humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
humocs-man
2026-02-17 17:27:26 +01:00
committed by GitHub
commit 302bbf2239
44 changed files with 4200 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/SETUP_CHECKLIST.md
+33
View File
@@ -0,0 +1,33 @@
# Repository Setup Checklist
## Initial Setup
### 1. Rename Template
- [ ] Update `finpilot` to your name in: Containerfile, Justfile, README.md, artifacthub-repo.yml
### 2. Enable GitHub Actions
- [ ] Settings → Actions → General → Enable workflows
- [ ] Set "Read and write permissions"
### 3. First Push
```bash
git add .
git commit -m "feat: initial customization"
git push origin main
```
### 4. Deploy
```bash
sudo bootc switch --transport registry ghcr.io/YOUR_USERNAME/YOUR_REPO:stable
sudo systemctl reboot
```
## Optional: Production Features
### Enable Signing (Recommended)
```bash
cosign generate-key-pair
# Add cosign.key to GitHub Secrets as SIGNING_SECRET
# Uncomment signing in .github/workflows/build.yml
```
.github/commit-convention.md
+116
View File
@@ -0,0 +1,116 @@
# Conventional Commits for bootc Image Template
This repository follows [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) specification.
## Commit Message Format
```
<type>(<scope>): <subject>
[optional body]
[optional footer(s)]
```
## Types
Use these commit types for changes to this bootc image template:
- **build**: Changes to the image build process (Containerfile, build.sh)
- **ci**: Changes to GitHub Actions workflows
- **config**: Changes to disk image configurations (TOML files)
- **feat**: New features or packages added to the image
- **fix**: Bug fixes or corrections
- **docs**: Documentation changes only
- **chore**: Maintenance tasks (dependencies, metadata)
- **refactor**: Code restructuring without changing behavior
## Scopes
Use these scopes to indicate what part of the image is affected:
- **base**: Base image changes (FROM line in Containerfile)
- **packages**: Package installation/removal
- **services**: Systemd service configuration
- **disk**: Disk image configuration (ISO, QCOW2, RAW)
- **workflow**: GitHub Actions workflows
- **metadata**: Image metadata and branding
- **signing**: Cosign key and signing configuration
## Examples
### Adding Packages
```
feat(packages): add development tools and editors
- Install neovim, git, and htop
- Add Development Tools group
```
### Changing Base Image
```
build(base): switch from Bazzite to Bluefin
Changing to Bluefin for better developer tooling support
```
### Configuring Services
```
feat(services): enable SSH and container services
- Enable sshd.service for remote access
- Enable podman.socket for rootless containers
```
### ISO Configuration
```
config(disk): update ISO to use custom registry
Update bootc switch URL to point to ghcr.io/username/repo
```
### Workflow Changes
```
ci(workflow): enable automatic ISO builds
Configure build-disk.yml to trigger on main branch pushes
```
### Metadata Updates
```
chore(metadata): update image description and keywords
Update ArtifactHub metadata with project-specific information
```
### Documentation
```
docs: add installation instructions for new features
```
### Bug Fixes
```
fix(packages): disable COPR after package installation
Ensure COPR repositories don't persist in final image
```
## Breaking Changes
If a change is breaking (e.g., removing packages, changing base image significantly), add `!` after the type/scope:
```
build(base)!: migrate from Fedora 40 to Fedora 41
BREAKING CHANGE: This upgrade requires a clean reinstall for existing users.
```
## Tips
- Keep subject line under 50 characters
- Use imperative mood ("add" not "added" or "adds")
- Don't end subject line with a period
- Separate subject from body with a blank line
- Use body to explain *what* and *why*, not *how*
- Be short and concise, avoid long commit messages, keep it simple
- Reference issues/PRs in footer when applicable
.github/copilot-instructions.md
+16
View File
@@ -0,0 +1,16 @@
# Copilot Instructions for finpilot
This repository uses comprehensive agent instructions. Please refer to the main documentation file:
**[AGENTS.md](../AGENTS.md)** in the repository root.
This file contains:
- Repository structure and organization
- Build system details and workflows
- Package management guidelines
- Development best practices
- Validation and testing procedures
- Troubleshooting guides
- Attribution requirements for AI agents
All coding agents should consult AGENTS.md for detailed instructions on working with this bootc image template.
.github/renovate.json5
+63
View File
@@ -0,0 +1,63 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:best-practices",
],
// Do not rebase when the default branch is updated
"rebaseWhen": "never",
customManagers: [
{
customType: 'regex',
description: 'Match container images in Justfile with tag and digest',
managerFilePatterns: [
'^Justfile$',
],
matchStrings: [
'(?<justName>.+?)\\s:=\\s(?:env\\(.+?,\\s)?["\'](?<packageName>\\S+?):(?<currentValue>\\S+?)@(?<currentDigest>sha256:[a-f0-9]+?)["\']\\)?',
],
datasourceTemplate: 'docker',
},
{
customType: 'regex',
description: 'Match container images in Justfile run_args without tag or digest',
managerFilePatterns: [
'^Justfile$',
],
matchStrings: [
'run_args\\+=\\((?<packageName>[a-zA-Z0-9._:/-]+):?(?<currentValue>\\S+?)\\)',
],
datasourceTemplate: 'docker',
versioningTemplate: 'docker',
},
],
"packageRules": [
{
"automerge": true,
"matchUpdateTypes": ["pin", "pinDigest"]
},
{
"description": "Auto-merge digest updates for base image and trigger build",
"automerge": true,
"matchManagers": ["dockerfile"],
"matchUpdateTypes": ["digest"],
"matchFileNames": ["Containerfile"],
"labels": ["renovate", "automerge"],
},
{
"description": "Disable automerge for all rechunk updates to allow manual review",
"matchUpdateTypes": ["major", "minor", "patch", "digest", "pinDigest"],
"matchPackageNames": ["ghcr.io/hhd-dev/rechunk"],
"automerge": false
},
{
"description": "Enable GitHub Actions updates since they are now pinned with SHA",
"enabled": true,
"matchUpdateTypes": ["digest", "pinDigest", "pin", "major", "minor", "patch"],
"matchDepTypes": ["action"],
"matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
},
]
}
.github/workflows/build.yml
+218
View File
@@ -0,0 +1,218 @@
---
name: Build container image
on:
pull_request:
branches:
- main
schedule:
- cron: '05 10 * * *' # 10:05am UTC everyday
push:
branches:
- main
paths-ignore:
- '**/README.md'
workflow_dispatch:
env:
IMAGE_DESC: "My Customized Universal Blue Image"
IMAGE_KEYWORDS: "bootc,ublue,universal-blue"
IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4" # Put your own image here for a fancy profile on https://artifacthub.io/!
IMAGE_NAME: "${{ github.event.repository.name }}" # output image name, usually same as repo name
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit
DEFAULT_TAG: "stable"
concurrency:
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
cancel-in-progress: true
jobs:
build_push:
name: Build and push image
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
id-token: write
steps:
- name: Prepare environment
run: |
# Lowercase the image uri
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
# These stage versions are pinned by https://github.com/renovatebot/renovate
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
# This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
# - name: Maximize build space
# uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
# with:
# remove-codeql: true
- name: Mount BTRFS for podman storage
id: container-storage-action
uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main
# Fallback to the remove-unwanted-software-action if github doesn't allocate enough space
# See: https://github.com/ublue-os/container-storage-action/pull/11
continue-on-error: true
with:
target-dir: /var/lib/containers
mount-opts: compress-force=zstd:2
- name: Get current date
id: date
run: |
# This generates a timestamp like what is defined on the ArtifactHub documentation
# E.G: 2022-02-08T15:38:15Z'
# https://artifacthub.io/docs/topics/repositories/container-images/
# https://linux.die.net/man/1/date
echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
# Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
# The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
- name: Image Metadata
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
id: metadata
with:
# This generates all the tags for your image, you can add custom tags here too!
# Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date".
tags: |
type=raw,value=${{ env.DEFAULT_TAG }}
type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
type=raw,value={{date 'YYYYMMDD'}}
type=sha,enable=${{ github.event_name == 'pull_request' }}
type=ref,event=pr
labels: |
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
org.opencontainers.image.created=${{ steps.date.outputs.date }}
org.opencontainers.image.description=${{ env.IMAGE_DESC }}
org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
org.opencontainers.image.vendor=${{ github.repository_owner }}
org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
io.artifacthub.package.deprecated=false
io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
io.artifacthub.package.license=Apache-2.0
io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
io.artifacthub.package.prerelease=false
containers.bootc=1
sep-tags: " "
sep-annotations: " "
- name: Build Image
id: build_image
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
with:
containerfiles: |
./Containerfile
# Postfix image name with -custom to make it a little more descriptive
# Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
image: ${{ env.IMAGE_NAME }}
tags: ${{ env.DEFAULT_TAG }}
labels: ${{ steps.metadata.outputs.labels }}
oci: false
# Tag for registry
- name: Tag for registry
run: |
for tag in ${{ steps.metadata.outputs.tags }}; do
podman tag ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} ${{ env.IMAGE_NAME }}:$tag
done
# SBOM (OPTIONAL): Software Bill of Materials generation using Syft
# Creates a detailed inventory of all software components in the image for supply chain security.
# To enable:
# 1. Uncomment the "Setup Syft" step below
# 2. Uncomment the "Generate SBOM" step below
# 3. If using image signing, also uncomment the "Add SBOM Attestation" step further down
# Documentation: https://github.com/anchore/syft
# - name: Setup Syft
# id: setup-syft
# uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
# with:
# syft-version: v1.20.0
#
# - name: Generate SBOM
# id: generate-sbom
# env:
# IMAGE: ${{ env.IMAGE_NAME }}
# DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
# SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
# run: |
# OUTPUT_PATH="$(mktemp -d)/sbom.json"
# export SYFT_PARALLELISM=$(($(nproc)*2))
# $SYFT_CMD ${IMAGE}:${DEFAULT_TAG} -o spdx-json=${OUTPUT_PATH}
# echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT
# These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
# They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
- name: Login to GitHub Container Registry
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Push To GHCR
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
id: push
env:
REGISTRY_USER: ${{ github.actor }}
REGISTRY_PASSWORD: ${{ github.token }}
with:
registry: ${{ env.IMAGE_REGISTRY }}
image: ${{ env.IMAGE_NAME }}
tags: ${{ steps.metadata.outputs.tags }}
username: ${{ env.REGISTRY_USER }}
password: ${{ env.REGISTRY_PASSWORD }}
# OPTIONAL: Image Signing with Cosign
# Signing is disabled by default. To enable, see README.md "Optional: Enable Image Signing" section.
# - name: Install Cosign
# uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
# if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
#
# - name: Sign container image
# if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
# run: |
# IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
# for tag in ${{ steps.metadata.outputs.tags }}; do
# cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
# done
# env:
# TAGS: ${{ steps.push.outputs.digest }}
# COSIGN_EXPERIMENTAL: false
# COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
# OPTIONAL: SBOM Attestation
# Attaches SBOM (Software Bill of Materials) to your signed image for supply chain security.
# Requires image signing to be enabled first (see above).
# To enable:
# 1. First enable image signing (see above section)
# 2. Uncomment the "Add SBOM Attestation" step below
# Documentation: https://slsa.dev/spec/v1.0/requirements#provenance-available
# - name: Add SBOM Attestation
# if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
# env:
# IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
# DIGEST: ${{ steps.push.outputs.digest }}
# COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
# SBOM_OUTPUT: ${{ steps.generate-sbom.outputs.OUTPUT_PATH }}
# run: |
# cd "$(dirname "$SBOM_OUTPUT")"
# cosign attest -y \
# --predicate "$(basename "$SBOM_OUTPUT")" \
# --type spdxjson \
# --key env://COSIGN_PRIVATE_KEY \
# "${IMAGE}@${DIGEST}"
.github/workflows/clean.yml
+27
View File
@@ -0,0 +1,27 @@
name: Cleanup Old Images
on:
schedule:
- cron: "0 0 * * 0" # Weekly on Sunday at midnight UTC
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
jobs:
delete-older-than-90:
runs-on: ubuntu-latest
permissions:
packages: write
steps:
- name: Delete Images Older Than 90 Days
uses: dataaxiom/ghcr-cleanup-action@cd0cdb900b5dbf3a6f2cc869f0dbb0b8211f50c4 # v1.0.16
with:
token: ${{ secrets.GITHUB_TOKEN }}
# IMPORTANT: Update this to match your image name from Containerfile (line 9)
# This should match the "# Name: your-repo-name" comment in your Containerfile
# Example: If your Containerfile has "# Name: my-custom-os", use "my-custom-os" here
packages: finpilot
older-than: 90 days
delete-orphaned-images: true
keep-n-tagged: 7
keep-n-untagged: 7
.github/workflows/renovate.yml
+31
View File
@@ -0,0 +1,31 @@
name: Renovate
on:
schedule:
# Run every 6 hours
- cron: '0 */6 * * *'
workflow_dispatch:
push:
branches:
- main
paths:
- '.github/renovate.json5'
- '.github/workflows/renovate.yml'
jobs:
renovate:
name: Run Renovate
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- name: Self-hosted Renovate
uses: renovatebot/github-action@b9486682a19fe4ea2dd1263c11b4e0c1fe1838fe # v40.3.2
with:
configurationFile: .github/renovate.json5
token: ${{ secrets.GITHUB_TOKEN }}
env:
LOG_LEVEL: 'debug'
.github/workflows/validate-brewfiles.yml
+38
View File
@@ -0,0 +1,38 @@
name: Validate Brewfiles
permissions:
contents: read
on:
pull_request:
paths:
- "custom/brew/**"
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5
- name: Set up Homebrew
uses: Homebrew/actions/setup-homebrew@1ccc07ccd54b6048295516a3eb89b192c35057dc # master
- name: Validate Brewfiles
shell: bash
run: |
echo "Validating Brewfiles in custom/brew/ directory..."
find "custom/brew" -iname '*\.Brewfile*' -print0 | \
while IFS= read -r -d '' brewfile ; do \
echo "::group:: ===$(basename $brewfile)==="
grep -E -e "^tap" $brewfile > taps.Brewfile || echo "# No taps" > taps.Brewfile
set -xeuo pipefail
brew bundle --file=./taps.Brewfile
if brew bundle exec whoami --file="$brewfile" | grep -F -e "${USER}" ; then
echo "✓ $brewfile is valid"
else
echo "✗ $brewfile validation failed"
exit 1
fi
set +xeuo pipefail
echo "::endgroup::"
done
.github/workflows/validate-flatpaks.yml
+37
View File
@@ -0,0 +1,37 @@
name: Validate Flatpaks
permissions:
contents: read
on:
pull_request:
paths:
- "custom/flatpak/**"
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5
- name: Set up Flathub
shell: bash
run: |
sudo apt install -y flatpak
flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
- name: Validate Flatpaks
shell: bash
run: |
echo "Validating flatpak files in custom/flatpak/ directory..."
set -xeuo pipefail
find "custom/flatpak" -iname '*\.list*' -print0 | \
while IFS= read -r -d '' flatpaks_file ; do \
echo "::group:: ===$(basename "$flatpaks_file")==="
grep -v "#.*" "$flatpaks_file" | grep -v "^$" | \
while read -r flatpak ; do \
flatpak remote-info --user flathub "${flatpak}"
done
echo "::endgroup::"
done
.github/workflows/validate-justfiles.yml
+40
View File
@@ -0,0 +1,40 @@
name: Validate Justfiles
permissions:
contents: read
on:
pull_request:
paths:
- "custom/ujust/**"
- "Justfile"
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5
- name: Install just
uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
- name: Validate Justfiles
shell: bash
run: |
echo "Validating justfiles in custom/ujust/ directory..."
set -xeuo pipefail
# Validate root Justfile
echo "::group:: Validating Justfile"
just --unstable --fmt --check -f Justfile
echo "::endgroup::"
# Validate custom ujust files
find "custom/ujust" -iname '*.just' -print0 | \
while IFS= read -r -d '' justfile ; do \
echo "::group:: ===$(basename "$justfile")==="
just --unstable --fmt --check -f "$justfile"
echo "::endgroup::"
done
echo "All justfiles are valid"
.github/workflows/validate-renovate.yml
+35
View File
@@ -0,0 +1,35 @@
name: Validate Renovate Config
on:
pull_request:
paths:
- ".github/renovate.json5"
- ".github/workflows/renovate.yml"
push:
branches:
- main
paths:
- ".github/renovate.json5"
- ".github/workflows/renovate.yml"
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5
- name: Setup Node.js
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v6
with:
node-version: latest
- name: Install dependencies
shell: bash
env:
RENOVATE_VERSION: latest
run: npm install -g renovate@${RENOVATE_VERSION}
- name: Validate Renovate config
shell: bash
run: renovate-config-validator --strict
.github/workflows/validate-shellcheck.yml
+37
View File
@@ -0,0 +1,37 @@
name: Validate Shell Scripts
permissions:
contents: read
on:
pull_request:
paths:
- "build/**/*.sh"
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5
- name: Install ShellCheck
shell: bash
run: |
sudo apt-get update
sudo apt-get install -y shellcheck
- name: Validate Shell Scripts
shell: bash
run: |
echo "Running shellcheck on build scripts..."
set -xeuo pipefail
find "build" -iname '*.sh' -print0 | \
while IFS= read -r -d '' script ; do \
echo "::group:: ===$(basename "$script")==="
shellcheck -x "$script"
echo "✓ $script passed shellcheck"
echo "::endgroup::"
done
echo "All shell scripts passed validation"