build-hypervisor.yml

name: Build Hypervisor Bootc Images

on:
  workflow_run:
    workflows: ["Build Fedora Minimal Bootc"]
    types: [completed]
    branches: [main]

  workflow_dispatch:
    inputs:
      variants:
        description: 'Variants to build (besides base)'
        required: true
        default: 'all'
        type: choice
        options:
          - 'all'
          - 'none'
          - 'amd'
          - 'nvidia'
          - 'nvidia-negativo17'
          - 'nvidia-rpmfusion'
      versions_override:
        description: 'JSON array of Fedora versions to build, e.g. [44] (empty = use fedora-versions.yml)'
        required: false
        default: ''
        type: string

concurrency:
  group: build-hypervisor-${{ github.ref }}
  cancel-in-progress: false

jobs:
  setup:
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-24.04
    outputs:
      versions: ${{ steps.r.outputs.versions }}
      stable: ${{ steps.r.outputs.stable }}
      rechunker: ${{ steps.r.outputs.rechunker }}
    steps:
      - uses: actions/checkout@v4
      - id: r
        run: |
          curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
            -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq
          if [ -n "${{ inputs.versions_override }}" ]; then
            echo "versions=${{ inputs.versions_override }}"
          else
            echo "versions=$(yq -o=json -I=0 '.supported' fedora-versions.yml)"
          fi >> "$GITHUB_OUTPUT"
          {
            echo "stable=$(yq '.stable' fedora-versions.yml)"
            echo "rechunker=$(yq '.rechunker' fedora-versions.yml)"
          } >> "$GITHUB_OUTPUT"

  build-base:
    needs: setup
    # Skip if upstream minimal build failed; allow all other triggers.
    # Also skip entirely under Forgejo (handled by .forgejo/workflows/).
    if: ${{ github.server_url == 'https://github.com' && (github.event.workflow_run.conclusion == 'success' || github.event_name != 'workflow_run') }}
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        fedora_version: ${{ fromJson(needs.setup.outputs.versions) }}
    outputs:
      tag: ${{ steps.params.outputs.tag }}
      owner: ${{ steps.params.outputs.owner }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Resolve build parameters
        id: params
        env:
          OWNER_RAW: ${{ github.repository_owner }}
        run: |
          OWNER=$(echo "$OWNER_RAW" | tr '[:upper:]' '[:lower:]')
          TAG=$(date +%Y%m%d-%H%M)
          {
            echo "owner=${OWNER}"
            echo "tag=${TAG}"
            echo "image_base=ghcr.io/${OWNER}/hypervisor-bootc"
          } >> "$GITHUB_OUTPUT"

      - name: Free disk space
        uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

      - name: Install cosign
        uses: sigstore/cosign-installer@v3.7.0

      - name: Install podman
        run: |
          sudo apt-get update
          sudo apt-get install -y podman
          podman --version

      - name: Render policy.json
        env:
          OWNER: ${{ steps.params.outputs.owner }}
        run: |
          sed -e "s|__REGISTRY_NAMESPACE__|${OWNER}|g" \
              policy-hypervisor.json.template > policy.json
          cat policy.json

      - name: Fetch cosy
        run: |
          mkdir -p bin man
          curl -fsSL https://raw.githubusercontent.com/BenSmith/cosy/main/cosy -o bin/cosy
          curl -fsSL https://raw.githubusercontent.com/BenSmith/cosy/main/cosy.1 -o man/cosy.1

      - name: Login to GHCR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTOR: ${{ github.actor }}
        run: |
          echo "$GH_TOKEN" | sudo podman login ghcr.io -u "$ACTOR" --password-stdin
          echo "$GH_TOKEN" | cosign login ghcr.io -u "$ACTOR" --password-stdin

      - name: Build base hypervisor
        env:
          VERSION: ${{ matrix.fedora_version }}
          OWNER: ${{ steps.params.outputs.owner }}
        run: |
          sudo podman build \
            --pull=always \
            --security-opt=label=disable \
            --security-opt=seccomp=unconfined \
            --cap-add=all \
            --ipc=host \
            --build-arg BASE_IMAGE=ghcr.io/${OWNER}/fedora-bootc-minimal:${VERSION} \
            -f hypervisor.Containerfile \
            -t localhost/hypervisor-bootc:build \
            .

      - name: Rechunk base image
        env:
          RECHUNKER: ${{ needs.setup.outputs.rechunker }}
        run: |
          sudo podman run --rm --privileged \
            -v /var/lib/containers:/var/lib/containers \
            quay.io/fedora/fedora-bootc:${RECHUNKER} \
            /usr/libexec/bootc-base-imagectl rechunk \
            localhost/hypervisor-bootc:build \
            localhost/hypervisor-bootc:rechunked

      - name: Tag and push base
        id: push_base
        env:
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          VERSION: ${{ matrix.fedora_version }}
          TAG: ${{ steps.params.outputs.tag }}
          STABLE: ${{ needs.setup.outputs.stable }}
        run: |
          VERSIONED="${VERSION}-${TAG}"
          FLOATING="${VERSION}"

          sudo podman tag localhost/hypervisor-bootc:rechunked "${IMAGE_BASE}:${VERSIONED}"
          sudo podman push --digestfile /tmp/digest.txt "${IMAGE_BASE}:${VERSIONED}"
          DIGEST=$(cat /tmp/digest.txt)

          sudo skopeo copy "docker://${IMAGE_BASE}@${DIGEST}" "docker://${IMAGE_BASE}:${FLOATING}"
          if [ "${VERSION}" = "${STABLE}" ]; then
            sudo skopeo copy "docker://${IMAGE_BASE}@${DIGEST}" "docker://${IMAGE_BASE}:latest"
          fi

          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"

      - name: Sign base
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_SECRET }}
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          DIGEST: ${{ steps.push_base.outputs.digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_BASE}@${DIGEST}"

      - name: Summary
        env:
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          VERSION: ${{ matrix.fedora_version }}
          TAG: ${{ steps.params.outputs.tag }}
          STABLE: ${{ needs.setup.outputs.stable }}
        run: |
          {
            echo "## Base hypervisor build complete (F${VERSION})"
            echo ""
            echo "- \`${IMAGE_BASE}:${VERSION}-${TAG}\`"
            echo "- \`${IMAGE_BASE}:${VERSION}\`"
            if [ "${VERSION}" = "${STABLE}" ]; then
              echo "- \`${IMAGE_BASE}:latest\`"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  build-variant:
    needs: [setup, build-base]
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    permissions:
      contents: read
      packages: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        variant:
          - name: amd
            image: hypervisor-amd
            containerfile: hypervisor-amd.Containerfile
            prefix: ''
            floating: ''
          - name: nvidia-negativo17
            image: hypervisor-nvidia
            containerfile: hypervisor-nvidia-negativo17.Containerfile
            prefix: 'negativo17-'
            floating: 'negativo17'
          - name: nvidia-rpmfusion
            image: hypervisor-nvidia
            containerfile: hypervisor-nvidia-rpmfusion.Containerfile
            prefix: 'rpmfusion-'
            floating: 'rpmfusion'
        fedora_version: ${{ fromJson(needs.setup.outputs.versions) }}

    steps:
      - name: Decide whether to build this variant
        id: gate
        env:
          SELECTION: ${{ inputs.variants }}
          EVENT: ${{ github.event_name }}
          NAME: ${{ matrix.variant.name }}
        run: |
          # workflow_run and schedule always build all variants.
          # workflow_dispatch respects the user's selection.
          if [ "$EVENT" != "workflow_dispatch" ] || [ "$SELECTION" = "all" ]; then
            BUILD=true
          elif [ "$SELECTION" = "none" ]; then
            BUILD=false
          elif [ "$SELECTION" = "nvidia" ] && [[ "$NAME" == nvidia-* ]]; then
            BUILD=true
          elif [ "$SELECTION" = "$NAME" ]; then
            BUILD=true
          else
            BUILD=false
          fi
          echo "build=${BUILD}" >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        if: steps.gate.outputs.build == 'true'
        uses: actions/checkout@v4

      - name: Render policy.json
        if: steps.gate.outputs.build == 'true'
        env:
          OWNER: ${{ needs.build-base.outputs.owner }}
        run: |
          sed -e "s|__REGISTRY_NAMESPACE__|${OWNER}|g" \
              policy-hypervisor.json.template > policy.json

      - name: Free disk space
        if: steps.gate.outputs.build == 'true'
        uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

      - name: Install podman and cosign
        if: steps.gate.outputs.build == 'true'
        uses: sigstore/cosign-installer@v3.7.0

      - name: Install podman
        if: steps.gate.outputs.build == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y podman
          podman --version

      - name: Fetch cosy
        if: steps.gate.outputs.build == 'true'
        run: |
          mkdir -p bin man
          curl -fsSL https://raw.githubusercontent.com/BenSmith/cosy/main/cosy -o bin/cosy
          curl -fsSL https://raw.githubusercontent.com/BenSmith/cosy/main/cosy.1 -o man/cosy.1

      - name: Login to GHCR
        if: steps.gate.outputs.build == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTOR: ${{ github.actor }}
        run: |
          echo "$GH_TOKEN" | sudo podman login ghcr.io -u "$ACTOR" --password-stdin
          echo "$GH_TOKEN" | cosign login ghcr.io -u "$ACTOR" --password-stdin

      - name: Build variant
        if: steps.gate.outputs.build == 'true'
        env:
          IMAGE: ${{ matrix.variant.image }}
          CONTAINERFILE: ${{ matrix.variant.containerfile }}
          VERSION: ${{ matrix.fedora_version }}
          OWNER: ${{ needs.build-base.outputs.owner }}
        run: |
          sudo podman build \
            --pull=always \
            --security-opt=label=disable \
            --security-opt=seccomp=unconfined \
            --cap-add=all \
            --ipc=host \
            --build-arg BASE=ghcr.io/${OWNER}/hypervisor-bootc:${VERSION} \
            -f "${CONTAINERFILE}" \
            -t "localhost/${IMAGE}:build" \
            .

      - name: Rechunk variant
        if: steps.gate.outputs.build == 'true'
        env:
          IMAGE: ${{ matrix.variant.image }}
          RECHUNKER: ${{ needs.setup.outputs.rechunker }}
        run: |
          sudo podman run --rm --privileged \
            -v /var/lib/containers:/var/lib/containers \
            quay.io/fedora/fedora-bootc:${RECHUNKER} \
            /usr/libexec/bootc-base-imagectl rechunk \
            "localhost/${IMAGE}:build" \
            "localhost/${IMAGE}:rechunked"

      - name: Tag and push variant
        if: steps.gate.outputs.build == 'true'
        id: push
        env:
          OWNER: ${{ needs.build-base.outputs.owner }}
          BASE_TAG: ${{ needs.build-base.outputs.tag }}
          IMAGE: ${{ matrix.variant.image }}
          PREFIX: ${{ matrix.variant.prefix }}
          FLOATING: ${{ matrix.variant.floating }}
          VERSION: ${{ matrix.fedora_version }}
          STABLE: ${{ needs.setup.outputs.stable }}
        run: |
          IMAGE_BASE="ghcr.io/${OWNER}/${IMAGE}"
          VERSIONED="${PREFIX}${VERSION}-${BASE_TAG}"
          FLOATING_TAG="${PREFIX}${VERSION}"

          sudo podman tag "localhost/${IMAGE}:rechunked" "${IMAGE_BASE}:${VERSIONED}"
          sudo podman push --digestfile /tmp/digest.txt "${IMAGE_BASE}:${VERSIONED}"
          DIGEST=$(cat /tmp/digest.txt)

          sudo skopeo copy "docker://${IMAGE_BASE}@${DIGEST}" "docker://${IMAGE_BASE}:${FLOATING_TAG}"

          if [ "${VERSION}" = "${STABLE}" ]; then
            STABLE_FLOATING="${FLOATING:-latest}"
            sudo skopeo copy "docker://${IMAGE_BASE}@${DIGEST}" "docker://${IMAGE_BASE}:${STABLE_FLOATING}"
          fi

          {
            echo "image_base=${IMAGE_BASE}"
            echo "versioned_tag=${VERSIONED}"
            echo "floating_tag=${FLOATING_TAG}"
            echo "digest=$(cat /tmp/digest.txt)"
          } >> "$GITHUB_OUTPUT"

      - name: Sign variant
        if: steps.gate.outputs.build == 'true'
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_SECRET }}
          IMAGE_BASE: ${{ steps.push.outputs.image_base }}
          DIGEST: ${{ steps.push.outputs.digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_BASE}@${DIGEST}"

      - name: Summary
        if: steps.gate.outputs.build == 'true'
        env:
          NAME: ${{ matrix.variant.name }}
          IMAGE_BASE: ${{ steps.push.outputs.image_base }}
          VERSIONED_TAG: ${{ steps.push.outputs.versioned_tag }}
          FLOATING_TAG: ${{ steps.push.outputs.floating_tag }}
        run: |
          {
            echo "## Variant ${NAME} (F${{ matrix.fedora_version }}) complete"
            echo ""
            echo "- \`${IMAGE_BASE}:${VERSIONED_TAG}\`"
            echo "- \`${IMAGE_BASE}:${FLOATING_TAG}\`"
          } >> "$GITHUB_STEP_SUMMARY"