGISTRY: "ghcr.io/ublue-os"
  IMAGE_NAME: "aurora"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

permissions: {}

jobs:
  build:
    name: Build ISOs
    runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-26.04' }}
    strategy:
      fail-fast: false
      matrix:
        platform: [amd64]
        flavor: ["main", "nvidia-open"]
        image_version: ["${{ inputs.image_version }}"]
    permissions:
      contents: read
      packages: read
      id-token: write
      attestations: write


    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 # v10

      - name: Configure containers policy for build
        run: |
          sudo ./.github/setup-runner-keys.sh          

      - name: Format image ref
        id: image_ref
        env:
          FLAVOR: ${{ matrix.flavor }}
          IMAGE_VERSION: ${{ matrix.image_version }}
        run: |
          set -eoux pipefail
          if [[ "${FLAVOR}" =~ main ]]; then
            image_name="aurora"
          else
            image_name="aurora-${FLAVOR}"
          fi
          image_ref="${IMAGE_REGISTRY}/${image_name}"
          KARGS="NONE"
          echo "image_ref=$image_ref" >> "${GITHUB_OUTPUT}"
          echo "artifact_format=${image_name}-${IMAGE_VERSION}-$(uname -m)" >> "${GITHUB_OUTPUT}"
          echo "kargs=$KARGS" >> "${GITHUB_OUTPUT}"          

      - name: Pull base image
        env:
          IMAGE_REF: ${{ steps.image_ref.outputs.image_ref }}
          IMAGE_VERSION: ${{ matrix.image_version }}
        run: |
          sudo podman pull "${IMAGE_REF}:${IMAGE_VERSION}"          

      - name: Generate titanoboa-compatible file list
        id: flatpak_list
        env:
          IMAGE_REF: ${{ steps.image_ref.outputs.image_ref }}
          IMAGE_VERSION: ${{ matrix.image_version }}
          FLATPAK_BREWFILE: /usr/share/ublue-os/homebrew/system-flatpaks.Brewfile
        run: |
          set -eoux pipefail
          mkdir -p iso_files
          ROOT="$(sudo podman image mount ${IMAGE_REF}:${IMAGE_VERSION})"
          sudo grep -v '#' "${ROOT}/${FLATPAK_BREWFILE}" | grep "^flatpak" | sed 's/flatpak //' | tr -d '"' | tee iso_files/flatpaks.list          

      - name: Build Live Container Image
        id: build-container
        env:
          FLAVOR: ${{ matrix.flavor }}
          IMAGE_VERSION: ${{ matrix.image_version }}
          BASE_IMAGE_REF: ${{ steps.image_ref.outputs.image_ref }}
        run: |
          CONTAINER_IMAGE_NAME="aurora-live-${FLAVOR}:${IMAGE_VERSION}"
          sudo podman build \
            --cap-add sys_admin \
            --security-opt label=disable \
            --build-arg BASE_IMAGE=${BASE_IMAGE_REF}:${IMAGE_VERSION} \
            --tag "${CONTAINER_IMAGE_NAME}" \
            -f Containerfile \
            .
          echo "image_name=${CONTAINER_IMAGE_NAME}" >> "${GITHUB_OUTPUT}"          

      - name: Build ISO
        id: build
        uses: ublue-os/titanoboa@5c457c3d0518bd17e754be0fd98a60d29d26abb4
        with:
          image-ref: ${{ steps.build-container.outputs.image_name }}

      - name: Rename ISO
        id: rename
        env:
          OUTPUT_PATH: ${{ steps.build.outputs.iso-dest }}
          FLAVOR: ${{ matrix.flavor }}
          OUTPUT_NAME: ${{ steps.image_ref.outputs.artifact_format }}
          IMAGE_VERSION: ${{ matrix.image_version }}
        run: |
          set -x
          mkdir -p output
          OUTPUT_DIRECTORY="$(realpath output)"
          mv "${OUTPUT_PATH}" "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}.iso"
          (cd "${OUTPUT_DIRECTORY}" && sha256sum "${OUTPUT_NAME}.iso" | tee "${OUTPUT_NAME}.iso-CHECKSUM")
          echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}"          

      - name: Attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        if: inputs.upload_r2 || (inputs.upload_artifacts && github.event_name != 'pull_request')
        with:
          subject-path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso

      - name: Upload ISO to Job Artifacts
        if: inputs.upload_artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          if-no-files-found: error
          path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso
          archive: false

      - name: Upload Checksum to Job Artifacts
        if: inputs.upload_artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          if-no-files-found: error
          path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso-CHECKSUM
          archive: false

      - name: Install rclone
        if: inputs.upload_r2
        run: /home/linuxbrew/.linuxbrew/bin/brew install rclone

      - name: Upload to CloudFlare test bucket
        if: inputs.upload_r2
        shell: bash
        env:
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.AURORA_DL_TEST_R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.AURORA_DL_TEST_R2_ACCESS_KEY_SECRET }}
          RCLONE_CONFIG_R2_REGION: auto
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.AURORA_DL_TEST_R2_ENDPOINT }}
          SOURCE_DIR: ${{ steps.rename.outputs.output_directory }}
        run: |
          /home/linuxbrew/.linuxbrew/bin/rclone copy --log-level INFO --checksum "${SOURCE_DIR}" R2:aurora-dl-test