Skip to content
This repository was archived by the owner on Feb 6, 2025. It is now read-only.

Commit 45ecfc7

Browse files
m2Gilesm2Giles
committed
feat: initial implementation
fix: cron fix: spelling fix: correct repo url fix: correct url fix: switch to ostree-desktop base fix: don't try to pull scratch fix: fix tag fix: correct tag generation chore(ci): fix up tags and variables chore(ci): fixup Containerfile chore: correct variable chore: pass in fedora version chore: fix ARGS
1 parent aa072c3 commit 45ecfc7

File tree

7 files changed

+262
-0
lines changed

7 files changed

+262
-0
lines changed

‎.github/dependabot.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
schedule:
11+
interval: "weekly"

‎.github/pull_request_template.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## Thank you for contributing to the Universal Blue project!
2+
3+
Please [read the Contributor's Guide](https://universal-blue.org/contributing.html) before submitting a pull request.

‎.github/workflows/release-please.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
on:
2+
push:
3+
branches:
4+
- main
5+
name: release-please
6+
jobs:
7+
release-please:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: google-github-actions/release-please-action@v4
11+
with:
12+
release-type: simple
13+
package-name: release-please-action

‎.github/workflows/reusable-build.yml

+191
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
name: Cache Fsync
2+
on:
3+
merge_group:
4+
schedule:
5+
- cron: "45 2 * * *" # 0245 UTC everyday
6+
workflow_dispatch:
7+
8+
env:
9+
IMAGE_NAME: fsync
10+
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
build:
18+
name: fsync
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
packages: write
23+
id-token: write
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
fedora_version:
28+
- 39
29+
- 40
30+
steps:
31+
- name: Checkout Push to Registry action
32+
uses: actions/checkout@v4
33+
34+
- name: Verify Akmods Image
35+
uses: EyeCantCU/cosign-action/verify@v0.2.2
36+
with:
37+
containers: akmods:fsync-40
38+
pubkey: https://raw.githubusercontent.com/ublue-os/akmods/main/cosign.pub
39+
registry: ghcr.io/ublue-os
40+
41+
- name: Get Fsync Kernel Version
42+
id: Version
43+
uses: Wandalen/wretry.action@v3.5.0
44+
with:
45+
attempt_limit: 3
46+
attempt_delay: 15000
47+
command: |
48+
kernel_release=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:fsync-40 | jq -r '.Labels["ostree.linux"] | split(".fc")[0]')
49+
major=$(echo "$kernel_release" | cut -d '.' -f 1)
50+
minor=$(echo "$kernel_release" | cut -d '.' -f 2)
51+
patch=$(echo "$kernel_release" | cut -d '.' -f 3)
52+
kernel_major_minor_patch="${major}.${minor}.${patch}"
53+
ver=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/base:${{ matrix.fedora_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
54+
if [ -z "$ver" ] || [ "null" = "$ver" ]; then
55+
echo "inspected image version must not be empty or null"
56+
exit 1
57+
fi
58+
echo "version=$ver" >> $GITHUB_ENV
59+
echo "kernel_release=${kernel_release}" >> $GITHUB_ENV
60+
echo "kernel_major_minor_patch=${kernel_major_minor_patch}" >> $GITHUB_ENV
61+
62+
- name: Checkout Push to Registry Action
63+
uses: actions/checkout@v4
64+
65+
- name: Generate Tags
66+
id: generate_tags
67+
shell: bash
68+
run: |
69+
tag="${{ env.kernel_major_minor_patch }}.fsync.fc${{ matrix.fedora_version }}.x86_64"
70+
COMMIT_TAGS=()
71+
COMMIT_TAGS+=("pr-${{ github.event_number }}-${tag}")
72+
COMMIT_TAGS+=("${GITHUB_SHA::7}-${tag}")
73+
74+
BUILD_TAG=(${tag})
75+
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
76+
echo "Generated the following commit tags: "
77+
for TAG in "${COMMIT_TAGS[@]}"; do
78+
echo "${TAG}"
79+
done
80+
81+
alias_tags=("${COMMIT_TAGS[@]}")
82+
else
83+
alias_tags=("${BUILD_TAG[@]}")
84+
fi
85+
86+
echo "Generated the following build tags: "
87+
for TAG in "${alias_tags[@]}"; do
88+
echo "${TAG}"
89+
done
90+
91+
echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
92+
93+
- name: Pull Image
94+
uses: Wandalen/wretry.action@v3.5.0
95+
with:
96+
attempt_limit: 3
97+
attempt_delay: 15000
98+
command: |
99+
podman pull quay.io/fedora-ostree-desktops/base:${{ matrix.fedora_version }}
100+
101+
- name: Build Metadata
102+
uses: docker/metadata-action@v5
103+
id: meta
104+
with:
105+
images: |
106+
${{ env.IMAGE_NAME }}
107+
labels: |
108+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
109+
org.opencontainers.image.description=A caching layer for sentry/kernel-fsync fsync kernel's
110+
org.opencontainers.image.version=${{ env.version }}
111+
ostree.linux="${{ env.kernel_major_minor_patch }}.fc${{ matrix.fedora_version }}.x86_64"
112+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
113+
io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4
114+
115+
- name: Build Image
116+
id: build_image
117+
uses: redhat-actions/buildah-build@v2
118+
with:
119+
containerfiles: |
120+
./Containerfile
121+
image: ${{ env.IMAGE_NAME }}
122+
tags: ${{ steps.generate_tags.outputs.alias_tags }}
123+
build-args: |
124+
FEDORA_VERSION=${{ matrix.fedora_version }}
125+
KERNEL_VERSION=${{ env.kernel_major_minor_patch }}
126+
labels: ${{ steps.meta.outputs.labels }}
127+
oci: false
128+
129+
- name: Lowercase Registry
130+
id: registry_case
131+
uses: ASzc/change-string-case-action@v6
132+
with:
133+
string: ${{ env.IMAGE_REGISTRY }}
134+
135+
- name: Push to GHCR
136+
uses: Wandalen/wretry.action@v3.5.0
137+
id: push
138+
if: github.event_name != 'pull_request'
139+
env:
140+
REGISTRY_USER: ${{ github.actor }}
141+
REGISTRY_PASSWORD: ${{ github.token }}
142+
with:
143+
action: redhat-actions/push-to-registry@v2
144+
attempt_limit: 3
145+
attempt_delay: 15000
146+
with: |
147+
image: ${{ steps.build_image.outputs.image }}
148+
tags: ${{ steps.build_image.outputs.tags }}
149+
registry: ${{ steps.registry_case.outputs.lowercase }}
150+
username: ${{ env.REGISTRY_USER }}
151+
password: ${{ env.REGISTRY_PASSWORD }}
152+
extra-args: |
153+
--disable-content-trust
154+
- name: Login to GitHub Container Registry
155+
uses: docker/login-action@v3
156+
if: github.event_name != 'pull_request'
157+
with:
158+
registry: ghcr.io
159+
username: ${{ github.actor }}
160+
password: ${{ secrets.GITHUB_TOKEN }}
161+
162+
# Sign container
163+
- uses: sigstore/cosign-installer@v3.5.0
164+
if: github.event_name != 'pull_request'
165+
166+
- name: Sign container image
167+
if: github.event_name != 'pull_request'
168+
run: |
169+
cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
170+
env:
171+
TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
172+
COSIGN_EXPERIMENTAL: false
173+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
174+
175+
- name: Echo outputs
176+
if: github.event_name != 'pull_request'
177+
run: |
178+
echo "${{ toJSON(steps.push.outputs) }}"
179+
180+
check:
181+
name: Check all builds successful
182+
runs-on: ubuntu-latest
183+
needs: [build]
184+
steps:
185+
- name: Exit on failure
186+
if: ${{ needs.build.result == 'failure' }}
187+
shell: bash
188+
run: exit 1
189+
- name: Exit
190+
shell: bash
191+
run: exit 0

‎Containerfile

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
ARG SOURCE_IMAGE=${SOURCE_IMAGE:-base}
2+
ARG SOURCE_REPO=${SOURCE_REPO:-fedora-ostree-desktops}
3+
ARG BASE_IMAGE=quay.io/${SOURCE_REPO}/${SOURCE_IMAGE}
4+
ARG FEDORA_VERSION=${FEDORA_VERSION:-40}
5+
6+
# Build from base-main since its our smallest image and we control the tags
7+
FROM ${BASE_IMAGE}:${FEDORA_VERSION} as builder
8+
ARG KERNEL_VERSION=${:-}
9+
ARG FEDORA_VERSION=${FEDORA_VERSION:-}
10+
11+
COPY fetch.sh /
12+
13+
RUN /fetch.sh
14+
15+
FROM scratch as rpms
16+
COPY --from=builder /tmp/rpms /tmp/rpms

‎cosign.pub

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7lh7fJMV4dBT2jT1XafixUJa7OVA
3+
cT+QFVD8IfIJIS/KBAc8hx1aslzkH3tfeM0cwyCLB7kOStZ4sh6RyFQD9w==
4+
-----END PUBLIC KEY-----

‎fetch.sh

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/usr/bin/bash
2+
3+
set -eoux pipefail
4+
5+
kernel_version="${KERNEL_VERSION}".fsync.fc"${FEDORA_VERSION}".x86_64
6+
7+
curl -LsSf -o /etc/yum.repos.d/_copr_sentry-kernel-ba.repo \
8+
https://copr.fedorainfracloud.org/coprs/sentry/kernel-fsync/repo/fedora-"$(rpm -E %fedora)"/sentry-kernel-fsync-fedora-"$(rpm -E %fedora)".repo
9+
10+
rpm-ostree install -y dnf dnf-plugins-core
11+
12+
dnf download -y \
13+
kernel-"${kernel_version}" \
14+
kernel-core-"${kernel_version}" \
15+
kernel-devel-matched-"${kernel_version}" \
16+
kernel-modules-"${kernel_version}" \
17+
kernel-modules-core-"${kernel_version}" \
18+
kernel-modules-extra-"${kernel_version}" \
19+
kernel-headers-"${kernel_version}" \
20+
kernel-devel-"${kernel_version}"
21+
22+
mkdir -p /tmp/rpms
23+
24+
mv /kernel-*.rpm /tmp/rpms

0 commit comments

Comments
 (0)