build-quantumqat #841
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: build-quantumqat | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: '05 10 * * *' # 10:05am UTC everyday | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '**/README.md' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref || github.run_id }} | |
| cancel-in-progress: true | |
| env: | |
| SOURCE_ORG: "ublue-os" | |
| SOURCE_REPO: "bazzite" | |
| IMAGE_SOURCE_TAG: "stable" | |
| MY_IMAGE_NAME: "quantumqat" | |
| IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" | |
| # Actions are pinned to full commit SHAs for supply-chain safety. The trailing | |
| # "# vX" comment lets Dependabot (.github/dependabot.yml) bump the SHA + comment | |
| # when a new release is published. | |
| jobs: | |
| build_push: | |
| name: Build and push image | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| # The entire build/sign/push is handled by the reusable BlueBuild action. | |
| # It reads recipes/recipe.yml, builds the image, signs it with cosign | |
| # (SIGNING_SECRET), and pushes to ghcr.io/<owner>/quantumqat. | |
| - name: Build Custom Image | |
| uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad # v1.12.0 | |
| with: | |
| recipe: recipe.yml | |
| # Only push+sign on non-PR events. The action defaults to push=true | |
| # and always cosign-signs what it pushes, so on a `pull_request` it | |
| # tries to push a `pr-<n>`-tagged image AND sign it. Signing needs | |
| # SIGNING_SECRET, which is empty on PRs (Dependabot PRs get no Actions | |
| # secrets at all; regular PRs would sign but we don't want unreviewed | |
| # code pushed under our key), so the job fails early at the cosign | |
| # step (~10s). Setting push=false on PRs makes them build-only: the | |
| # image is still fully built and validated, just not published or | |
| # signed. The real sign+push happens on the push to main after merge | |
| # (see the build_iso note below, which relies on the same condition). | |
| push: ${{ github.event_name != 'pull_request' }} | |
| cosign_private_key: ${{ secrets.SIGNING_SECRET }} | |
| registry_token: ${{ github.token }} | |
| pr_event_number: ${{ github.event.number }} | |
| maximize_build_space: true | |
| build_iso: | |
| name: Build ISO | |
| runs-on: ubuntu-24.04 | |
| needs: build_push | |
| # The BlueBuild action does not publish a pullable image on pull_request | |
| # events, so build the ISO only on push/schedule/manual runs where the | |
| # `latest` image exists. PRs still validate that the image builds. | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| # OUTPUTS: | |
| # - SOURCE_VERSION_MAJOR: Fedora major version of the base image (e.g. 43) | |
| - name: Get image major version | |
| id: fetch_source_meta | |
| env: | |
| org: ${{ env.SOURCE_ORG }} | |
| BASE_IMAGE: ${{ env.SOURCE_REPO }} | |
| IMAGE_SOURCE_TAG: ${{ env.IMAGE_SOURCE_TAG }} | |
| run: | | |
| set -x | |
| declare -i SOURCE_VERSION_MAJOR=0 | |
| SOURCE_VERSION=$( | |
| skopeo inspect --no-tags --raw --config \ | |
| "docker://ghcr.io/${org}/${BASE_IMAGE}:${IMAGE_SOURCE_TAG}" | \ | |
| jq -r '.config.Labels["org.opencontainers.image.version"]' | |
| ) | |
| if [[ -z $SOURCE_VERSION ]]; then | |
| echo "::error::SOURCE_VERSION was not fetched correctly" | |
| exit 1 | |
| fi | |
| SOURCE_VERSION_MAJOR=$([[ ${SOURCE_VERSION} =~ ^(.*-)?([[:digit:]]+) ]] && echo "${BASH_REMATCH[-1]}") | |
| if [[ -z ${SOURCE_VERSION_MAJOR} ]] || (( SOURCE_VERSION_MAJOR <= 0 )); then | |
| echo "::error::SOURCE_VERSION_MAJOR was not fetched correctly: ${SOURCE_VERSION_MAJOR}" | |
| exit 1 | |
| fi | |
| echo "SOURCE_VERSION_MAJOR=$SOURCE_VERSION_MAJOR" >>$GITHUB_OUTPUT | |
| # GitHub usernames may contain uppercase letters which GHCR rejects. | |
| - name: Lowercase Registry | |
| id: registry_case | |
| uses: ASzc/change-string-case-action@ecd1412d078f2e06e9eedcbaa6fcd988151c3f82 # v8 | |
| with: | |
| string: ${{ env.IMAGE_REGISTRY }} | |
| - name: Build ISO | |
| uses: jasonn3/build-container-installer@bed71f841c250650a70f1ed8315ba92da1591ba6 # v1.5.0 | |
| id: build_iso | |
| with: | |
| image_name: ${{ env.MY_IMAGE_NAME }} | |
| image_repo: ${{ steps.registry_case.outputs.lowercase }} | |
| image_tag: latest | |
| variant: Kinoite | |
| version: ${{ steps.fetch_source_meta.outputs.SOURCE_VERSION_MAJOR }} | |
| secure_boot_key_url: 'https://github.com/ublue-os/bazzite/raw/main/secure_boot.der' | |
| enrollment_password: 'universalblue' | |
| additional_templates: '/github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl' | |
| iso_name: build/${{ env.MY_IMAGE_NAME }}-latest.iso | |
| - name: Upload ISO as artifact | |
| id: upload | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: ${{ steps.build_iso.outputs.iso_name }} | |
| path: | | |
| ${{ steps.build_iso.outputs.iso_path }} | |
| ${{ steps.build_iso.outputs.iso_path }}-CHECKSUM | |
| if-no-files-found: error | |
| retention-days: 0 | |
| compression-level: 0 | |
| check: | |
| name: Check all builds successful | |
| if: always() | |
| runs-on: ubuntu-latest | |
| needs: [build_push, build_iso] | |
| steps: | |
| - name: Check Jobs | |
| env: | |
| JOBS: ${{ toJson(needs) }} | |
| run: | | |
| echo "Job status:" | |
| echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"' | |
| for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do | |
| if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then | |
| echo "" | |
| echo "Status check not okay!" | |
| exit 1 | |
| fi | |
| done |