c22aae0591
Some checks failed
Image, disk image and live ISO / iso (push) Has been cancelled
The live ISO's installs now pull and update from registry.quineglobal.com/quine-linux:latest (Taskfile's UPDATE_IMAGE), our own pull-only name for the forge's image, instead of the forge's hostname, so the update source outlives where the images are stored. CI still pushes to the forge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
183 lines
8.4 KiB
YAML
183 lines
8.4 KiB
YAML
name: Image, disk image and live ISO
|
|
|
|
# Builds the quine-linux image on our Aurora build (published by
|
|
# quine-global-labs/aurora's workflow to this forge's registry), pushes it to
|
|
# forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
|
|
# `<date>`, the commit; installed systems pull it as
|
|
# registry.quineglobal.com/quine-linux, a pull-only name for it), then
|
|
# builds a disk image (qcow2) and the live ISO
|
|
# (which is also the installer, as Aurora's) from it and uploads them to MinIO
|
|
# as <bucket>/disk/latest/disk.qcow2 and <bucket>/live/latest/live.iso,
|
|
# replacing the last build's.
|
|
#
|
|
# Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
|
|
# hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with
|
|
# root podman and ~30 GB of free disk.
|
|
#
|
|
# A tag `v*` also publishes a release: the files go to MinIO's public
|
|
# <bucket>/releases/<tag>/, and a Forgejo release on this repo links to them
|
|
# (Forgejo's external-URL release files: the images are too big for GitHub's
|
|
# 2 GiB limit, and this keeps one copy). The website lists these releases.
|
|
#
|
|
# Upstream images (Fedora's, bootc-image-builder) are vendored into
|
|
# forge.quinefoundation.com/quine-global-labs/mirror/ first, and pulled
|
|
# from there (.forgejo/vendor-images.sh).
|
|
#
|
|
# Secrets: REGISTRY_TOKEN (a Forgejo token with package write access),
|
|
# MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's just the
|
|
# MinIO user's name, `quine-linux`).
|
|
# Variables (optional): REGISTRY_USER (the token's owner; default: the
|
|
# actor), MINIO_ENDPOINT (default https://s3.quineglobal.com), MINIO_BUCKET
|
|
# (default quine-linux).
|
|
|
|
# Also daily, two hours after quine-global-labs/aurora's daily build, so the
|
|
# image and ISO pick up its result. Forgejo reads the schedule from pushes to
|
|
# main, but not from `[skip ci]` ones: after changing it, push without.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
schedule:
|
|
- cron: '0 7 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: iso-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
REGISTRY: forge.quinefoundation.com
|
|
BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
|
|
IMAGE: forge.quinefoundation.com/quine-global-labs/quine-linux
|
|
MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }}
|
|
MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }}
|
|
|
|
jobs:
|
|
iso:
|
|
runs-on: runner-x86-linux
|
|
timeout-minutes: 300
|
|
steps:
|
|
# No submodules: stage 0 (Aurora) comes from the registry now. Our pull
|
|
# mirror of code.forgejo.org/actions/checkout.
|
|
- uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
|
|
|
|
- name: Install task, mc, just, yq and cosign
|
|
# Only what the runner doesn't already have: runner-x86-linux has
|
|
# all five from nixpkgs (petersweb-infra, hosts/runner-x86-linux).
|
|
# dl.min.io's mc answers 410 Gone, so a runner without mc needs one
|
|
# installed.
|
|
run: |
|
|
bin="$HOME/.local/bin"
|
|
mkdir -p "$bin"
|
|
have() { command -v "$1" >/dev/null; }
|
|
have task || curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$bin"
|
|
# --force: on a host-mode runner $HOME outlives the job.
|
|
have just || curl -fsSL https://just.systems/install.sh | bash -s -- --force --to "$bin"
|
|
have yq || { curl -fsSL -o "$bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && chmod +x "$bin/yq"; }
|
|
have cosign || { curl -fsSL -o "$bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 && chmod +x "$bin/cosign"; }
|
|
have mc || { curl -fsSL -o "$bin/mc" https://dl.min.io/client/mc/release/linux-amd64/mc && chmod +x "$bin/mc"; }
|
|
echo "$bin" >> "$GITHUB_PATH"
|
|
for t in task just yq cosign mc; do printf '%s: ' "$t"; command -v "$t"; done
|
|
|
|
- name: Log in to the registry
|
|
env:
|
|
REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
|
|
|
|
- name: Vendor upstream images
|
|
# Into the forge's mirror/ (.forgejo/vendor-images.sh), which the
|
|
# pulls below then read: bootc-image-builder (Taskfile.yml) and what
|
|
# Titanoboa's ISO step runs in (Taskfile.yml, FEDORA_IMAGE).
|
|
run: |
|
|
.forgejo/vendor-images.sh \
|
|
quay.io/fedora/fedora:latest \
|
|
ghcr.io/osbuild/bootc-image-builder:latest
|
|
|
|
- name: Pull base images
|
|
# Before the builds, with retries: quay.io's CDN cuts off multi-GB
|
|
# layers now and then ("unexpected EOF"), and a pull inside
|
|
# `buildah build` gives up after one reconnect. Already-pulled
|
|
# images cost only a manifest check. The upstream ones come from the
|
|
# forge's mirror/ when it has them (runner-x86-linux's
|
|
# registries.conf).
|
|
run: |
|
|
for img in \
|
|
"$BASE_IMAGE" \
|
|
quay.io/fedora/fedora:latest \
|
|
ghcr.io/osbuild/bootc-image-builder:latest; do
|
|
for try in 1 2 3 4 5; do
|
|
podman pull --retry 5 --retry-delay 20s -q "$img" && break
|
|
[ "$try" != 5 ] || exit 1
|
|
echo "retrying $img in 30s"; sleep 30
|
|
done
|
|
done
|
|
|
|
- name: Build image
|
|
run: task build-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
|
|
|
|
- name: Push image
|
|
run: |
|
|
tags=(latest "$(date -u +%Y%m%d)" "${GITHUB_SHA::12}")
|
|
[ "$GITHUB_REF_TYPE" != tag ] || tags+=("$GITHUB_REF_NAME")
|
|
for t in "${tags[@]}"; do
|
|
podman tag localhost/quine-linux "$IMAGE:$t"
|
|
podman push --retry 5 "$IMAGE:$t"
|
|
done
|
|
|
|
- name: Build disk image
|
|
run: task build-disk-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
|
|
|
|
- name: Build live ISO
|
|
# Installs quine-linux:latest, which "Push image" just updated.
|
|
run: task build-live-iso CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
|
|
|
|
- name: Upload to MinIO
|
|
env:
|
|
MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
|
|
MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
|
|
run: |
|
|
mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY"
|
|
mc mb --ignore-existing "store/${MINIO_BUCKET}"
|
|
# Latest only: each file is 5-8 GB, and the forge VM's disk is
|
|
# shared. Tagged releases keep their own copies (releases/<tag>/).
|
|
ls -lh output/qcow2/disk.qcow2
|
|
mc cp output/qcow2/disk.qcow2 "store/${MINIO_BUCKET}/disk/latest/disk.qcow2"
|
|
ls -lh output/live/Quine-Linux-Live.iso
|
|
mc cp output/live/Quine-Linux-Live.iso "store/${MINIO_BUCKET}/live/latest/live.iso"
|
|
|
|
- name: Publish the release
|
|
if: github.ref_type == 'tag'
|
|
env:
|
|
MINIO_ACCESS_KEY: ${{ vars.MINIO_ACCESS_KEY || secrets.MINIO_ACCESS_KEY }}
|
|
MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag=$GITHUB_REF_NAME
|
|
mkdir -p release
|
|
ln -f output/qcow2/disk.qcow2 "release/quine-linux-$tag-x86_64.qcow2"
|
|
ln -f output/live/Quine-Linux-Live.iso "release/quine-linux-$tag-live-x86_64.iso"
|
|
(cd release && sha256sum -- * > SHA256SUMS)
|
|
cat release/SHA256SUMS
|
|
|
|
mc alias set store "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY"
|
|
for f in release/*; do mc cp "$f" "store/${MINIO_BUCKET}/releases/$tag/${f#release/}"; done
|
|
|
|
api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases"
|
|
auth=(-H "Authorization: token $TOKEN")
|
|
id=$(jq -n --arg tag "$tag" --arg image "$IMAGE:$tag" '{tag_name: $tag, name: $tag,
|
|
body: "Container image: `\($image)`.\nFiles are checked by SHA256SUMS."}' |
|
|
curl -fsS "${auth[@]}" -H 'Content-Type: application/json' -d @- "$api" | jq -er .id)
|
|
for f in release/*; do
|
|
name=${f#release/}
|
|
curl -fsS "${auth[@]}" -F "external_url=${MINIO_ENDPOINT}/${MINIO_BUCKET}/releases/$tag/$name" \
|
|
"$api/$id/assets?name=$name" >/dev/null
|
|
echo "linked $name"
|
|
done
|
|
echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$tag"
|
|
|
|
- name: Clean up
|
|
if: always()
|
|
run: |
|
|
rm -rf output release
|
|
podman logout "$REGISTRY" || true
|