From a957c96fa1d664a65f09f121d75274d661bb3767 Mon Sep 17 00:00:00 2001 From: gunnar Date: Sat, 30 May 2026 16:33:41 +0200 Subject: [PATCH] chore: repo cleanup - pin actions, fix typos, improve gitignore - build.yml: pin push-to-registry to SHA - build-installer-iso.yml: pin checkout/upload-artifact to SHA, replace hardcoded registry with env vars, add env block - Justfile: fix 'Virtal' typo (10x), fix shfmt error msg, quote $file in check/fix recipes - .gitignore: add *.iso, *.qcow2, *.raw, .env, *.log - iso/config.toml: remove leading space - Containerfile: remove non-existent /tmp/build from cleanup - build/50-prepare-flatpak-for-bazaar.sh: add executable permission - build/README.md: update to reflect current script names --- .github/workflows/build-installer-iso.yml | 18 +++-- .github/workflows/build.yml | 2 +- .gitignore | 6 ++ Containerfile | 2 +- Justfile | 26 +++---- build/50-prepare-flatpak-for-bazaar.sh | 0 build/README.md | 86 ++++++++++------------- iso/config.toml | 2 +- 8 files changed, 72 insertions(+), 70 deletions(-) mode change 100644 => 100755 build/50-prepare-flatpak-for-bazaar.sh diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml index f832612..6315c49 100644 --- a/.github/workflows/build-installer-iso.yml +++ b/.github/workflows/build-installer-iso.yml @@ -7,6 +7,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }} cancel-in-progress: true +env: + IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" + IMAGE_NAME: "${{ github.event.repository.name }}" + DEFAULT_TAG: "stable" + jobs: build-iso: runs-on: ubuntu-latest @@ -15,8 +20,13 @@ jobs: packages: read steps: + - name: Prepare environment + run: | + echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Free disk space run: | @@ -37,7 +47,7 @@ jobs: - name: Pull base image run: | - sudo podman pull ghcr.io/humocs-man/fluffy-pancake:stable + sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} - name: Build ISO run: | @@ -50,10 +60,10 @@ jobs: --rootfs btrfs \ --config /config.toml \ --output /output/ \ - ghcr.io/humocs-man/fluffy-pancake:stable + ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} - name: Upload ISO artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: installer-iso # Wir suchen rekursiv nach jeder .iso Datei im output Ordner diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 659e5c6..553c415 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -130,7 +130,7 @@ jobs: - name: Push to GHCR id: push if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - uses: redhat-actions/push-to-registry@v2 + uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 with: image: ${{ env.IMAGE_NAME }} tags: ${{ steps.metadata.outputs.tags }} diff --git a/.gitignore b/.gitignore index 9eee28b..e194aac 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,9 @@ cosign.key _build_* output _build-*/** +*.iso +*.qcow2 +*.raw +.env +.env.* +*.log diff --git a/Containerfile b/Containerfile index fd5592c..51b3ce9 100644 --- a/Containerfile +++ b/Containerfile @@ -98,5 +98,5 @@ COPY configs/99-custom.preset /usr/lib/systemd/system-preset/99-custom.preset # LINTING ############################################################################### # Wir räumen zuerst auf, validieren das System via bootc container lint -RUN rm -rf /tmp/build /root/.cache/dnf/* && \ +RUN rm -rf /root/.cache/dnf/* && \ bootc container lint diff --git a/Justfile b/Justfile index 6388401..86f087c 100644 --- a/Justfile +++ b/Justfile @@ -16,7 +16,7 @@ check: #!/usr/bin/bash find . -type f -name "*.just" | while read -r file; do echo "Checking syntax: $file" - just --unstable --fmt --check -f $file + just --unstable --fmt --check -f "$file" done echo "Checking syntax: Justfile" just --unstable --fmt --check -f Justfile @@ -27,7 +27,7 @@ fix: #!/usr/bin/bash find . -type f -name "*.just" | while read -r file; do echo "Checking syntax: $file" - just --unstable --fmt -f $file + just --unstable --fmt -f "$file" done echo "Checking syntax: Justfile" just --unstable --fmt -f Justfile || { exit 1; } @@ -198,27 +198,27 @@ _build-bib $target_image $tag $type $config: (_rootful_load_image target_image t _rebuild-bib $target_image $tag $type $config: (build target_image tag) && (_build-bib target_image tag type config) # Build a QCOW2 virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] build-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "qcow2" "iso/disk.toml") # Build a RAW virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] build-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "raw" "iso/disk.toml") # Build an ISO virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] build-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "iso" "iso/iso.toml") # Rebuild a QCOW2 virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] rebuild-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "qcow2" "iso/disk.toml") # Rebuild a RAW virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] rebuild-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "raw" "iso/disk.toml") # Rebuild an ISO virtual machine image -[group('Build Virtal Machine Image')] +[group('Build Virtual Machine Image')] rebuild-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "iso" "iso/iso.toml") # Run a virtual machine with the specified image type and configuration @@ -264,19 +264,19 @@ _run-vm $target_image $tag $type $config: podman run "${run_args[@]}" # Run a virtual machine from a QCOW2 image -[group('Run Virtal Machine')] +[group('Run Virtual Machine')] run-vm-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "qcow2" "iso/disk.toml") # Run a virtual machine from a RAW image -[group('Run Virtal Machine')] +[group('Run Virtual Machine')] run-vm-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "raw" "iso/disk.toml") # Run a virtual machine from an ISO -[group('Run Virtal Machine')] +[group('Run Virtual Machine')] run-vm-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "iso" "iso/iso.toml") # Run a virtual machine using systemd-vmspawn -[group('Run Virtal Machine')] +[group('Run Virtual Machine')] spawn-vm rebuild="0" type="qcow2" ram="6G": #!/usr/bin/env bash @@ -311,7 +311,7 @@ format: set -eoux pipefail # Check if shfmt is installed if ! command -v shfmt &> /dev/null; then - echo "shellcheck could not be found. Please install it." + echo "shfmt could not be found. Please install it." exit 1 fi # Run shfmt on all Bash scripts diff --git a/build/50-prepare-flatpak-for-bazaar.sh b/build/50-prepare-flatpak-for-bazaar.sh old mode 100644 new mode 100755 diff --git a/build/README.md b/build/README.md index c0cb90e..335c986 100644 --- a/build/README.md +++ b/build/README.md @@ -1,77 +1,63 @@ # Build Scripts -This directory contains build scripts that run during image creation. Scripts are executed in numerical order. +This directory contains build scripts that run during image creation via bind mounts in the Containerfile. ## How It Works -Scripts are named with a number prefix (e.g., `10-build.sh`, `20-onepassword.sh`) and run in ascending order during the container build process. +Scripts are named with a number prefix and run in ascending order during the container build process. Each script is bind-mounted into the build container and executed individually. ## Included Scripts -- **`10-build.sh`** - Main build script for base system modifications, package installation, and service configuration +- **`10-repos.sh`** - RPM Fusion repositories einrichten (frei + nonfree) +- **`20-multimedia.sh`** - Mesa Freeworld, Codecs, FFmpeg, GStreamer, Intel-Media-Treiber +- **`30-virt.sh`** - Virtualisierung (libvirt, QEMU), Plasma-Setup, Distrobox, Micro, etc. +- **`40-remove-packages.sh`** - Entfernt unerwuenschte Pakete (Firefox, Plasma Discover) +- **`50-prepare-flatpak-for-bazaar.sh`** - Laedt Flathub-Repo-Definition fuer Bazaar -## Example Scripts +## Hilfsscript -- **`20-onepassword.sh.example`** - Example showing how to install software from third-party RPM repositories (Google Chrome, 1Password) +- **`copr-helpers.sh`** - Funktionen fuer sichere COPR-Repo-Installation (enable, install, disable) -To use an example script: -1. Remove the `.example` extension -2. Make it executable: `chmod +x build/20-yourscript.sh` -3. The build system will automatically run it in numerical order - -## Creating Your Own Scripts - -Create numbered scripts for different purposes: +## Erstellung eigener Scripts ```bash -# 10-build.sh - Base system (already exists) -# 20-drivers.sh - Hardware drivers -# 30-development.sh - Development tools -# 40-gaming.sh - Gaming software -# 50-cleanup.sh - Final cleanup tasks -``` +# Neues Script mit nummeriertem Prefix erstellen +# Die Number bestimmt die Ausfuehrungsreihenfolge -### Script Template +#!/usr/bin/bash +set -eoux pipefail -```bash -#!/usr/bin/env bash -set -oue pipefail - -echo "Running custom setup..." -# Your commands here +echo "Installiere Pakete..." +dnf5 install -y --allowerasing some-package ``` ### Best Practices -- **Use descriptive names**: `20-nvidia-drivers.sh` is better than `20-stuff.sh` -- **One purpose per script**: Easier to debug and maintain -- **Clean up after yourself**: Remove temporary files and disable temporary repos -- **Test incrementally**: Add one script at a time and test builds -- **Comment your code**: Future you will thank present you +- **Beschreibende Namen**: `25-nvidia.sh` statt `25-stuff.sh` +- **Ein Script pro Zweck**: Einfacher zu debuggen und zu warten +- **Aufraeumen**: Temporaere Dateien entfernen, temporaere Repos deaktivieren +- **Inkrementell testen**: Ein Script nach dem anderen hinzufuegen +- **Kommentare**: Das zukuenftige Ich wird es schaetzen -### Disabling Scripts +### Script deaktivieren -To temporarily disable a script without deleting it: -- Rename it with `.disabled` extension: `20-script.sh.disabled` -- Or remove execute permission: `chmod -x build/20-script.sh` +Ohne Loeschen deaktivieren: +- Umbenennen: `20-script.sh` → `20-script.sh.disabled` +- Execute-Recht entfernen: `chmod -x build/20-script.sh` -## Execution Order - -The Containerfile runs scripts like this: +## Ausfuehrung im Containerfile ```dockerfile -RUN /ctx/build/10-build.sh +RUN --mount=type=bind,from=ctx,source=/build/10-repos.sh,target=/tmp/10-repos.sh \ + --mount=type=cache,dst=/var/cache \ + --mount=type=tmpfs,dst=/tmp \ + bash /tmp/10-repos.sh && dnf5 clean all ``` -If you want to run multiple scripts, you can: +## Hinweise -1. **Modify Containerfile** to run each script explicitly -2. **Create a runner script** that executes all numbered scripts -3. **Use the default** and keep everything in `10-build.sh` (simplest) - -## Notes - -- Scripts run as root during build -- Build context is available at `/ctx` -- Use dnf5 for package management (not dnf or yum) -- Always use `-y` flag for non-interactive installs +- Scripts laufen als root waehrend des Builds +- Build-Kontext ist ueber Bind-Mounts verfuegbar +- Nutze `dnf5` fuer Paketverwaltung (nicht dnf oder yum) +- Immer `-y` Flag fuer nicht-interaktive Installationen verwenden +- Cache-Mounts (`--mount=type=cache`) verhindern Neudownload bei Aenderungen diff --git a/iso/config.toml b/iso/config.toml index 1798d94..91cf114 100644 --- a/iso/config.toml +++ b/iso/config.toml @@ -1,4 +1,4 @@ - [customizations.installer.kickstart] +[customizations.installer.kickstart] contents = """ # Sprache und Tastatur festlegen lang de_DE.UTF-8