quay.io's CDN cut off a multi-GB fedora-bootc layer mid-download, and
buildah's pull inside the build gives up after one reconnect. Pull the
images the installer image and the ISO need beforehand, retrying.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
runner-x86-linux has task, just, yq, cosign and mc from nixpkgs. The
earlier failures were dl.min.io answering 410 Gone for mc (MinIO no
longer publishes community binaries), not GitHub refusing just; drop the
GITHUB_TOKEN workaround that was based on that misreading.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The installer sends $GITHUB_TOKEN to GitHub; in a Forgejo job that's
Forgejo's own token, so GitHub refused the download (410).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a host-mode runner $HOME persists between jobs, so the second run
failed with 'just already exists'.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
stage-0/ is a submodule holding our fork of Aurora (upstream for now),
built with Aurora's own `just build` by the new `task build-base` into
localhost/aurora:stable. The Containerfile (stage 1) now builds FROM
${BASE_IMAGE}, which defaults to that image, instead of a pinned upstream
digest; the pin is now the submodule commit. build-image builds stage 0
first when needed, and BASE_IMAGE=ghcr.io/ublue-os/aurora:stable skips it
(the only option on macOS).
CI checks out submodules, fetches just, yq and cosign, and gets a longer
timeout for the Aurora build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
.forgejo/workflows/iso.yml runs `task build-installer-iso` on a runner
labelled iso-builder (x86_64, root podman) and uploads the ISO to MinIO
under installer/<commit>/ and installer/latest/.
For unattended runs, the Taskfile now only uses sudo when not already root
(CI runners often lack it), and OUTPUT_DIR is absolute so the bind mount
into bootc-image-builder doesn't depend on relative-path support.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
