Skip to content
This repository was archived by the owner on Mar 3, 2024. It is now read-only.

Commit 95a5913

Browse files
akippnnakippnn
authored
Initial commit
0 parents  commit 95a5913

26 files changed

+1341
-0
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @castrojo

‎.github/dependabot.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
schedule:
11+
interval: "weekly"
12+
13+

‎.github/semantic.yml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
enabled: true
2+
titleOnly: true

‎.github/workflows/build.yml

+217
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
# This workflow builds every branch of the repository daily at 16:30 UTC, one hour after ublue-os/nvidia builds.
2+
# The images are also built after pushing changes or pull requests.
3+
# The builds can also be triggered manually in the Actions tab thanks to workflow dispatch.
4+
# Only the branch called `live` is published.
5+
6+
7+
name: build-ublue
8+
on: # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
9+
schedule:
10+
- cron: "30 16 * * *"
11+
push:
12+
branches:
13+
- live
14+
- template
15+
- main
16+
paths-ignore: # don't rebuild if only documentation has changed
17+
- "**.md"
18+
pull_request:
19+
workflow_dispatch:
20+
21+
env:
22+
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
23+
24+
# Only deploys the branch named "live". Ignores all other branches, to allow
25+
# having "development" branches without interfering with GHCR image uploads.
26+
jobs:
27+
push-ghcr:
28+
name: Build and push image
29+
runs-on: ubuntu-22.04
30+
permissions:
31+
contents: read
32+
packages: write
33+
id-token: write
34+
strategy:
35+
fail-fast: false
36+
37+
matrix:
38+
# !!!
39+
# Add recipes for all the images you want to build here.
40+
# Don't add module configuration files, you will get errors.
41+
recipe:
42+
- recipe.yml
43+
# !!!
44+
45+
steps:
46+
- name: Maximize build space
47+
uses: AdityaGarg8/remove-unwanted-software@v1
48+
with:
49+
remove-dotnet: 'true'
50+
remove-android: 'true'
51+
remove-haskell: 'true'
52+
53+
# Checkout push-to-registry action GitHub repository
54+
- name: Checkout Push to Registry action
55+
uses: actions/checkout@v4
56+
57+
# Confirm that cosign.pub matches SIGNING_SECRET
58+
- uses: sigstore/[email protected]
59+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
60+
61+
- name: Check SIGNING_SECRET matches cosign.pub
62+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
63+
env:
64+
COSIGN_EXPERIMENTAL: false
65+
COSIGN_PASSWORD: ""
66+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
67+
shell: bash
68+
run: |
69+
echo "Checking for difference between public key from SIGNING_SECRET and cosign.pub"
70+
delta=$(diff -u <(cosign public-key --key env://COSIGN_PRIVATE_KEY) cosign.pub)
71+
if [ -z "$delta" ]; then
72+
echo "cosign.pub matches SIGNING_SECRET"
73+
else
74+
echo "cosign.pub does not match SIGNING_SECRET"
75+
echo "$delta"
76+
exit 1
77+
fi
78+
79+
- name: Add yq (for reading recipe.yml)
80+
uses: mikefarah/[email protected]
81+
82+
- name: Gather image data from recipe
83+
run: |
84+
echo "IMAGE_NAME=$(yq '.name' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
85+
echo "IMAGE_DESCRIPTION=$(yq '.description' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
86+
echo "IMAGE_MAJOR_VERSION=$(yq '.image-version' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
87+
echo "BASE_IMAGE_URL=$(yq '.base-image' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
88+
89+
- name: Get current version
90+
id: labels
91+
run: |
92+
ver=$(skopeo inspect docker://${{ env.BASE_IMAGE_URL }}:${{ env.IMAGE_MAJOR_VERSION }} | jq -r '.Labels["org.opencontainers.image.version"]')
93+
echo "VERSION=$ver" >> $GITHUB_OUTPUT
94+
95+
- name: Generate tags
96+
id: generate-tags
97+
shell: bash
98+
run: |
99+
# Generate a timestamp for creating an image version history
100+
TIMESTAMP="$(date +%Y%m%d)"
101+
MAJOR_VERSION="$(echo ${{ steps.labels.outputs.VERSION }} | cut -d . -f 1)"
102+
COMMIT_TAGS=()
103+
BUILD_TAGS=()
104+
# Have tags for tracking builds during pull request
105+
SHA_SHORT="${GITHUB_SHA::7}"
106+
107+
# Using clever bash string templating, https://stackoverflow.com/q/40771781
108+
# don't make malformed tags if $MAJOR_VERSION is empty (base-image didn't include proper labels) --
109+
COMMIT_TAGS+=("pr-${{ github.event.number }}${MAJOR_VERSION:+-$MAJOR_VERSION}")
110+
COMMIT_TAGS+=("${SHA_SHORT}${MAJOR_VERSION:+-$MAJOR_VERSION}")
111+
112+
BUILD_TAGS=("${MAJOR_VERSION}" "${MAJOR_VERSION:+$MAJOR_VERSION-}${TIMESTAMP}")
113+
# --
114+
115+
BUILD_TAGS+=("${TIMESTAMP}")
116+
BUILD_TAGS+=("latest")
117+
118+
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
119+
echo "Generated the following commit tags: "
120+
for TAG in "${COMMIT_TAGS[@]}"; do
121+
echo "${TAG}"
122+
done
123+
alias_tags=("${COMMIT_TAGS[@]}")
124+
else
125+
alias_tags=("${BUILD_TAGS[@]}")
126+
fi
127+
echo "Generated the following build tags: "
128+
for TAG in "${BUILD_TAGS[@]}"; do
129+
echo "${TAG}"
130+
done
131+
echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
132+
133+
# Build metadata
134+
- name: Image Metadata
135+
uses: docker/metadata-action@v5
136+
id: meta
137+
with:
138+
images: |
139+
${{ env.IMAGE_NAME }}
140+
labels: |
141+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
142+
org.opencontainers.image.version=${{ steps.labels.outputs.VERSION }}
143+
org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
144+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/startingpoint/main/README.md
145+
io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4
146+
147+
# Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
148+
# https://github.com/macbre/push-to-ghcr/issues/12
149+
- name: Lowercase Registry
150+
id: registry_case
151+
uses: ASzc/change-string-case-action@v6
152+
with:
153+
string: ${{ env.IMAGE_REGISTRY }}
154+
155+
- name: Lowercase Image
156+
id: image_case
157+
uses: ASzc/change-string-case-action@v6
158+
with:
159+
string: ${{ env.IMAGE_NAME }}
160+
161+
# Build image using Buildah action
162+
- name: Build Image
163+
id: build_image
164+
uses: redhat-actions/buildah-build@v2
165+
with:
166+
containerfiles: |
167+
./Containerfile
168+
image: ${{ env.IMAGE_NAME }}
169+
tags: |
170+
${{ steps.generate-tags.outputs.alias_tags }}
171+
build-args: |
172+
IMAGE_MAJOR_VERSION=${{ env.IMAGE_MAJOR_VERSION }}
173+
BASE_IMAGE_URL=${{ env.BASE_IMAGE_URL }}
174+
RECIPE=${{ matrix.recipe }}
175+
IMAGE_REGISTRY=${{ steps.registry_case.outputs.lowercase }}
176+
labels: ${{ steps.meta.outputs.labels }}
177+
oci: false
178+
179+
# Push the image to GHCR (Image Registry)
180+
- name: Push To GHCR
181+
uses: redhat-actions/push-to-registry@v2
182+
id: push
183+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
184+
env:
185+
REGISTRY_USER: ${{ github.actor }}
186+
REGISTRY_PASSWORD: ${{ github.token }}
187+
with:
188+
image: ${{ steps.build_image.outputs.image }}
189+
tags: ${{ steps.build_image.outputs.tags }}
190+
registry: ${{ steps.registry_case.outputs.lowercase }}
191+
username: ${{ env.REGISTRY_USER }}
192+
password: ${{ env.REGISTRY_PASSWORD }}
193+
extra-args: |
194+
--disable-content-trust
195+
196+
- name: Login to GitHub Container Registry
197+
uses: docker/login-action@v3
198+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
199+
with:
200+
registry: ghcr.io
201+
username: ${{ github.actor }}
202+
password: ${{ secrets.GITHUB_TOKEN }}
203+
204+
# Sign container
205+
- name: Sign container image
206+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
207+
run: |
208+
cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}@${TAGS}
209+
env:
210+
TAGS: ${{ steps.push.outputs.digest }}
211+
COSIGN_EXPERIMENTAL: false
212+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
213+
214+
- name: Echo outputs
215+
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
216+
run: |
217+
echo "${{ toJSON(steps.push.outputs) }}"

‎.github/workflows/release-iso.yml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
on:
2+
push:
3+
paths:
4+
- 'boot_menu.yml'
5+
- '.github/workflows/release-iso.yml'
6+
workflow_dispatch:
7+
8+
name: release-iso
9+
jobs:
10+
release-iso:
11+
name: Generate and Release ISOs
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write
15+
container:
16+
image: fedora:39
17+
options: --privileged
18+
steps:
19+
- uses: actions/checkout@v4
20+
- name: Generate ISO
21+
uses: ublue-os/[email protected]
22+
id: isogenerator
23+
with:
24+
image-name: ${{ github.event.repository.name }}
25+
installer-repo: releases
26+
installer-major-version: 39
27+
boot-menu-path: boot_menu.yml
28+
- name: install github CLI
29+
run: |
30+
sudo dnf install 'dnf-command(config-manager)' -y
31+
sudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
32+
sudo dnf install gh -y
33+
- name: Upload ISO
34+
env:
35+
GITHUB_TOKEN: ${{ github.token }}
36+
run: |
37+
if gh release list -R ${{ github.repository_owner }}/${{ github.event.repository.name }} | grep "auto-iso"; then
38+
gh release view auto-iso -R ${{ github.repository_owner }}/${{ github.event.repository.name }} --json assets -q .assets[].name | xargs --no-run-if-empty -L 1 gh release delete-asset auto-iso -R ${{ github.repository_owner }}/${{ github.event.repository.name }}
39+
gh release upload auto-iso ${{ steps.isogenerator.outputs.iso-path }} -R ${{ github.repository_owner }}/${{ github.event.repository.name }} --clobber
40+
else
41+
gh release create auto-iso ${{ steps.isogenerator.outputs.iso-path }} -t ISO -n "This is an automatically generated ISO release." -R ${{ github.repository_owner }}/${{ github.event.repository.name }}
42+
fi
43+
- name: Upload SHA256SUM
44+
env:
45+
GITHUB_TOKEN: ${{ github.token }}
46+
run:
47+
gh release upload auto-iso ${{ steps.isogenerator.outputs.sha256sum-path }} -R ${{ github.repository_owner }}/${{ github.event.repository.name }} --clobber

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.idea
2+
cosign.key

0 commit comments

Comments
 (0)