Skip to content

Commit cedc1fe

Browse files
BigSpaceshipsBigSpaceships
authored
Initial commit
0 parents  commit cedc1fe

17 files changed

Lines changed: 1431 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
schedule:
11+
interval: "weekly"

‎.github/renovate.json5‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:best-practices",
5+
],
6+
7+
"rebaseWhen": "never",
8+
9+
"packageRules": [
10+
{
11+
"automerge": true,
12+
"matchUpdateTypes": ["pin", "pinDigest"]
13+
},
14+
{
15+
"enabled": false,
16+
"matchUpdateTypes": ["digest", "pinDigest", "pin"],
17+
"matchDepTypes": ["container"],
18+
"matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
19+
},
20+
]
21+
}

‎.github/workflows/build-disk.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
name: Build disk images
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
upload-to-s3:
8+
description: "Upload to S3"
9+
required: false
10+
default: false
11+
type: boolean
12+
platform:
13+
required: true
14+
type: choice
15+
options:
16+
- amd64
17+
- arm64
18+
pull_request:
19+
branches:
20+
- main
21+
paths:
22+
- './disk_config/disk.toml'
23+
- './disk_config/iso.toml'
24+
- './.github/workflows/build-disk.yml'
25+
26+
env:
27+
IMAGE_NAME: ${{ github.event.repository.name }} # output of build.yml, keep in sync
28+
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit
29+
DEFAULT_TAG: "latest"
30+
BIB_IMAGE: "quay.io/centos-bootc/bootc-image-builder:latest"
31+
32+
concurrency:
33+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
34+
cancel-in-progress: true
35+
36+
jobs:
37+
build:
38+
name: Build disk images
39+
runs-on: ${{ inputs.platform == 'amd64' && 'ubuntu-26.04' || 'ubuntu-26.04-arm' }}
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
disk-type: ["qcow2", "anaconda-iso"]
44+
permissions:
45+
contents: read
46+
packages: read
47+
id-token: write
48+
49+
steps:
50+
- name: Prepare environment
51+
run: |
52+
USER_UID=$(id -u)
53+
USER_GID=$(id -g)
54+
# Concatenate the types with a hyphen
55+
DISK_TYPE=$(echo "${{ matrix.disk-type }}" | tr ' ' '-')
56+
# Lowercase the image uri
57+
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
58+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
59+
echo "DISK_TYPE=${DISK_TYPE}" >> ${GITHUB_ENV}
60+
echo "USER_UID=${USER_UID}" >> ${GITHUB_ENV}
61+
echo "USER_GID=${USER_GID}" >> ${GITHUB_ENV}
62+
63+
- name: Install dependencies
64+
if: inputs.platform == 'arm64'
65+
run: |
66+
set -x
67+
sudo apt update -y
68+
sudo apt install -y \
69+
podman
70+
71+
- name: Maximize build space
72+
if: inputs.platform != 'arm64'
73+
uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
74+
with:
75+
remove-codeql: true
76+
77+
- name: Checkout
78+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
79+
80+
- name: Build disk images
81+
id: build
82+
uses: osbuild/bootc-image-builder-action@8661cd3832544ad68c12dcde8681b13ab0f56a8d # main
83+
with:
84+
builder-image: ${{ env.BIB_IMAGE }}
85+
config-file: ${{ matrix.disk-type == 'anaconda-iso' && './disk_config/iso.toml' || './disk_config/disk.toml' }}
86+
image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
87+
chown: ${{ env.USER_UID }}:${{ env.USER_GID }}
88+
types: ${{ matrix.disk-type }}
89+
additional-args: --use-librepo=True
90+
91+
- name: Upload disk images and Checksum to Job Artifacts
92+
if: inputs.upload-to-s3 != true && github.event_name != 'pull_request'
93+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
94+
with:
95+
path: ${{ steps.build.outputs.output-directory }}
96+
if-no-files-found: error
97+
retention-days: 0
98+
compression-level: 0
99+
overwrite: true
100+
101+
- name: Upload to S3
102+
if: inputs.upload-to-s3 == true && github.event_name != 'pull_request'
103+
shell: bash
104+
env:
105+
RCLONE_CONFIG_S3_TYPE: s3
106+
RCLONE_CONFIG_S3_PROVIDER: ${{ secrets.S3_PROVIDER }}
107+
RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
108+
RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
109+
RCLONE_CONFIG_S3_REGION: ${{ secrets.S3_REGION }}
110+
RCLONE_CONFIG_S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
111+
SOURCE_DIR: ${{ steps.build.outputs.output-directory }}
112+
run: |
113+
sudo apt-get update
114+
sudo apt-get install -y rclone
115+
rclone copy $SOURCE_DIR S3:${{ secrets.S3_BUCKET_NAME }}

‎.github/workflows/build.yml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
---
2+
name: Build container image
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
schedule:
8+
- cron: '05 10 * * *' # 10:05am UTC everyday
9+
push:
10+
branches:
11+
- main
12+
paths-ignore:
13+
- '**/README.md'
14+
workflow_dispatch:
15+
16+
env:
17+
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
21+
cancel-in-progress: true
22+
23+
jobs:
24+
build_push:
25+
name: Build and push image
26+
runs-on: ubuntu-26.04
27+
28+
permissions:
29+
contents: read
30+
packages: write
31+
id-token: write
32+
33+
steps:
34+
# These stage versions are pinned by https://github.com/renovatebot/renovate
35+
- name: Checkout
36+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
37+
38+
- name: Maximize build space
39+
uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
40+
41+
- name: Install just
42+
uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0
43+
44+
- name: Check Just Syntax
45+
shell: bash
46+
run: |
47+
just check
48+
49+
- name: Image Name
50+
id: image-name
51+
run: |
52+
IMAGE_NAME=$(just image_name)
53+
54+
echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
55+
56+
- name: Default Tag
57+
id: gen-default-tag
58+
run: |
59+
DEFAULT_TAG=$(just generate-default-tag)
60+
61+
echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
62+
63+
- name: Prepare environment
64+
run: |
65+
# Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
66+
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
67+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
68+
69+
# This actually builds the container image
70+
- name: Build Image
71+
id: build-image
72+
run: |
73+
just build \
74+
${IMAGE_NAME} \
75+
${DEFAULT_TAG}
76+
77+
# This is optional, this provides smaller delta updates
78+
- name: Rechunk with rpm-ostree
79+
id: rechunk
80+
run: |
81+
just ostree-rechunk \
82+
${IMAGE_NAME} \
83+
${DEFAULT_TAG}
84+
85+
# If you are feeling adventurous, use the new distro agnostic rechunker
86+
# https://github.com/coreos/chunkah
87+
# You can delete the Rechunk with rpm-ostree portion then if you use this
88+
#- name: Rechunk with Chunkah
89+
# id: rechunk
90+
# run: |
91+
# just rechunk \
92+
# ${IMAGE_NAME} \
93+
# ${DEFAULT_TAG}
94+
95+
- name: Generate Build Tags
96+
id: gen-build-tags
97+
run: |
98+
alias_tags="$(just generate-build-tags \
99+
${IMAGE_NAME} \
100+
${DEFAULT_TAG})"
101+
102+
echo "Tags for this Action..."
103+
echo "${alias_tags}"
104+
echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
105+
106+
- name: Tag Image
107+
id: tag-images
108+
env:
109+
ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
110+
run: |
111+
just tag-images \
112+
"${IMAGE_NAME}" \
113+
"${DEFAULT_TAG}" \
114+
"${ALIAS_TAGS}"
115+
116+
# These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
117+
# They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
118+
- name: Login to GitHub Container Registry
119+
uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
120+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
121+
with:
122+
registry: ghcr.io
123+
username: ${{ github.actor }}
124+
password: ${{ secrets.GITHUB_TOKEN }}
125+
126+
- name: Push To GHCR
127+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
128+
id: push-image
129+
env:
130+
ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
131+
run: |
132+
set -euox pipefail
133+
for tag in ${ALIAS_TAGS}; do
134+
podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
135+
done
136+
137+
digest=$(< /tmp/digestfile)
138+
139+
echo "digest=${digest}" >> $GITHUB_OUTPUT
140+
141+
# This section is optional and only needs to be enabled if you plan on distributing
142+
# your project for others to consume. You will need to create a public and private key
143+
# using Cosign and save the private key as a repository secret in Github for this workflow
144+
# to consume. For more details, review the image signing section of the README.
145+
- name: Install Cosign
146+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
147+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
148+
with:
149+
# be careful when upgrading major versions
150+
cosign-release: 'v3.1.2'
151+
152+
- name: Sign container image
153+
id: sign-image
154+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
155+
env:
156+
COSIGN_EXPERIMENTAL: false
157+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
158+
DIGEST: ${{ steps.push-image.outputs.digest }}
159+
run: |
160+
# https://github.com/containers/container-libs/issues/388
161+
# https://github.com/coreos/rpm-ostree/issues/5509
162+
# use old bundle format, so we can use newer cosign 3.X.X instead of 2.X.X
163+
cosign sign -y --new-bundle-format=false --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
164+

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
cosign.key
2+
_build_*
3+
output
4+
_build-*/**
5+
*_chunkah_*
6+
*_rpm-ostree_*

‎Containerfile‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Allow build scripts to be referenced without being copied into the final image
2+
FROM scratch AS ctx
3+
COPY build_files /
4+
COPY system_files /system_files
5+
6+
# Base Image
7+
FROM ghcr.io/ublue-os/bazzite:stable@sha256:9556db65991d57a03a7dc18e4ba28a686d8bcdcd6b61235aa69c8267bb22ff76
8+
## Other possible base images include:
9+
# FROM ghcr.io/ublue-os/bazzite:testing
10+
# FROM ghcr.io/ublue-os/aurora:stable
11+
# FROM ghcr.io/ublue-os/bluefin-nvidia-open:stable
12+
#
13+
# ... and so on, here are more base images
14+
# Universal Blue Images: https://github.com/orgs/ublue-os/packages
15+
# Fedora base image: quay.io/fedora/fedora-bootc:44
16+
# CentOS base images: quay.io/centos-bootc/centos-bootc:stream10
17+
18+
### [IM]MUTABLE /opt
19+
## Some bootable images, like Fedora, have /opt symlinked to /var/opt, in order to
20+
## make it mutable/writable for users. However, some packages write files to this directory,
21+
## thus its contents might be wiped out when bootc deploys an image, making it troublesome for
22+
## some packages. Eg, google-chrome, docker-desktop.
23+
##
24+
## Uncomment the following line if one desires to make /opt immutable and be able to be used
25+
## by the package manager.
26+
27+
# RUN rm /opt && mkdir /opt
28+
29+
### MODIFICATIONS
30+
## make modifications desired in your image and install packages by modifying the build.sh script
31+
## the following RUN directive does all the things required to run "build.sh" as recommended.
32+
33+
RUN --mount=type=bind,from=ctx,source=/,target=/ctx \
34+
--mount=type=cache,dst=/var/cache \
35+
--mount=type=cache,dst=/var/log \
36+
--mount=type=tmpfs,dst=/tmp \
37+
/ctx/build.sh
38+
39+
### LINTING
40+
## Verify final image and contents are correct.
41+
RUN bootc container lint

0 commit comments

Comments
 (0)