name: Image and installer ISO

# Builds the quine-linux image on our Aurora build (published by
# quine-global-labs/aurora's workflow to this forge's registry), pushes it to
# forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
# `<date>`, the commit), then builds the installer ISO from it and uploads
# that to MinIO as <bucket>/installer/<commit>/install.iso and
# <bucket>/installer/latest/install.iso.
#
# Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
# hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with
# root podman and ~30 GB of free disk.
#
# Upstream images (Fedora's, bootc-image-builder) are vendored into
# forge.quinefoundation.com/quine-global-labs/mirror/ first, and pulled
# from there (.forgejo/vendor-images.sh).
#
# Secrets: REGISTRY_TOKEN (a Forgejo token with package write access),
# MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's just the
# MinIO user's name, `quine-linux`).
# Variables (optional): REGISTRY_USER (the token's owner; default: the
# actor), MINIO_ENDPOINT (default https://s3.quineglobal.com), MINIO_BUCKET
# (default quine-linux).

# Also daily, two hours after quine-global-labs/aurora's daily build, so the
# image and ISO pick up its result.
on:
  push:
    branches: [main]
  schedule:
    - cron: '0 7 * * *'
  workflow_dispatch:

concurrency:
  group: iso-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: forge.quinefoundation.com
  BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
  IMAGE: forge.quinefoundation.com/quine-global-labs/quine-linux
  MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }}
  MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }}

jobs:
  iso:
    runs-on: runner-x86-linux
    timeout-minutes: 300
    steps:
      # No submodules: stage 0 (Aurora) comes from the registry now. Our pull
      # mirror of code.forgejo.org/actions/checkout.
      - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4

      - name: Install task, mc, just, yq and cosign
        # Only what the runner doesn't already have: runner-x86-linux has
        # all five from nixpkgs (petersweb-infra, hosts/runner-x86-linux).
        # dl.min.io's mc answers 410 Gone, so a runner without mc needs one
        # installed.
        run: |
          bin="$HOME/.local/bin"
          mkdir -p "$bin"
          have() { command -v "$1" >/dev/null; }
          have task || curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$bin"
          # --force: on a host-mode runner $HOME outlives the job.
          have just || curl -fsSL https://just.systems/install.sh | bash -s -- --force --to "$bin"
          have yq || { curl -fsSL -o "$bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && chmod +x "$bin/yq"; }
          have cosign || { curl -fsSL -o "$bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 && chmod +x "$bin/cosign"; }
          have mc || { curl -fsSL -o "$bin/mc" https://dl.min.io/client/mc/release/linux-amd64/mc && chmod +x "$bin/mc"; }
          echo "$bin" >> "$GITHUB_PATH"
          for t in task just yq cosign mc; do printf '%s: ' "$t"; command -v "$t"; done

      - name: Log in to the registry
        env:
          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin

      - name: Vendor upstream images
        # Into the forge's mirror/ (.forgejo/vendor-images.sh), which the
        # pulls below then read: the installer's two bases
        # (installer/Containerfile) and bootc-image-builder (Taskfile.yml).
        run: |
          .forgejo/vendor-images.sh \
            quay.io/fedora/fedora-bootc:rawhide \
            registry.fedoraproject.org/fedora:rawhide \
            ghcr.io/osbuild/bootc-image-builder:latest

      - name: Pull base images
        # Before the builds, with retries: quay.io's CDN cuts off multi-GB
        # layers now and then ("unexpected EOF"), and a pull inside
        # `buildah build` gives up after one reconnect. Already-pulled
        # images cost only a manifest check. The upstream ones come from the
        # forge's mirror/ when it has them (runner-x86-linux's
        # registries.conf).
        run: |
          for img in \
            "$BASE_IMAGE" \
            quay.io/fedora/fedora-bootc:rawhide \
            registry.fedoraproject.org/fedora:rawhide \
            ghcr.io/osbuild/bootc-image-builder:latest; do
            for try in 1 2 3 4 5; do
              podman pull --retry 5 --retry-delay 20s -q "$img" && break
              [ "$try" != 5 ] || exit 1
              echo "retrying $img in 30s"; sleep 30
            done
          done

      - name: Build image
        run: task build-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"

      - name: Push image
        run: |
          for t in latest "$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
            podman tag localhost/quine-linux "$IMAGE:$t"
            podman push --retry 5 "$IMAGE:$t"
          done

      - name: Build installer ISO
        run: task build-installer-iso CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"

      - name: Upload to MinIO
        env:
          MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
        run: |
          # Normally output/bootiso/: bootc-image-builder names the folder
          # after its export, not the image type, so look rather than assume.
          iso=$(find output -name install.iso -print -quit)
          [ -n "$iso" ] || { echo "no install.iso under output/:"; find output -maxdepth 2; exit 1; }
          echo "ISO: $iso"
          ls -lh "$iso"
          mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY"
          mc mb --ignore-existing "store/${MINIO_BUCKET}"
          dest="store/${MINIO_BUCKET}/installer"
          mc cp "$iso" "${dest}/${GITHUB_SHA}/install.iso"
          mc cp "${dest}/${GITHUB_SHA}/install.iso" "${dest}/latest/install.iso"

      - name: Clean up
        if: always()
        run: |
          rm -rf output
          podman logout "$REGISTRY" || true