Wesley van TilburgandClaude Opus 5.5
1dbe7f6895
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 9s
Build containers / Prune old releases and tags (pull_request) Skipped
The changes job ran on the bare runner, which has no git (the build jobs install it before checkout). actions/checkout then fell back to a tarball without history, `git diff` failed, `|| true` turned that into an empty change list, and an empty list means "rebuild everything" - on every push and PR. Run the job in the buildroot container with git and nodejs, warn when the diff fails instead of hiding it, treat a diff with no changes as "build nothing", and let a manual run pick one image. The weekly scheduled run still rebuilds all images for package updates. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
281 lines
9.6 KiB
YAML
281 lines
9.6 KiB
YAML
name: Build containers
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
image:
|
|
description: Image to build
|
|
type: choice
|
|
options: [all, fedora-cosmic, fedora-remote, fedora-intune]
|
|
default: all
|
|
pull_request:
|
|
branches: ["main"]
|
|
push:
|
|
branches: ["main"]
|
|
schedule:
|
|
# Weekly, Mondays 04:00 UTC.
|
|
- cron: "0 4 * * 1"
|
|
|
|
jobs:
|
|
# Work out which images actually changed, so a push only rebuilds those.
|
|
changes:
|
|
name: Compute changes
|
|
runs-on: job-v2
|
|
# The runner has no git: without it actions/checkout falls back to a
|
|
# tarball with no history, `git diff` fails and every image is rebuilt.
|
|
container:
|
|
image: "quay.io/fedora-ostree-desktops/buildroot:44"
|
|
outputs:
|
|
cosmic: ${{ steps.changes.outputs.cosmic }}
|
|
remote: ${{ steps.changes.outputs.remote }}
|
|
intune: ${{ steps.changes.outputs.intune }}
|
|
steps:
|
|
- name: Install tools
|
|
run: dnf install -y nodejs git
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Detect changed images
|
|
id: changes
|
|
shell: bash
|
|
env:
|
|
EVENT: ${{ github.event_name }}
|
|
BEFORE: ${{ github.event.before }}
|
|
SHA: ${{ github.sha }}
|
|
BASE_REF: ${{ github.base_ref }}
|
|
DISPATCH_IMAGE: ${{ inputs.image }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Diff the event's commits; any failure rebuilds everything, but
|
|
# say so instead of hiding it.
|
|
diff_or_all() {
|
|
if ! changed="$(git diff --name-only "$@")"; then
|
|
echo "::warning::git diff $* failed; rebuilding every image"
|
|
changed=""
|
|
elif [[ -z "${changed}" ]]; then
|
|
# Nothing changed (e.g. an empty merge): build nothing rather
|
|
# than everything.
|
|
changed="(none)"
|
|
fi
|
|
}
|
|
case "${EVENT}" in
|
|
push)
|
|
if [[ -n "${BEFORE}" && "${BEFORE}" != 0000000000000000000000000000000000000000 ]]; then
|
|
diff_or_all "${BEFORE}" "${SHA}"
|
|
else
|
|
echo "::warning::push without a previous commit; rebuilding every image"
|
|
changed=""
|
|
fi
|
|
;;
|
|
pull_request)
|
|
diff_or_all "origin/${BASE_REF}...HEAD"
|
|
;;
|
|
workflow_dispatch)
|
|
# Pretend the chosen image's directory changed; "all" (or no
|
|
# input) rebuilds everything.
|
|
if [[ -n "${DISPATCH_IMAGE}" && "${DISPATCH_IMAGE}" != all ]]; then
|
|
changed="images/${DISPATCH_IMAGE}/"
|
|
else
|
|
changed=""
|
|
fi
|
|
;;
|
|
*)
|
|
# schedule: the weekly rebuild picks up package updates for all.
|
|
changed=""
|
|
;;
|
|
esac
|
|
printf 'Changed paths:\n%s\n' "${changed:-(all)}"
|
|
eval "$(printf '%s\n' "${changed}" | ./ci-changes.sh)"
|
|
echo "cosmic=${cosmic}" >> "$GITHUB_OUTPUT"
|
|
echo "remote=${remote}" >> "$GITHUB_OUTPUT"
|
|
echo "intune=${intune}" >> "$GITHUB_OUTPUT"
|
|
|
|
build-cosmic:
|
|
name: ${{ matrix.image }} (${{ matrix.distro }})
|
|
needs: changes
|
|
if: needs.changes.outputs.cosmic == 'true'
|
|
runs-on: ${{ matrix.runner }}
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- image: fedora-cosmic
|
|
distro: "44"
|
|
arch: x86_64
|
|
runner: job-v2
|
|
- image: fedora-cosmic
|
|
distro: rawhide
|
|
arch: x86_64
|
|
runner: job-v2
|
|
|
|
container:
|
|
image: "quay.io/fedora-ostree-desktops/buildroot:${{ matrix.distro }}"
|
|
options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
|
|
|
|
env:
|
|
IMAGE: ${{ matrix.image }}
|
|
DISTRO: ${{ matrix.distro }}
|
|
ARCH: ${{ matrix.arch }}
|
|
REGISTRY: git.plabble.org/misthios
|
|
GITEA_URL: https://git.plabble.org
|
|
GITEA_REPO: Misthios/bootc-images
|
|
|
|
steps: &build_steps
|
|
- name: Install build tools
|
|
run: |
|
|
set -xeuo pipefail
|
|
dnf install -y nodejs jq curl git createrepo_c
|
|
dnf install -y skopeo
|
|
dnf install -y cosign || true
|
|
if ! command -v cosign >/dev/null; then
|
|
case "$(uname -m)" in
|
|
x86_64) cosign_arch=amd64 ;;
|
|
aarch64) cosign_arch=arm64 ;;
|
|
*) echo "Unsupported arch for cosign"; exit 1 ;;
|
|
esac
|
|
curl -fsSL -o /usr/local/bin/cosign \
|
|
"https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-${cosign_arch}"
|
|
chmod +x /usr/local/bin/cosign
|
|
fi
|
|
|
|
- name: Configure containers storage
|
|
run: |
|
|
if [ -f /usr/share/containers/storage.conf ]; then
|
|
sed -i 's/driver = "overlay"/driver = "vfs"/' /usr/share/containers/storage.conf
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Log in to registry
|
|
# Only the push step needs it, and PR builds get no secrets.
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -xeuo pipefail
|
|
mkdir -p ~/.docker
|
|
registry_host="${REGISTRY%%/*}"
|
|
echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
|
|
--password-stdin --authfile /tmp/auth.json "${registry_host}"
|
|
echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
|
|
--password-stdin --authfile ~/.docker/config.json "${registry_host}"
|
|
|
|
- name: Build image
|
|
env:
|
|
KANIDM_UNIXD_TOKEN: ${{ secrets.KANIDM_UNIXD_TOKEN }}
|
|
run: ./build.sh "${IMAGE}" "${DISTRO}" "${ARCH}"
|
|
|
|
- name: Push and sign image
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
|
|
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
|
|
run: |
|
|
set -xeuo pipefail
|
|
export STORAGE_DRIVER=vfs
|
|
buildid="$(cat .buildid)"
|
|
oci="build/${IMAGE}-${DISTRO}-${ARCH}/${IMAGE}-${DISTRO}-${ARCH}.ociarchive"
|
|
tag="${DISTRO}.${buildid}"
|
|
|
|
skopeo copy --authfile /tmp/auth.json \
|
|
"oci-archive:${oci}" "docker://${REGISTRY}/${IMAGE}:${tag}"
|
|
skopeo copy --authfile /tmp/auth.json \
|
|
"oci-archive:${oci}" "docker://${REGISTRY}/${IMAGE}:${DISTRO}"
|
|
|
|
printf '%s' "${COSIGN_PRIVATE_KEY}" | base64 -d > private.key
|
|
cosign sign -y --key private.key "${REGISTRY}/${IMAGE}:${tag}"
|
|
cosign sign -y --key private.key "${REGISTRY}/${IMAGE}:${DISTRO}"
|
|
rm -f private.key
|
|
|
|
- name: Generate changelog and publish release
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
buildid="$(cat .buildid)"
|
|
pkgs="build/${IMAGE}-${DISTRO}-${ARCH}/packages-current.txt"
|
|
./release.sh "${IMAGE}" "${DISTRO}" "${buildid}" "${pkgs}"
|
|
|
|
build-remote:
|
|
name: fedora-remote (44)
|
|
needs: changes
|
|
if: needs.changes.outputs.remote == 'true'
|
|
runs-on: job-v2
|
|
|
|
container:
|
|
image: "quay.io/fedora-ostree-desktops/buildroot:44"
|
|
options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
|
|
|
|
env:
|
|
IMAGE: fedora-remote
|
|
DISTRO: "44"
|
|
ARCH: x86_64
|
|
REGISTRY: git.plabble.org/misthios
|
|
GITEA_URL: https://git.plabble.org
|
|
GITEA_REPO: Misthios/bootc-images
|
|
|
|
steps: *build_steps
|
|
|
|
build-intune:
|
|
name: fedora-intune (44)
|
|
needs: changes
|
|
if: needs.changes.outputs.intune == 'true'
|
|
runs-on: job-v2
|
|
|
|
container:
|
|
image: "quay.io/fedora-ostree-desktops/buildroot:44"
|
|
options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
|
|
|
|
env:
|
|
IMAGE: fedora-intune
|
|
DISTRO: "44"
|
|
ARCH: x86_64
|
|
REGISTRY: git.plabble.org/misthios
|
|
GITEA_URL: https://git.plabble.org
|
|
GITEA_REPO: Misthios/bootc-images
|
|
|
|
steps: *build_steps
|
|
|
|
prune:
|
|
name: Prune old releases and tags
|
|
runs-on: job-v2
|
|
needs: [changes, build-cosmic, build-remote, build-intune]
|
|
# Run even if some builds were skipped or failed.
|
|
if: ${{ always() && github.event_name != 'pull_request' }}
|
|
container:
|
|
image: "quay.io/fedora-ostree-desktops/buildroot:44"
|
|
options: "--security-opt=label=disable --privileged --user 0:0"
|
|
env:
|
|
GITEA_URL: https://git.plabble.org
|
|
GITEA_REPO: Misthios/bootc-images
|
|
steps:
|
|
- name: Install tools
|
|
run: dnf install -y nodejs jq curl skopeo
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Prune old releases
|
|
env:
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
for image in fedora-cosmic fedora-remote fedora-intune; do
|
|
./prune-releases.sh "${image}"
|
|
done
|
|
- name: Prune old registry tags
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -xeuo pipefail
|
|
authfile=/tmp/prune-auth.json
|
|
echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
|
|
--password-stdin --authfile "${authfile}" git.plabble.org
|
|
for image in fedora-cosmic fedora-remote fedora-intune; do
|
|
AUTHFILE="${authfile}" ./prune-registry.sh "${image}" Misthios 44 rawhide
|
|
done
|