diff --git a/.github/workflows/reusable-build-iso-anaconda.yml b/.github/workflows/reusable-build-iso-anaconda.yml new file mode 100644 index 0000000..b190083 --- /dev/null +++ b/.github/workflows/reusable-build-iso-anaconda.yml @@ -0,0 +1,361 @@ +--- +name: Reusable Build +"on": + workflow_call: + inputs: + image_version: + description: 'Which image version to build' + type: string + required: true + image_tag: + description: 'Image tag to build from' + type: string + default: lts + upload_artifacts: + description: 'Upload ISOs as job artifacts' + type: boolean + default: false + upload_r2: + description: 'Upload ISOs to Cloudflare R2' + type: boolean + default: true + secrets: + R2_ACCESS_KEY_ID_2025: + required: false + R2_SECRET_ACCESS_KEY_2025: + required: false + R2_ENDPOINT_2025: + required: false + pull_request: + paths: + - ".github/workflows/reusable-build-iso-anaconda.yml" + - "iso_files/configure_iso_anaconda.sh" + +env: + IMAGE_REGISTRY: "ghcr.io/ublue-os" + IMAGE_NAME: "bluefin" + +jobs: + # Define which variants to build based on input + # This job ensures strict separation: each image_version builds ONLY its own ISOs + determine-matrix: + name: Determine Build Matrix + runs-on: ubuntu-latest + outputs: + matrix: ${{ steps.set-matrix.outputs.matrix }} + steps: + - name: Set Matrix + id: set-matrix + run: | + # Define the matrix based on the input selection + # When called via workflow_call, the image_version input determines which ISOs to build + # Each variant builds ONLY its own specific ISOs - no cross-contamination + # NOTE: Check if inputs.image_version is provided (indicates workflow_call) + # rather than checking github.event_name, which may not be reliable + if [[ -n "${{ inputs.image_version }}" ]]; then + case "${{ inputs.image_version }}" in + "lts") + # LTS variant: builds ONLY LTS ISOs (4 total) + matrix='{"include":[ + {"platform":"amd64","flavor":"main","image_version":"lts"}, + {"platform":"arm64","flavor":"main","image_version":"lts"}, + {"platform":"amd64","flavor":"gdx","image_version":"lts"}, + {"platform":"arm64","flavor":"gdx","image_version":"lts"} + ]}' + ;; + "lts-hwe") + # LTS-HWE variant: builds ONLY LTS-HWE ISOs (2 total) + matrix='{"include":[ + {"platform":"amd64","flavor":"main","image_version":"lts-hwe"}, + {"platform":"arm64","flavor":"main","image_version":"lts-hwe"} + ]}' + ;; + "stable") + # Stable variant: builds ONLY Stable ISOs (2 total) + matrix='{"include":[ + {"platform":"amd64","flavor":"main","image_version":"stable"}, + {"platform":"amd64","flavor":"nvidia-open","image_version":"stable"} + ]}' + ;; + "all") + # "all" is reserved for testing - builds all variants + matrix='{"include":[ + {"platform":"amd64","flavor":"main","image_version":"stable"}, + {"platform":"amd64","flavor":"nvidia-open","image_version":"stable"}, + {"platform":"amd64","flavor":"main","image_version":"lts"}, + {"platform":"arm64","flavor":"main","image_version":"lts"}, + {"platform":"amd64","flavor":"gdx","image_version":"lts"}, + {"platform":"arm64","flavor":"gdx","image_version":"lts"}, + {"platform":"amd64","flavor":"main","image_version":"lts-hwe"}, + {"platform":"arm64","flavor":"main","image_version":"lts-hwe"} + ]}' + ;; + esac + else + # Default for when image_version is not provided (e.g., pull_request triggers) + # Build Stable only for faster PR validation + matrix='{"include":[ + {"platform":"amd64","flavor":"main","image_version":"stable"}, + {"platform":"amd64","flavor":"nvidia-open","image_version":"stable"} + ]}' + fi + + # Compact the JSON and output it + compact_matrix=$(echo "$matrix" | jq -c .) + echo "matrix=$compact_matrix" >> $GITHUB_OUTPUT + echo "Generated matrix:" + echo "$matrix" | jq . + + build: + name: Build ISOs + runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} + needs: determine-matrix + strategy: + fail-fast: false + matrix: ${{ fromJSON(needs.determine-matrix.outputs.matrix) }} + permissions: + contents: read + packages: read + id-token: write + + steps: + - name: Install dependencies + if: matrix.platform == 'arm64' + run: | + set -x + sudo apt update -y + sudo apt install -y \ + podman + + - name: Checkout + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + with: + submodules: recursive + + - name: Setup Just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 + + - name: Check Just Syntax + shell: bash + run: | + just check + + - name: Format image ref + id: image_ref + env: + FLAVOR: ${{ matrix.flavor }} + run: | + set -eoux pipefail + # Standard variants use the Just recipe to determine image name + image_name=$(just image_name "bluefin" "${{ matrix.image_version}}" "${{ matrix.flavor}}") + image_ref="${IMAGE_REGISTRY}/${image_name}" + artifact_format="$image_name-${{ matrix.image_version }}-$(uname -m)" + KARGS="NONE" + echo "image_ref=$image_ref" >> "${GITHUB_OUTPUT}" + echo "artifact_format=$artifact_format" >> "${GITHUB_OUTPUT}" + echo "kargs=$KARGS" >> "${GITHUB_OUTPUT}" + + - name: Generate titanoboa-compatible file list + id: flatpak_list + run: | + set -eoux pipefail + FILE_LIST="$(mktemp)" + git clone https://github.com/projectbluefin/common.git common + find common -iname "*system-flatpaks.Brewfile" -exec cat '{}' ';' | grep -v '#' | grep -F -e "flatpak" | sed 's/flatpak //' | tr -d '"' | tee "${FILE_LIST}" + echo "file_list_path=${FILE_LIST}" | tee "${GITHUB_OUTPUT}" + + - name: Build ISO + id: build + uses: ublue-os/titanoboa@main + with: + image-ref: ${{ steps.image_ref.outputs.image_ref }}:${{ inputs.image_tag || matrix.image_version }} + flatpaks-list: ${{ steps.flatpak_list.outputs.file_list_path }} + hook-post-rootfs: ${{ (matrix.image_version == 'lts' || matrix.image_version == 'lts-hwe') && format('{0}/iso_files/configure_lts_iso_anaconda.sh', github.workspace) || format('{0}/iso_files/configure_iso_anaconda.sh', github.workspace) }} + kargs: ${{ steps.image_ref.outputs.kargs }} + builder-distro: ${{ (matrix.image_version == 'lts' || matrix.image_version == 'lts-hwe') && 'centos' || 'fedora' }} + + - name: Rename ISO + id: rename + env: + OUTPUT_PATH: ${{ steps.build.outputs.iso-dest }} + FLAVOR: ${{ matrix.flavor }} + OUTPUT_NAME: ${{ steps.image_ref.outputs.artifact_format }} + IMAGE_VERSION: ${{ matrix.image_version }} + run: | + set -x + mkdir -p output + OUTPUT_DIRECTORY="$(realpath output)" + mv "${OUTPUT_PATH}" "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}.iso" + (cd "${OUTPUT_DIRECTORY}" && sha256sum "${OUTPUT_NAME}.iso" | tee "${OUTPUT_NAME}.iso-CHECKSUM") + echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}" + + - name: Generate Torrent File + env: + OUTPUT_DIRECTORY: ${{ steps.rename.outputs.output_directory }} + OUTPUT_NAME: ${{ steps.image_ref.outputs.artifact_format }} + IMAGE_VERSION: ${{ matrix.image_version }} + FLAVOR: ${{ matrix.flavor }} + PLATFORM: ${{ matrix.platform }} + run: | + set -eoux pipefail + + sudo apt-get install -y mktorrent + + BUILD_DATE=$(date -u +%Y-%m-%d) + + cd "${OUTPUT_DIRECTORY}" + mktorrent \ + -a udp://tracker.opentrackr.org:1337/announce \ + -a udp://open.tracker.cl:1337/announce \ + -a udp://open.demonii.com:1337/announce \ + -a udp://tracker.openbittorrent.com:6969/announce \ + -a udp://exodus.desync.com:6969/announce \ + -a udp://tracker.torrent.eu.org:451/announce \ + -a udp://tracker.moeking.me:6969/announce \ + -a https://tracker.gbitt.info:443/announce \ + -a https://tracker.tamersunion.org:443/announce \ + -a wss://tracker.btorrent.xyz \ + -a wss://tracker.openwebtorrent.com \ + -w "https://projectbluefin.dev/${OUTPUT_NAME}.iso" \ + -w "https://download.projectbluefin.io/${OUTPUT_NAME}.iso" \ + -c "Bluefin ${IMAGE_VERSION} ${FLAVOR} (${PLATFORM}) - ${BUILD_DATE}" \ + -o "${OUTPUT_NAME}.iso.torrent" \ + "${OUTPUT_NAME}.iso" + + sha256sum "${OUTPUT_NAME}.iso.torrent" | tee "${OUTPUT_NAME}.iso.torrent-CHECKSUM" + + - name: Upload to Job Artifacts + if: inputs.upload_artifacts + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 + with: + name: ${{ steps.image_ref.outputs.artifact_format }} + if-no-files-found: error + path: ${{ steps.rename.outputs.output_directory }} + + - name: Set up Homebrew + if: inputs.upload_r2 && github.event_name != 'pull_request' + uses: Homebrew/actions/setup-homebrew@master + + - name: Install rclone + if: inputs.upload_r2 && github.event_name != 'pull_request' + run: brew install rclone + + - name: Upload to CloudFlare + if: inputs.upload_r2 && github.event_name != 'pull_request' + shell: bash + env: + RCLONE_CONFIG_R2_TYPE: s3 + RCLONE_CONFIG_R2_PROVIDER: Cloudflare + RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID_2025 }} + RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY_2025 }} + RCLONE_CONFIG_R2_REGION: auto + RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT_2025 }} + SOURCE_DIR: ${{ steps.rename.outputs.output_directory }} + run: | + rclone copy --log-level INFO --checksum "${SOURCE_DIR}" R2:testing + + create-prerelease: + name: Create GitHub Prerelease + needs: build + if: github.event_name != 'pull_request' + runs-on: ubuntu-latest + permissions: + contents: write + env: + RCLONE_CONFIG_R2_TYPE: s3 + RCLONE_CONFIG_R2_PROVIDER: Cloudflare + RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID_2025 }} + RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY_2025 }} + RCLONE_CONFIG_R2_REGION: auto + RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT_2025 }} + + steps: + - name: Checkout + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + + - name: Set up Homebrew + uses: Homebrew/actions/setup-homebrew@master + + - name: Install rclone + run: brew install rclone + + - name: Download Torrent Files from R2 + run: | + set -eoux pipefail + mkdir -p torrents + rclone copy R2:testing torrents \ + --include "*.iso.torrent" \ + --include "*.iso.torrent-CHECKSUM" \ + --log-level INFO + + echo "Downloaded torrent files:" + ls -lh torrents/ + + if [ -z "$(ls torrents/*.torrent 2>/dev/null)" ]; then + echo "No torrent files found in R2 testing bucket" + exit 1 + fi + + - name: Determine Release Version + id: version + env: + GH_TOKEN: ${{ github.token }} + run: | + set -eoux pipefail + YEAR_MONTH=$(date -u +%y.%m) + + if gh release view "${YEAR_MONTH}" >/dev/null 2>&1; then + PATCH=1 + while gh release view "${YEAR_MONTH}.${PATCH}" >/dev/null 2>&1; do + PATCH=$((PATCH + 1)) + done + VERSION="${YEAR_MONTH}.${PATCH}" + else + VERSION="${YEAR_MONTH}" + fi + + echo "version=${VERSION}" >> $GITHUB_OUTPUT + + - name: Create GitHub Prerelease + env: + GH_TOKEN: ${{ github.token }} + VERSION: ${{ steps.version.outputs.version }} + run: | + set -eoux pipefail + + TORRENT_LIST="" + for f in torrents/*.torrent torrents/*.torrent-CHECKSUM; do + [ -f "$f" ] && TORRENT_LIST="${TORRENT_LIST} ${f}" + done + + gh release create "${VERSION}" \ + --prerelease \ + --title "Bluefin ISOs ${VERSION} (Prerelease)" \ + --notes "$(cat <<'EOF' + ## ⚠️ Prerelease - Testing Builds + + These ISOs are automatically generated from successful builds and uploaded to the **testing** bucket. + + **Status**: Not yet promoted to production + **For**: Testing and validation only + + Once validated, these builds can be promoted to production using the promotion workflow. + + ### How to Download + + 1. Download a `.torrent` file below + 2. Open with a BitTorrent client (qBittorrent, Transmission, etc.) + 3. Torrents include web seeds -- downloads work immediately + + ### Direct Downloads + + ISOs are also available at https://docs.projectbluefin.io/downloads-testing + + ### Verify + + ```bash + sha256sum -c .torrent-CHECKSUM + ``` + EOF + )" \ + ${TORRENT_LIST}