e2e.yaml

name: e2e melange bootstrap + build

on:
  push:
  pull_request:

jobs:
  build:
    name: bootstrap package
    runs-on: ubuntu-latest
    container:
      image: alpine:latest
      options: |
        --cap-add NET_ADMIN --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor:unconfined

    steps:
    - name: Fetch dependencies
      run: |
        cat >/etc/apk/repositories <<_EOF_
        https://dl-cdn.alpinelinux.org/alpine/edge/main
        https://dl-cdn.alpinelinux.org/alpine/edge/community
        https://dl-cdn.alpinelinux.org/alpine/edge/testing
        _EOF_

        apk upgrade -Ua
        apk add go cosign build-base git bubblewrap
    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
    - name: Mark workspace as a safe repository
      run: git config --global --add safe.directory ${GITHUB_WORKSPACE}
    - name: Build bootstrap melange tool (stage1)
      run: make melange
    - name: Generate a package signing keypair
      run: |
        ./melange keygen
        mv melange.rsa.pub /etc/apk/keys
    - name: Prepare build workspace for stage2
      run: |
        git clone . workspace-stage2/x86_64
    - name: Build stage2 melange package with bootstrap melange
      run: ./melange build --pipeline-dir=pipelines/ --signing-key=melange.rsa --arch x86_64 --workspace-dir workspace-stage2/
    - name: Install stage2 melange package
      run: apk add ./packages/x86_64/melange-*.apk
    - name: Move stage2 artifacts to stage2 directory
      run: |
        mv packages stage2
    - name: Verify operation of stage2 melange
      run: melange version
    - name: Prepare build workspace for stage3
      run: |
        git clone . workspace-stage3/x86_64
    - name: Build stage3 melange package with stage2 melange
      run: melange build --signing-key=melange.rsa --arch x86_64 --workspace-dir workspace-stage3/
    - name: Install stage3 melange package
      run: apk add ./packages/x86_64/melange-*.apk
    - name: Move stage3 artifacts to stage3 directory
      run: |
        mv packages stage3
    - name: Ensure melange package is reproducible
      run: |
        sha256sum stage2/x86_64/*.apk | sed -e 's:stage2/:stage3/:g' | sha256sum -c
    - name: Verify operation of stage3 melange
      run: melange version