name: Image, disk image and live ISO # Builds the quine-linux image on our Aurora build (published by # quine-global-labs/aurora's workflow to this forge's registry), pushes it to # forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`, # ``, the commit; installed systems pull it as # registry.quineglobal.com/quine-linux, a pull-only name for it), then # builds a disk image (qcow2) and the live ISO # (which is also the installer, as Aurora's) from it and uploads them to MinIO # as /disk/latest/disk.qcow2 and /live/latest/live.iso, # replacing the last build's. # # Runs on runner-x86-linux (host mode, root podman; petersweb-infra, # hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with # root podman and ~30 GB of free disk. # # A tag `v*` also publishes a release: the files go to MinIO's public # /releases//, and a Forgejo release on this repo links to them # (Forgejo's external-URL release files: the images are too big for GitHub's # 2 GiB limit, and this keeps one copy). The website lists these releases. # # Upstream images (Fedora's, bootc-image-builder) are vendored into # forge.quinefoundation.com/quine-global-labs/mirror/ first, and pulled # from there (.forgejo/vendor-images.sh). # # Secrets: REGISTRY_TOKEN (a Forgejo token with package write access), # MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's just the # MinIO user's name, `quine-linux`). # Variables (optional): REGISTRY_USER (the token's owner; default: the # actor), MINIO_ENDPOINT (default https://s3.quineglobal.com), MINIO_BUCKET # (default quine-linux). # Also daily, two hours after quine-global-labs/aurora's daily build, so the # image and ISO pick up its result. Forgejo reads the schedule from pushes to # main, but not from `[skip ci]` ones: after changing it, push without. on: push: branches: [main] tags: ['v*'] schedule: - cron: '0 7 * * *' workflow_dispatch: concurrency: group: iso-${{ github.ref }} cancel-in-progress: true env: REGISTRY: forge.quinefoundation.com BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable IMAGE: forge.quinefoundation.com/quine-global-labs/quine-linux MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }} MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }} jobs: iso: runs-on: runner-x86-linux timeout-minutes: 300 steps: # No submodules: stage 0 (Aurora) comes from the registry now. Our pull # mirror of code.forgejo.org/actions/checkout. - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4 - name: Install task, mc, just, yq and cosign # Only what the runner doesn't already have: runner-x86-linux has # all five from nixpkgs (petersweb-infra, hosts/runner-x86-linux). # dl.min.io's mc answers 410 Gone, so a runner without mc needs one # installed. run: | bin="$HOME/.local/bin" mkdir -p "$bin" have() { command -v "$1" >/dev/null; } have task || curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$bin" # --force: on a host-mode runner $HOME outlives the job. have just || curl -fsSL https://just.systems/install.sh | bash -s -- --force --to "$bin" have yq || { curl -fsSL -o "$bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && chmod +x "$bin/yq"; } have cosign || { curl -fsSL -o "$bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 && chmod +x "$bin/cosign"; } have mc || { curl -fsSL -o "$bin/mc" https://dl.min.io/client/mc/release/linux-amd64/mc && chmod +x "$bin/mc"; } echo "$bin" >> "$GITHUB_PATH" for t in task just yq cosign mc; do printf '%s: ' "$t"; command -v "$t"; done - name: Log in to the registry env: REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }} REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin - name: Vendor upstream images # Into the forge's mirror/ (.forgejo/vendor-images.sh), which the # pulls below then read: bootc-image-builder (Taskfile.yml) and what # Titanoboa's ISO step runs in (Taskfile.yml, FEDORA_IMAGE). run: | .forgejo/vendor-images.sh \ quay.io/fedora/fedora:latest \ ghcr.io/osbuild/bootc-image-builder:latest - name: Pull base images # Before the builds, with retries: quay.io's CDN cuts off multi-GB # layers now and then ("unexpected EOF"), and a pull inside # `buildah build` gives up after one reconnect. Already-pulled # images cost only a manifest check. The upstream ones come from the # forge's mirror/ when it has them (runner-x86-linux's # registries.conf). run: | for img in \ "$BASE_IMAGE" \ quay.io/fedora/fedora:latest \ ghcr.io/osbuild/bootc-image-builder:latest; do for try in 1 2 3 4 5; do podman pull --retry 5 --retry-delay 20s -q "$img" && break [ "$try" != 5 ] || exit 1 echo "retrying $img in 30s"; sleep 30 done done - name: Build image run: task build-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE" - name: Push image run: | tags=(latest "$(date -u +%Y%m%d)" "${GITHUB_SHA::12}") [ "$GITHUB_REF_TYPE" != tag ] || tags+=("$GITHUB_REF_NAME") for t in "${tags[@]}"; do podman tag localhost/quine-linux "$IMAGE:$t" podman push --retry 5 "$IMAGE:$t" done - name: Build disk image run: task build-disk-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE" - name: Build live ISO # Installs quine-linux:latest, which "Push image" just updated. run: task build-live-iso CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE" - name: Upload to MinIO env: MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }} MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }} run: | mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY" mc mb --ignore-existing "store/${MINIO_BUCKET}" # Latest only: each file is 5-8 GB, and the forge VM's disk is # shared. Tagged releases keep their own copies (releases//). ls -lh output/qcow2/disk.qcow2 mc cp output/qcow2/disk.qcow2 "store/${MINIO_BUCKET}/disk/latest/disk.qcow2" ls -lh output/live/Quine-Linux-Live.iso mc cp output/live/Quine-Linux-Live.iso "store/${MINIO_BUCKET}/live/latest/live.iso" - name: Publish the release if: github.ref_type == 'tag' env: MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }} MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }} TOKEN: ${{ github.token }} run: | tag=$GITHUB_REF_NAME mkdir -p release ln -f output/qcow2/disk.qcow2 "release/quine-linux-$tag-x86_64.qcow2" ln -f output/live/Quine-Linux-Live.iso "release/quine-linux-$tag-live-x86_64.iso" (cd release && sha256sum -- * > SHA256SUMS) cat release/SHA256SUMS mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY" for f in release/*; do mc cp "$f" "store/${MINIO_BUCKET}/releases/$tag/${f#release/}"; done api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases" auth=(-H "Authorization: token $TOKEN") # v1.2.3-alpha.1 and the like: a pre-release. pre=false; [[ $tag != *-* ]] || pre=true id=$(jq -n --arg tag "$tag" --arg image "$IMAGE:$tag" --argjson pre "$pre" '{tag_name: $tag, name: $tag, prerelease: $pre, body: "Container image: `\($image)`.\nFiles are checked by SHA256SUMS."}' | curl -fsS "${auth[@]}" -H 'Content-Type: application/json' -d @- "$api" | jq -er .id) for f in release/*; do name=${f#release/} curl -fsS "${auth[@]}" -F "external_url=${MINIO_ENDPOINT}/${MINIO_BUCKET}/releases/$tag/$name" \ "$api/$id/assets?name=$name" >/dev/null echo "linked $name" done echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$tag" - name: Clean up if: always() run: | rm -rf output release podman logout "$REGISTRY" || true # Each build leaves ~100 GB of images and stages; the runner's daily # prune keeps a day's worth, and a second build that day filled the # disk. The next build pulls its bases from the forge again. podman image prune -af >/dev/null || true