quine-linux/.forgejo/workflows/iso.yml

name: Installer ISO

# Builds the installer ISO (`task build-installer-iso`) and uploads it to
# MinIO as <bucket>/installer/<commit>/install.iso and
# <bucket>/installer/latest/install.iso.
#
# Runs on a runner labelled `iso-builder`: bootc-image-builder needs an
# x86_64 host with root podman (the job runs as root, or with sudo) and
# ~30 GB of free disk. Stage 0 (the stage-0/ Aurora fork) also needs
# buildah, cpp, skopeo and jq from the runner's distro; just, yq and cosign
# are fetched below.
#
# Secret: MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's
# just the MinIO user's name, `quine-linux`).
# Variables (optional): MINIO_ENDPOINT (default https://s3.quineglobal.com),
# MINIO_BUCKET (default quine-linux).

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: iso-${{ github.ref }}
  cancel-in-progress: true

env:
  MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }}
  MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }}

jobs:
  iso:
    runs-on: iso-builder
    timeout-minutes: 300
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install task, mc, just, yq and cosign
        run: |
          mkdir -p "$HOME/.local/bin"
          curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$HOME/.local/bin"
          curl -fsSL https://just.systems/install.sh | bash -s -- --to "$HOME/.local/bin"
          curl -fsSL -o "$HOME/.local/bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          curl -fsSL -o "$HOME/.local/bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
          chmod +x "$HOME/.local/bin/yq" "$HOME/.local/bin/cosign"
          curl -fsSL -o "$HOME/.local/bin/mc" https://dl.min.io/client/mc/release/linux-amd64/mc
          chmod +x "$HOME/.local/bin/mc"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Build installer ISO
        run: task build-installer-iso CONTAINER_RUNTIME=podman

      - name: Upload to MinIO
        env:
          MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
        run: |
          iso=output/bootc-installer/install.iso
          ls -lh "$iso"
          mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY"
          mc mb --ignore-existing "store/${MINIO_BUCKET}"
          dest="store/${MINIO_BUCKET}/installer"
          mc cp "$iso" "${dest}/${GITHUB_SHA}/install.iso"
          mc cp "${dest}/${GITHUB_SHA}/install.iso" "${dest}/latest/install.iso"

      - name: Clean up build output
        if: always()
        run: rm -rf output