mirror of
https://github.com/optim-enterprises-bv/secureblue.git
synced 2025-12-26 15:27:19 +00:00
155 lines
6.8 KiB
YAML
155 lines
6.8 KiB
YAML
name: build-secureblue
|
|
on:
|
|
schedule:
|
|
- cron: "00 6 * * *" # build at 6:00 UTC every day
|
|
# 60 minutes after last wayblue images start building
|
|
push:
|
|
paths-ignore: # don't rebuild if only documentation has changed
|
|
- "**.md"
|
|
|
|
workflow_dispatch: # allow manually triggering builds
|
|
jobs:
|
|
bluebuild:
|
|
name: Build secureblue
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: false # stop GH from cancelling all matrix builds if one fails
|
|
matrix:
|
|
recipe:
|
|
# non-userns
|
|
# general
|
|
- general/recipe-silverblue-main.yml
|
|
- general/recipe-silverblue-nvidia.yml
|
|
- general/recipe-silverblue-nvidia-open.yml
|
|
- general/recipe-kinoite-main.yml
|
|
- general/recipe-kinoite-nvidia.yml
|
|
- general/recipe-kinoite-nvidia-open.yml
|
|
- general/recipe-sericea-main.yml
|
|
- general/recipe-sericea-nvidia.yml
|
|
- general/recipe-sericea-nvidia-open.yml
|
|
- general/recipe-wayblue-wayfire-main.yml
|
|
- general/recipe-wayblue-wayfire-nvidia.yml
|
|
- general/recipe-wayblue-wayfire-nvidia-open.yml
|
|
- general/recipe-wayblue-hyprland-main.yml
|
|
- general/recipe-wayblue-hyprland-nvidia.yml
|
|
- general/recipe-wayblue-hyprland-nvidia-open.yml
|
|
- general/recipe-wayblue-river-main.yml
|
|
- general/recipe-wayblue-river-nvidia.yml
|
|
- general/recipe-wayblue-river-nvidia-open.yml
|
|
- general/recipe-wayblue-sway-main.yml
|
|
- general/recipe-wayblue-sway-nvidia.yml
|
|
- general/recipe-wayblue-sway-nvidia-open.yml
|
|
# - general/recipe-cosmic-main.yml
|
|
# - general/recipe-cosmic-nvidia.yml
|
|
# - general/recipe-cosmic-nvidia-open.yml
|
|
# server
|
|
- securecore/recipe-securecore-main.yml
|
|
- securecore/recipe-securecore-nvidia.yml
|
|
- securecore/recipe-securecore-nvidia-open.yml
|
|
- securecore/recipe-securecore-zfs-main.yml
|
|
- securecore/recipe-securecore-zfs-nvidia.yml
|
|
- securecore/recipe-securecore-zfs-nvidia-open.yml
|
|
# userns
|
|
# general
|
|
- general/recipe-silverblue-main-userns.yml
|
|
- general/recipe-silverblue-nvidia-userns.yml
|
|
- general/recipe-silverblue-nvidia-open-userns.yml
|
|
- general/recipe-kinoite-main-userns.yml
|
|
- general/recipe-kinoite-nvidia-userns.yml
|
|
- general/recipe-kinoite-nvidia-open-userns.yml
|
|
- general/recipe-sericea-main-userns.yml
|
|
- general/recipe-sericea-nvidia-userns.yml
|
|
- general/recipe-sericea-nvidia-open-userns.yml
|
|
- general/recipe-wayblue-wayfire-main-userns.yml
|
|
- general/recipe-wayblue-wayfire-nvidia-userns.yml
|
|
- general/recipe-wayblue-wayfire-nvidia-open-userns.yml
|
|
- general/recipe-wayblue-hyprland-main-userns.yml
|
|
- general/recipe-wayblue-hyprland-nvidia-userns.yml
|
|
- general/recipe-wayblue-hyprland-nvidia-open-userns.yml
|
|
- general/recipe-wayblue-river-main-userns.yml
|
|
- general/recipe-wayblue-river-nvidia-userns.yml
|
|
- general/recipe-wayblue-river-nvidia-open-userns.yml
|
|
- general/recipe-wayblue-sway-main-userns.yml
|
|
- general/recipe-wayblue-sway-nvidia-userns.yml
|
|
- general/recipe-wayblue-sway-nvidia-open-userns.yml
|
|
# - general/recipe-cosmic-main-userns.yml
|
|
# - general/recipe-cosmic-nvidia-userns.yml
|
|
# - general/recipe-cosmic-nvidia-open-userns.yml
|
|
# server
|
|
- securecore/recipe-securecore-main-userns.yml
|
|
- securecore/recipe-securecore-nvidia-userns.yml
|
|
- securecore/recipe-securecore-nvidia-open-userns.yml
|
|
- securecore/recipe-securecore-zfs-main-userns.yml
|
|
- securecore/recipe-securecore-zfs-nvidia-userns.yml
|
|
- securecore/recipe-securecore-zfs-nvidia-open-userns.yml
|
|
|
|
steps:
|
|
- name: Checkout repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Add yq (for reading recipe.yml)
|
|
uses: mikefarah/yq@v4.44.3
|
|
|
|
- name: Gather image data from recipe
|
|
run: |
|
|
echo "IMAGE_NAME=$(yq '.name' ./recipes/${{ matrix.recipe }})" >> $GITHUB_ENV
|
|
echo "IMAGE_MAJOR_VERSION=$(yq '.image-version' ./recipes/${{ matrix.recipe }})" >> $GITHUB_ENV
|
|
BASE_IMAGE=$(yq '.base-image' ./recipes/${{ matrix.recipe }})
|
|
echo "BASE_IMAGE_NAME=$(echo $BASE_IMAGE | sed 's/.*\/.*\///')" >> $GITHUB_ENV
|
|
|
|
- name: Verify base image
|
|
if: ${{ contains(env.IMAGE_NAME, 'wayblue') }}
|
|
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
|
with:
|
|
containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
|
|
registry: 'ghcr.io/wayblueorg'
|
|
pubkey: 'https://raw.githubusercontent.com/wayblueorg/wayblue/live/cosign.pub'
|
|
|
|
- name: Validate server kernel and kmod versions
|
|
if: ${{ contains(env.IMAGE_NAME, 'securecore') }}
|
|
uses: Wandalen/wretry.action@v3.5.0
|
|
with:
|
|
attempt_limit: 3
|
|
attempt_delay: 15000
|
|
command: |
|
|
set -eo pipefail
|
|
linux=$(skopeo inspect docker://ghcr.io/ublue-os/coreos-testing-kernel:40 | jq -r '.Labels["ostree.linux"]')
|
|
AKMODS_KERNEL_VERSION=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:coreos-testing-40 | jq -r '.Labels["ostree.linux"]')
|
|
if [[ "${linux}" != "${AKMODS_KERNEL_VERSION}" ]]; then
|
|
echo "Kernel Versions do not match between AKMODS and Cached-Kernel."
|
|
exit 1
|
|
fi
|
|
echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV
|
|
|
|
- name: Validate desktop kernel and kmod versions
|
|
if: ${{ !contains(env.IMAGE_NAME, 'securecore') }}
|
|
uses: Wandalen/wretry.action@v3.5.0
|
|
with:
|
|
attempt_limit: 3
|
|
attempt_delay: 15000
|
|
command: |
|
|
set -eo pipefail
|
|
linux=$(skopeo inspect docker://ghcr.io/ublue-os/main-kernel:40 | jq -r '.Labels["ostree.linux"]')
|
|
AKMODS_KERNEL_VERSION=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:main-40 | jq -r '.Labels["ostree.linux"]')
|
|
if [[ "${linux}" != "${AKMODS_KERNEL_VERSION}" ]]; then
|
|
echo "Kernel Versions do not match between AKMODS and Cached-Kernel."
|
|
exit 1
|
|
fi
|
|
echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV
|
|
|
|
|
|
- name: Build secureblue
|
|
uses: blue-build/github-action@v1.6.1
|
|
with:
|
|
cli_version: v0.8.20
|
|
recipe: ${{ matrix.recipe }}
|
|
cosign_private_key: ${{ secrets.SIGNING_SECRET }}
|
|
registry_token: ${{ github.token }}
|
|
pr_event_number: ${{ github.event.number }}
|
|
maximize_build_space: true
|
|
squash: true
|