quine-linux/.forgejo/workflows/iso.yml

name: Installer ISO

# Builds the installer ISO (`task build-installer-iso`) and uploads it to
# MinIO as <bucket>/installer/<commit>/install.iso and
# <bucket>/installer/latest/install.iso.
#
# Runs on a runner labelled `iso-builder`: bootc-image-builder needs an
# x86_64 host with root podman (the job runs as root, or with sudo) and
# ~30 GB of free disk. Stage 0 (the stage-0/ Aurora fork) also needs
# buildah, cpp, skopeo and jq from the runner's distro; just, yq and cosign
# are fetched below.
#
# Secret: MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's
# just the MinIO user's name, `quine-linux`).
# Variables (optional): MINIO_ENDPOINT (default https://s3.quineglobal.com),
# MINIO_BUCKET (default quine-linux).

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: iso-${{ github.ref }}
  cancel-in-progress: true

env:
  MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }}
  MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }}

jobs:
  iso:
    runs-on: iso-builder
    timeout-minutes: 300
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install task, mc, just, yq and cosign
        # Only what the runner doesn't already have: runner-x86-linux has
        # all five from nixpkgs (petersweb-infra, hosts/runner-x86-linux).
        # dl.min.io's mc answers 410 Gone, so a runner without mc needs one
        # installed.
        run: |
          bin="$HOME/.local/bin"
          mkdir -p "$bin"
          have() { command -v "$1" >/dev/null; }
          have task || curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$bin"
          # --force: on a host-mode runner $HOME outlives the job.
          have just || curl -fsSL https://just.systems/install.sh | bash -s -- --force --to "$bin"
          have yq || { curl -fsSL -o "$bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && chmod +x "$bin/yq"; }
          have cosign || { curl -fsSL -o "$bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 && chmod +x "$bin/cosign"; }
          have mc || { curl -fsSL -o "$bin/mc" https://dl.min.io/client/mc/release/linux-amd64/mc && chmod +x "$bin/mc"; }
          echo "$bin" >> "$GITHUB_PATH"
          for t in task just yq cosign mc; do printf '%s: ' "$t"; command -v "$t"; done

      - name: Pull base images
        # Before the builds, with retries: quay.io's CDN cuts off multi-GB
        # layers now and then ("unexpected EOF"), and a pull inside
        # `buildah build` gives up after one reconnect. Already-pulled
        # images cost only a manifest check. Stage 0's own bases (Aurora's
        # image-versions.yml) aren't listed: Aurora pins them by digest.
        run: |
          for img in \
            quay.io/fedora/fedora-bootc:rawhide \
            registry.fedoraproject.org/fedora:rawhide \
            ghcr.io/osbuild/bootc-image-builder:latest; do
            for try in 1 2 3 4 5; do
              podman pull --retry 5 --retry-delay 20s -q "$img" && break
              [ "$try" != 5 ] || exit 1
              echo "retrying $img in 30s"; sleep 30
            done
          done

      - name: Build installer ISO
        run: task build-installer-iso CONTAINER_RUNTIME=podman

      - name: Upload to MinIO
        env:
          MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
        run: |
          iso=output/bootc-installer/install.iso
          ls -lh "$iso"
          mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY"
          mc mb --ignore-existing "store/${MINIO_BUCKET}"
          dest="store/${MINIO_BUCKET}/installer"
          mc cp "$iso" "${dest}/${GITHUB_SHA}/install.iso"
          mc cp "${dest}/${GITHUB_SHA}/install.iso" "${dest}/latest/install.iso"

      - name: Clean up build output
        if: always()
        run: rm -rf output