feat(ci): implement testing stream workflows (#2250)

* feat(ci): testing stream

* feat(ci): workaround for scheduled stable build on non-default branch

* feat(renovate): initial config for testing stream

We want to get builds that are triggered by kinoite updates from
renovate but promote changes like get-aurora-dev/common and
ublue-os/brew from main to the stable branch, while still receiving
updates for things like github actions.

.github/renovate.json5

@@ -4,7 +4,7 @@
     "config:best-practices"
   ],
 
-  "baseBranchPatterns": ["main"],
+  "baseBranchPatterns": ["main", "stable-f44"],
 
   // Do not rebase when the default branch is updated
   "rebaseWhen": "never",
@@ -32,23 +32,35 @@
       "matchUpdateTypes": ["digest"]
     },
     {
-      "matchUpdateTypes": ["pin", "digest", "pinDigest"],
-      "matchPackageNames": ["ghcr.io/jasonn3/build-container-installer"],
-      "automerge": false
-    },
-    {
+      // We always want to trigger a fresh build when we have a new base image on every branch
+      // so we get package and security updates
+      "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
       "automerge": true,
-      "matchUpdateTypes": ["digest"],
-      "matchDepNames": [
-        "quay.io/fedora-ostree-desktops/kinoite",
-        "ghcr.io/ublue-os/brew",
-        "ghcr.io/get-aurora-dev/common"
-      ]
+      "matchUpdateTypes": ["digest"]
     },
     {
       "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
       "matchUpdateTypes": ["major"],
       "enabled": false
+    },
+    {
+      "matchDepNames": [
+        "ghcr.io/ublue-os/brew",
+        "ghcr.io/get-aurora-dev/common"
+      ],
+      "matchBaseBranches": ["main"],
+      "automerge": true,
+      "matchUpdateTypes": ["digest"]
+    },
+    {
+      "matchDepNames": [
+        "ghcr.io/ublue-os/brew",
+        "ghcr.io/get-aurora-dev/common"
+      ],
+      // Brew and common are not "security updates", they have to go through :testing/main first
+      // to reach a stable release
+      "matchBaseBranches": ["stable-f44"],
+      "enabled": false
     }
   ]
 }

.github/workflows/build-image-latest-main.yml

@@ -3,7 +3,7 @@ on:
   merge_group:
   pull_request:
     branches:
-      - main
+      - stable-f44
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"

.github/workflows/build-image-stable.yml

@@ -1,15 +1,16 @@
 name: Stable Images
 on:
+  # We do not want this to run after PR merges
+  # we are only publishing weekly :stable images
+
+  # We still want to know if things are broken
   pull_request:
     branches:
-      - main
-      - testing
+      - stable-f44
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"
       - ".github/workflows/scorecard.yml"
-  schedule:
-    - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM
   workflow_call:
   workflow_dispatch:
     inputs:

.github/workflows/build-image-testing.yml

@@ -1,9 +1,9 @@
-name: Beta Images
+name: Testing Images
 on:
-   #merge_group:
+   merge_group:
    pull_request:
      branches:
-       - beta
+       - main
      paths-ignore:
        - "**.md"
        - ".github/workflows/moderator.yml"
@@ -27,8 +27,8 @@ permissions:
   artifact-metadata: write
 
 jobs:
-  build-image-beta:
-    name: Build Beta Images
+  build-image-testing:
+    name: Build Testing Images
     uses: ./.github/workflows/reusable-build.yml
     secrets: inherit
     strategy:
@@ -38,7 +38,7 @@ jobs:
     with:
       image_flavors: '["main", "nvidia-open"]'
       brand_name: ${{ matrix.brand_name }}
-      stream_name: beta
+      stream_name: testing
       previous_build: ${{ inputs.previous_build }}
       # FIXME: MAIN has no arm builds in ublue-os/akmods yet
       # https://github.com/ublue-os/akmods/pull/440

.github/workflows/generate-release.yml

@@ -34,6 +34,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 500
+          ref: stable-f44
 
       - name: Install Just
         run: |

.github/workflows/trigger-schedule-stable-image.yml

@@ -0,0 +1,27 @@
+# We have this because we can't schedule builds on non-default branches
+name: Trigger Stable Image Build
+on:
+  schedule:
+    - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  trigger-stable-build:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Trigger Stable Image Build
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH: stable-f44
+        run: |
+          gh workflow run \
+            build-image-stable.yml \
+            --ref "${BRANCH}"