build-ublue #59
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build-ublue | |
| on: | |
| # Build *every* branch at 10:20pm UTC every day (1 hr delay after "nvidia" builds), | |
| # regardless of the branch names. (Not just "live, template and main" branches.) | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule | |
| schedule: | |
| - cron: "20 22 * * *" | |
| # Build automatically after pushing commits or tags to the "live", "template" | |
| # or "main" branches, except when the commit only affects "documentation" text files. | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push | |
| push: | |
| branches: | |
| - live | |
| - template | |
| - main | |
| paths-ignore: | |
| - "**.md" | |
| - "**.txt" | |
| # Build pull requests whenever they are opened or updated, to make sure they | |
| # work. The build won't be deployed, since we filter out PRs in the deployment | |
| # stage. Note that submitted PRs run the workflow of the *fork's* own primary | |
| # branch, using the fork's own secrets/environment. Please be sure to sync | |
| # your primary branch with upstream's latest workflow before submitting PRs! | |
| # For pull requests, we build *any* branch regardless of name, to allow "build | |
| # checks" to succeed for typical PR branch names such as "fix-something". | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request | |
| pull_request: | |
| paths-ignore: | |
| - "**.md" | |
| - "**.txt" | |
| # Build when manually triggering this workflow for a branch. This allows you | |
| # to build any branch, even if it's not listed in the automated triggers above. | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch | |
| workflow_dispatch: | |
| env: | |
| IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} | |
| jobs: | |
| push-ghcr: | |
| # Only deploys the branch named "live". Ignores all other branches, to allow | |
| # having "development" branches without interfering with GHCR image uploads. | |
| name: Build and push image | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| recipe: | |
| - recipe.yml | |
| steps: | |
| # Checkout push-to-registry action GitHub repository | |
| - name: Checkout Push to Registry action | |
| uses: actions/checkout@v3 | |
| - name: Add yq for reading recipe.yml | |
| uses: mikefarah/yq@v4.33.3 | |
| - name: Gather image data from recipe | |
| run: | | |
| echo "IMAGE_NAME=$(yq '.name' ./${{ matrix.recipe }})" >> $GITHUB_ENV | |
| echo "IMAGE_DESCRIPTION=$(yq '.description' ./${{ matrix.recipe }})" >> $GITHUB_ENV | |
| echo "FEDORA_MAJOR_VERSION=$(yq '.fedora-version' ./${{ matrix.recipe }})" >> $GITHUB_ENV | |
| echo "BASE_IMAGE_URL=$(yq '.base-image' ./${{ matrix.recipe }})" >> $GITHUB_ENV | |
| - name: Generate tags | |
| id: generate-tags | |
| shell: bash | |
| run: | | |
| # Generate a timestamp for creating an image version history | |
| TIMESTAMP="$(date +%Y%m%d)" | |
| MAJOR_VERSION="${{ env.FEDORA_MAJOR_VERSION }}" | |
| COMMIT_TAGS=() | |
| BUILD_TAGS=() | |
| # Have tags for tracking builds during pull request | |
| SHA_SHORT="${GITHUB_SHA::7}" | |
| COMMIT_TAGS+=("pr-${{ github.event.number }}-${MAJOR_VERSION}") | |
| COMMIT_TAGS+=("${SHA_SHORT}-${MAJOR_VERSION}") | |
| BUILD_TAGS=("${MAJOR_VERSION}" "${MAJOR_VERSION}-${TIMESTAMP}") | |
| BUILD_TAGS+=("${TIMESTAMP}") | |
| BUILD_TAGS+=("latest") | |
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | |
| echo "Generated the following commit tags: " | |
| for TAG in "${COMMIT_TAGS[@]}"; do | |
| echo "${TAG}" | |
| done | |
| alias_tags=("${COMMIT_TAGS[@]}") | |
| else | |
| alias_tags=("${BUILD_TAGS[@]}") | |
| fi | |
| echo "Generated the following build tags: " | |
| for TAG in "${BUILD_TAGS[@]}"; do | |
| echo "${TAG}" | |
| done | |
| echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT | |
| - name: Get current version | |
| id: labels | |
| run: | | |
| ver=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/${{ env.SOURCE_IMAGE }}:${{ matrix.major_version }} | jq -r '.Labels["org.opencontainers.image.version"]') | |
| echo "VERSION=$ver" >> $GITHUB_OUTPUT | |
| # Build metadata | |
| - name: Image Metadata | |
| uses: docker/metadata-action@v4 | |
| id: meta | |
| with: | |
| images: | | |
| ${{ env.IMAGE_NAME }} | |
| labels: | | |
| org.opencontainers.image.title=${{ env.IMAGE_NAME }} | |
| org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }} | |
| org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }} | |
| io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/startingpoint/main/README.md | |
| io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4 | |
| # Build image using Buildah action | |
| - name: Build Image | |
| id: build_image | |
| uses: redhat-actions/buildah-build@v2 | |
| with: | |
| containerfiles: | | |
| ./Containerfile | |
| image: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| ${{ steps.generate-tags.outputs.alias_tags }} | |
| build-args: | | |
| FEDORA_MAJOR_VERSION=${{ env.FEDORA_MAJOR_VERSION }} | |
| BASE_IMAGE_URL=${{ env.BASE_IMAGE_URL }} | |
| RECIPE=${{ matrix.recipe }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| oci: false | |
| # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. | |
| # https://github.com/macbre/push-to-ghcr/issues/12 | |
| - name: Lowercase Registry | |
| id: registry_case | |
| uses: ASzc/change-string-case-action@v5 | |
| with: | |
| string: ${{ env.IMAGE_REGISTRY }} | |
| # Push the image to GHCR (Image Registry) | |
| - name: Push To GHCR | |
| uses: redhat-actions/push-to-registry@v2 | |
| id: push | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live' | |
| env: | |
| REGISTRY_USER: ${{ github.actor }} | |
| REGISTRY_PASSWORD: ${{ github.token }} | |
| with: | |
| image: ${{ steps.build_image.outputs.image }} | |
| tags: ${{ steps.build_image.outputs.tags }} | |
| registry: ${{ steps.registry_case.outputs.lowercase }} | |
| username: ${{ env.REGISTRY_USER }} | |
| password: ${{ env.REGISTRY_PASSWORD }} | |
| extra-args: | | |
| --disable-content-trust | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v2 | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Sign container | |
| - uses: sigstore/cosign-installer@v3.0.4 | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live' | |
| - name: Sign container image | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live' | |
| run: | | |
| cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS} | |
| env: | |
| TAGS: ${{ steps.push.outputs.digest }} | |
| COSIGN_EXPERIMENTAL: false | |
| COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} | |
| - name: Echo outputs | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live' | |
| run: | | |
| echo "${{ toJSON(steps.push.outputs) }}" |