Build a disk image (qcow2) too, and put it in releases

bootc-image-builder's qcow2, with no user: Aurora's plasma-setup creates
the first one at first boot. Daily builds upload it to MinIO's
disk/latest/; tagged releases include it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/iso.yml

@@ -1,11 +1,12 @@
-name: Image and installer ISO
+name: Image, installer ISO and disk image
 
 # Builds the quine-linux image on our Aurora build (published by
 # quine-global-labs/aurora's workflow to this forge's registry), pushes it to
 # forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
-# `<date>`, the commit), then builds the installer ISO from it and uploads
-# that to MinIO as <bucket>/installer/<commit>/install.iso and
-# <bucket>/installer/latest/install.iso.
+# `<date>`, the commit), then builds the installer ISO and a disk image
+# (qcow2) from it and uploads them to MinIO as
+# <bucket>/installer/<commit>/install.iso, <bucket>/installer/latest/install.iso
+# and <bucket>/disk/latest/disk.qcow2.
 #
 # Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
 # hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with
@@ -127,6 +128,9 @@ jobs:
       - name: Build installer ISO
         run: task build-installer-iso CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
 
+      - name: Build disk image
+        run: task build-disk-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
+
       - name: Upload to MinIO
         env:
           MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
@@ -143,6 +147,9 @@ jobs:
           dest="store/${MINIO_BUCKET}/installer"
           mc cp "$iso" "${dest}/${GITHUB_SHA}/install.iso"
           mc cp "${dest}/${GITHUB_SHA}/install.iso" "${dest}/latest/install.iso"
+          # The disk image: latest only, it's as big as the ISO.
+          ls -lh output/qcow2/disk.qcow2
+          mc cp output/qcow2/disk.qcow2 "store/${MINIO_BUCKET}/disk/latest/disk.qcow2"
 
       - name: Publish the release
         if: github.ref_type == 'tag'
@@ -154,6 +161,7 @@ jobs:
           tag=$GITHUB_REF_NAME
           mkdir -p release
           ln -f "$(find output -name install.iso -print -quit)" "release/quine-linux-$tag-installer-x86_64.iso"
+          ln -f output/qcow2/disk.qcow2 "release/quine-linux-$tag-x86_64.qcow2"
           (cd release && sha256sum -- * > SHA256SUMS)
           cat release/SHA256SUMS
 

Taskfile.yml

@@ -5,9 +5,8 @@ vars:
   INSTALLER_IMAGE: quine-installer
   # What the Containerfile builds FROM: our Aurora fork
   # (quine-global-labs/aurora), built and published by that repo's workflow.
-  # It's private: `podman login forge.quinefoundation.com` first. Override
-  # with a local build of the fork (BASE_IMAGE=localhost/aurora:stable, see
-  # README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
+  # Override with a local build of the fork (BASE_IMAGE=localhost/aurora:stable,
+  # see README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
   BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
   OUTPUT_DIR: '{{.ROOT_DIR}}/output'
   # Root is needed for the container builds and bootc; skip {{.SUDO}} when already
@@ -135,6 +134,38 @@ tasks:
     generates:
       - "{{.OUTPUT_DIR}}/bootiso/install.iso"
 
+  build-disk-image:
+    desc: >-
+      Build a ready-installed disk image (qcow2) of the local quine-linux
+      image, via bootc-image-builder: boot it in a VM and plasma-setup asks
+      for the first user. Output lands in {{.OUTPUT_DIR}}/qcow2/disk.qcow2.
+    preconditions:
+      - sh: |
+          case "$(uname -m)" in x86_64|amd64) a=amd64 ;; aarch64|arm64) a=arm64 ;; *) a="$(uname -m)" ;; esac
+          [ "$a" = "{{.TARGET_ARCH}}" ]
+        msg: >-
+          Disk image builds need a host of architecture {{.TARGET_ARCH}}. This
+          one is {{ARCH}}; see build-iso.
+    cmds:
+      # Not a dep: deps run before preconditions, and this should fail fast.
+      - task: build-image
+      - task: export-to-storage
+        vars: { IMAGES: "{{.IMAGE}}" }
+      - mkdir -p {{.OUTPUT_DIR}}
+      # --rootfs btrfs: what Aurora installs with, as in build-installer-iso.
+      - >-
+        {{.SUDO}} {{.CONTAINER_RUNTIME}} run --rm --privileged {{.PULL_FLAG}}
+        --security-opt label=type:unconfined_t
+        -v {{.OUTPUT_DIR}}:/output
+        -v {{.ROOT_DIR}}/disk/config.toml:/config.toml:ro
+        -v {{.STORAGE}}:/var/lib/containers/storage
+        {{.BIB_IMAGE}}
+        --type qcow2
+        --rootfs btrfs
+        localhost/{{.IMAGE}}
+    generates:
+      - "{{.OUTPUT_DIR}}/qcow2/disk.qcow2"
+
   export-to-storage:
     internal: true
     desc: >-

disk/config.toml

@@ -0,0 +1,8 @@
+# bootc-image-builder's config for the disk image (task build-disk-image).
+# No user: the image has none, so plasma-setup (Aurora's, enabled by
+# default) creates the first one at first boot. Root's minimum size only;
+# a qcow2 is sparse, so the download is the size of what's written, not 64
+# GiB.
+[[customizations.filesystem]]
+mountpoint = "/"
+minsize = "64 GiB"