build.yml

---
name: build-quantumqat
on:
  pull_request:
    branches:
      - main
  schedule:
    - cron: '05 10 * * *'  # 10:05am UTC everyday
  push:
    branches:
      - main
    paths-ignore:
      - '**/README.md'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

env:
  SOURCE_ORG: "ublue-os"
  SOURCE_REPO: "bazzite"
  IMAGE_SOURCE_TAG: "stable"
  MY_IMAGE_NAME: "quantumqat"
  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"

# Actions are pinned to full commit SHAs for supply-chain safety. The trailing
# "# vX" comment lets Dependabot (.github/dependabot.yml) bump the SHA + comment
# when a new release is published.
jobs:
  build_push:
    name: Build and push image
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      # The entire build/sign/push is handled by the reusable BlueBuild action.
      # It reads recipes/recipe.yml, builds the image, signs it with cosign
      # (SIGNING_SECRET), and pushes to ghcr.io/<owner>/quantumqat.
      - name: Build Custom Image
        uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad  # v1.12.0
        with:
          recipe: recipe.yml
          # Only push+sign on non-PR events. The action defaults to push=true
          # and always cosign-signs what it pushes, so on a `pull_request` it
          # tries to push a `pr-<n>`-tagged image AND sign it. Signing needs
          # SIGNING_SECRET, which is empty on PRs (Dependabot PRs get no Actions
          # secrets at all; regular PRs would sign but we don't want unreviewed
          # code pushed under our key), so the job fails early at the cosign
          # step (~10s). Setting push=false on PRs makes them build-only: the
          # image is still fully built and validated, just not published or
          # signed. The real sign+push happens on the push to main after merge
          # (see the build_iso note below, which relies on the same condition).
          push: ${{ github.event_name != 'pull_request' }}
          cosign_private_key: ${{ secrets.SIGNING_SECRET }}
          registry_token: ${{ github.token }}
          pr_event_number: ${{ github.event.number }}
          maximize_build_space: true

  build_iso:
    name: Build ISO
    runs-on: ubuntu-24.04
    needs: build_push
    # The BlueBuild action does not publish a pullable image on pull_request
    # events, so build the ISO only on push/schedule/manual runs where the
    # `latest` image exists. PRs still validate that the image builds.
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7

      # OUTPUTS:
      #   - SOURCE_VERSION_MAJOR: Fedora major version of the base image (e.g. 43)
      - name: Get image major version
        id: fetch_source_meta
        env:
          org: ${{ env.SOURCE_ORG }}
          BASE_IMAGE: ${{ env.SOURCE_REPO }}
          IMAGE_SOURCE_TAG: ${{ env.IMAGE_SOURCE_TAG }}
        run: |
          set -x
          declare -i SOURCE_VERSION_MAJOR=0

          SOURCE_VERSION=$(
                skopeo inspect --no-tags --raw --config \
                "docker://ghcr.io/${org}/${BASE_IMAGE}:${IMAGE_SOURCE_TAG}" | \
                jq -r '.config.Labels["org.opencontainers.image.version"]'
          )
          if [[ -z $SOURCE_VERSION ]]; then
            echo "::error::SOURCE_VERSION was not fetched correctly"
            exit 1
          fi

          SOURCE_VERSION_MAJOR=$([[ ${SOURCE_VERSION} =~ ^(.*-)?([[:digit:]]+) ]] && echo "${BASH_REMATCH[-1]}")
          if [[ -z ${SOURCE_VERSION_MAJOR} ]] || (( SOURCE_VERSION_MAJOR <= 0 )); then
            echo "::error::SOURCE_VERSION_MAJOR was not fetched correctly: ${SOURCE_VERSION_MAJOR}"
            exit 1
          fi

          echo "SOURCE_VERSION_MAJOR=$SOURCE_VERSION_MAJOR" >>$GITHUB_OUTPUT

      # GitHub usernames may contain uppercase letters which GHCR rejects.
      - name: Lowercase Registry
        id: registry_case
        uses: ASzc/change-string-case-action@ecd1412d078f2e06e9eedcbaa6fcd988151c3f82  # v8
        with:
          string: ${{ env.IMAGE_REGISTRY }}

      - name: Build ISO
        uses: jasonn3/build-container-installer@bed71f841c250650a70f1ed8315ba92da1591ba6  # v1.5.0
        id: build_iso
        with:
          image_name: ${{ env.MY_IMAGE_NAME }}
          image_repo: ${{ steps.registry_case.outputs.lowercase }}
          image_tag: latest
          variant: Kinoite
          version: ${{ steps.fetch_source_meta.outputs.SOURCE_VERSION_MAJOR }}
          secure_boot_key_url: 'https://github.com/ublue-os/bazzite/raw/main/secure_boot.der'
          enrollment_password: 'universalblue'
          additional_templates: '/github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl'
          iso_name: build/${{ env.MY_IMAGE_NAME }}-latest.iso

      - name: Upload ISO as artifact
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: ${{ steps.build_iso.outputs.iso_name }}
          path: |
            ${{ steps.build_iso.outputs.iso_path }}
            ${{ steps.build_iso.outputs.iso_path }}-CHECKSUM
          if-no-files-found: error
          retention-days: 0
          compression-level: 0

  check:
    name: Check all builds successful
    if: always()
    runs-on: ubuntu-latest
    needs: [build_push, build_iso]
    steps:
      - name: Check Jobs
        env:
          JOBS: ${{ toJson(needs) }}
        run: |
          echo "Job status:"
          echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'

          for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
            if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
              echo ""
              echo "Status check not okay!"
              exit 1
            fi
          done