mirror-ublue-os-akmods/.github/workflows/reusable-build.yml

name: build-akmod
run-name: "Build ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }}"
on:
  workflow_call:
    inputs:
      akmods_target:
        description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open"
        required: true
        type: string
      bazzite_tag:
        description: "The release tag for the bazzite kernel"
        required: false
        type: string
      kernel_flavor:
        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
        required: true
        type: string
      version:
        description: "Release Version: 10, 41, 42, etc"
        required: true
        type: string
      kernel_cache_key:
        description: "The Key for the Kernel Cache"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      akmods_target:
        description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open"
        required: true
        type: string
      bazzite_tag:
        description: "The release tag for the bazzite kernel"
        required: false
        type: string
      kernel_flavor:
        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
        required: true
        type: string
      version:
        description: "Release Version: 10, 41, 42, etc"
        required: true
        type: string
      kernel_cache_key:
        description: "The Key for the Kernel Cache"
        required: true
        type: string
env:
  AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }}
  AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
  AKMODS_TARGET: ${{ inputs.akmods_target }}
  AKMODS_VERSION: ${{ inputs.version }}
  KCKEY: ${{ inputs.kernel_cache_key }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }}-${{ inputs.akmods_target }}
  cancel-in-progress: true

jobs:
  build-akmods:
    name: Build ${{ matrix.platform }}
    runs-on: ${{ matrix.platform == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
    permissions:
      actions: read
      contents: read
      packages: write
    container:
      image: "ghcr.io/ublue-os/devcontainer:latest"
      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
    strategy:
      fail-fast: false
      matrix:
        platform:
          - x86_64
          # - aarch64
    steps:
      - name: Checkout Repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Mark Directory as Safe
        run: git config --system --ad safe.directory "$GITHUB_WORKSPACE"

      - name: Export GITHUB_WORKSPACE
        id: gh-workspace
        run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT"
        
      - name: Cache Kernel RPMs
        id: cache-kernel
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms
          key: ${{ env.KCKEY }}-${{ matrix.platform }}

      - name: Fail Absent Kernel Cache
        if: steps.cache-kernel.outputs.cache-hit != 'true'
        run: "echo 'Kernel Cache not found for key: ${{ env.KCKEY }}'; exit 1"

      - name: Retrieve Signing Key
        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
        shell: bash
        run: |
          mkdir -p certs
          echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
          echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
          # DEBUG: get character count of key
          wc -c certs/private_key.priv
          wc -c certs/private_key_2.priv          
        
      - name: Build Image
        id: build
        run: just build

      - name: Test Image
        run: just test

      - name: Push and Sign Image
        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
        run:
          just login-to-ghcr
          just push
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          REGISTRY_ACTOR: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ github.token }}

  manifest:
    name: "Generate ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }} Manifest"
    runs-on: ubuntu-latest
    needs: [build-akmods]
    container:
      image: "ghcr.io/ublue-os/devcontainer:latest"
      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
      - name: Exit on failure
        if: ${{ needs.build-akmods.result == 'failure' }}
        run: exit 1

      - name: Export GITHUB_WORKSPACE
        id: gh-workspace
        run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT"

      - name: Cache Kernel RPMs
        id: cache-kernel
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms
          key: ${{ env.KCKEY }}-x86_64

      - name: Generate Manifest
        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
        run:
          just login-to-ghcr
          just manifest
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          REGISTRY_ACTOR: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ github.token }}