Skip to content

Commit

Permalink
new build scheme
Browse files Browse the repository at this point in the history
  • Loading branch information
@johnmmcgee
johnmmcgee committed Nov 17, 2024
1 parent 5fe9dbb commit cede6d2
Show file tree
Hide file tree
Showing 16 changed files with 710 additions and 754 deletions.
1 change: 0 additions & 1 deletion .github/dependabot.yml
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
---
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
Expand Down
277 changes: 37 additions & 240 deletions .github/workflows/build-desktop.yml
View file
Original file line number Diff line number Diff line change
@@ -1,243 +1,40 @@
---
name: Build mcOS-desktop
name: mcos Build Desktop
on:
workflow_call:
inputs:
tag_version:
description: "The Tag Version for the Build"
required: true
type: string

env:
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
IMAGE_NAME: mcos
IMAGE_STYLED: mcOS
pull_request:
branches:
- main
paths-ignore:
- "**.md"
push:
branches:
- main
paths-ignore:
- "**.md"
schedule:
- cron: "31 6 * * 0" # 6:31 UTC Sunday
- cron: "31 6 * * 1,2,3,4,5,6" # 6:31 UTC Monday-Saturday
workflow_call:
workflow_dispatch:

permissions:
contents: read
packages: write
id-token: write

jobs:
push-ublue:
name: Build Desktop Images
runs-on: ubuntu-24.04
continue-on-error: false
permissions:
contents: read
packages: write
id-token: write
strategy:
fail-fast: false
matrix:
image:
- bluefin
- bluefin-nvidia
tag_version:
- ${{ inputs.tag_version }}

steps:
- name: Build Variables
id: build-vars
uses: Wandalen/wretry.action@v3.5.0
with:
attempt_limit: 3
attempt_delay: 15000
command: |
set -eoux pipefail
image="${{ matrix.image }}"
base_image=${{ matrix.image }}
tag_version=${{ matrix.tag_version }}
if [[ "$tag_version" == "stable" ]]; then
tag_version="${tag_version}-daily"
fi
if [[ ! "${image}" =~ cosmic ]]; then
KERNEL_RELEASE=$(skopeo inspect docker://ghcr.io/ublue-os/"${base_image}:${tag_version}" | jq -r '.Labels["ostree.linux"]')
fedora_version=$(echo $KERNEL_RELEASE | grep -oP 'fc\K[0-9]+')
ver=$(skopeo inspect docker://ghcr.io/ublue-os/"${base_image}:$tag_version" | jq -r '.Labels["org.opencontainers.image.version"]')
fi
case "${image}" in
"bluefin"*|"aurora"*)
upstream_repo=bluefin
;;
*)
echo "Invalid Choice. Exiting..."
exit 1
;;
esac
if [ -z "$ver" ] || [ "null" = "$ver" ]; then
echo "inspected image version must not be empty or null"
exit 1
fi
echo "version=$ver" >> $GITHUB_ENV
echo "tag_version=$tag_version" >> $GITHUB_ENV
echo "kernel_release=${KERNEL_RELEASE}" >> $GITHUB_ENV
echo "fedora_version=${fedora_version}" >> $GITHUB_ENV
echo "upstream_repo=${upstream_repo}" >> $GITHUB_ENV
echo "image=${image}" >> $GITHUB_ENV
echo "base_image=${base_image}" >> $GITHUB_ENV
- name: Verify Base Image
uses: EyeCantCU/cosign-action/verify@v0.2.2
with:
containers: ${{ env.base_image }}:${{ env.tag_version }}
pubkey: https://raw.githubusercontent.com/ublue-os/${{ env.upstream_repo }}/main/cosign.pub
registry: ghcr.io/ublue-os

- name: Pull Images
uses: Wandalen/wretry.action@v3.5.0
id: pull
with:
attempt_limit: 3
attempt_delay: 15000
command: |
set -eoux pipefail
sudo podman pull ghcr.io/ublue-os/${{ env.base_image }}:${{ env.tag_version }}
sudo podman pull ghcr.io/hhd-dev/rechunk:v0.8.6
- name: Checkout Push to Registry Action
uses: actions/checkout@v4

- name: Generate Tags
id: generate_tags
shell: bash
run: |
TIMESTAMP="$(date +%Y%m%d)"
case "${{ env.image }}" in
"bazzite-deck"*)
tag="bazzite-deck"
;;
"bazzite"*)
tag="bazzite"
;;
*)
tag="${{ env.image }}"
esac
if [[ "${{ matrix.tag_version }}" == "latest" ]]; then
tag=${tag}-latest
fi
BUILD_TAGS+=("${tag}" "${tag}-${TIMESTAMP}")
for TAG in "${BUILD_TAGS[@]}"; do
echo "${TAG}"
done
echo "default_tag=${tag}" >> "$GITHUB_OUTPUT"
echo "build_tags=${BUILD_TAGS[*]}" >> "$GITHUB_OUTPUT"
- name: Maximize Build Space
uses: ublue-os/remove-unwanted-software@v7

- name: Build Image
id: build_image
shell: bash
run: |
sudo buildah build \
--format "docker" \
--build-arg IMAGE=${{ env.image }} \
--build-arg BASE_IMAGE=${{ env.base_image }} \
--build-arg TAG_VERSION=${{ env.tag_version }} \
--tag raw-img .
- name: Remove old Images
run: |
set -eoux pipefail
sudo podman image rm ghcr.io/ublue-os/${{ env.base_image }}:${{ env.tag_version }}
- name: Rechunk Image
id: rechunk
uses: hhd-dev/rechunk@v0.8.6
with:
ref: "raw-img"
prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.generate_tags.outputs.default_tag }}"
version: "${{ env.version }}"
rechunk: "ghcr.io/hhd-dev/rechunk:v0.8.6"
labels: |
org.opencontainers.image.title=${{ env.IMAGE_STYLED }}
org.opencontainers.image.description=${{ env.IMAGE_STYLED }} is my customized image of various ublue projects
org.opencontainers.image.version=${{ env.version }}
- name: Load into Podman and Tag
shell: bash
run: |
set -eoux pipefail
IMAGE=$(podman pull ${{ steps.rechunk.outputs.ref }})
sudo rm -rf ${{ steps.rechunk.outputs.output }}
for tag in ${{ steps.generate_tags.outputs.build_tags }}; do
podman tag $IMAGE ${{ env.IMAGE_NAME }}:$tag
done
podman tag $IMAGE rechunked-img
- name: Check Secureboot
id: secureboot
shell: bash
run: |
set -x
if [[ ! $(command -v sbverify) || ! $(command -v curl) || ! $(command -v openssl) ]]; then
sudo apt update
sudo apt install sbsigntool curl openssl
fi
TMP=$(podman create rechunked-img bash)
podman cp $TMP:/usr/lib/modules/${{ env.kernel_release }}/vmlinuz .
podman rm $TMP
# podman run --rm rechunked-img /bin/bash -c "cat /usr/lib/modules/*/vmlinuz" > vmlinuz
sbverify --list vmlinuz
curl --retry 3 -Lo kernel-sign.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key.der
curl --retry 3 -Lo akmods.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key_2.der
openssl x509 -in kernel-sign.der -out kernel-sign.crt
openssl x509 -in akmods.der -out akmods.crt
sbverify --cert kernel-sign.crt vmlinuz || exit 1
sbverify --cert akmods.crt vmlinuz || exit 1
- name: Lowercase Registry
id: registry_case
uses: ASzc/change-string-case-action@v6
with:
string: ${{ env.IMAGE_REGISTRY }}

- name: Push to GHCR
uses: Wandalen/wretry.action@v3.5.0
id: push
if: github.event_name != 'pull_request'
env:
REGISTRY_USER: ${{ github.actor }}
REGISTRY_PASSWORD: ${{ github.token }}
with:
action: redhat-actions/push-to-registry@v2
attempt_limit: 3
attempt_delay: 15000
with: |
image: ${{ env.IMAGE_NAME }}
tags: ${{ steps.generate_tags.outputs.build_tags }}
registry: ${{ steps.registry_case.outputs.lowercase }}
username: ${{ env.REGISTRY_USER }}
password: ${{ env.REGISTRY_PASSWORD }}
extra-args: |
--disable-content-trust
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
if: github.event_name != 'pull_request'
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- uses: sigstore/cosign-installer@v3.5.0
if: github.event_name != 'pull_request'

- name: Sign Container Image
if: github.event_name != 'pull_request'
run: |
cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
env:
TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
COSIGN_EXPERIMENTAL: false
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

- name: Echo Outputs
if: github.event_name != 'pull_request'
run: |
echo "${{ toJSON(steps.push.outputs) }}"
build-desktop-stable:
name: Desktop Stable
uses: ./.github/workflows/reusable-build.yml
secrets: inherit
with:
images: '["bluefin", "bluefin-dx"]'
streams: '["stable"]'
flavors: '["main", "nvidia"]'
build-desktop-testing:
name: Desktop Beta(Testing)
uses: ./.github/workflows/reusable-build.yml
secrets: inherit
with:
images: '["bluefin", "bluefin-dx"]'
streams: '["beta"]'
flavors: '["main", "nvidia"]'
Loading

0 comments on commit cede6d2

Please sign in to comment.