build-minimal-bootc.yml

name: Build Fedora Minimal Bootc

on:
  workflow_dispatch:
    inputs:
      versions_override:
        description: 'JSON array of Fedora versions to build, e.g. [44] (empty = use fedora-versions.yml)'
        required: false
        default: ''
        type: string

  schedule:
    - cron: '0 2 * * 6'

  push:
    branches: [main]
    paths:
      - 'fedora-bootc-minimal.Containerfile'
      - 'policy-minimal.json.template'
      - 'cosign.pub'
      - '.github/workflows/build-minimal-bootc.yml'
      - 'fedora-versions.yml'

concurrency:
  group: build-minimal-bootc-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_NAME: fedora-bootc-minimal

jobs:
  setup:
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-24.04
    outputs:
      versions: ${{ steps.r.outputs.versions }}
      stable: ${{ steps.r.outputs.stable }}
      rechunker: ${{ steps.r.outputs.rechunker }}
    steps:
      - uses: actions/checkout@v4
      - id: r
        run: |
          curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
            -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq
          if [ -n "${{ inputs.versions_override }}" ]; then
            echo "versions=${{ inputs.versions_override }}"
          else
            echo "versions=$(yq -o=json -I=0 '.supported' fedora-versions.yml)"
          fi >> "$GITHUB_OUTPUT"
          {
            echo "stable=$(yq '.stable' fedora-versions.yml)"
            echo "rechunker=$(yq '.rechunker' fedora-versions.yml)"
          } >> "$GITHUB_OUTPUT"

  build:
    needs: setup
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        fedora_version: ${{ fromJson(needs.setup.outputs.versions) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Resolve build parameters
        id: params
        env:
          OWNER_RAW: ${{ github.repository_owner }}
        run: |
          OWNER=$(echo "$OWNER_RAW" | tr '[:upper:]' '[:lower:]')
          TAG=$(date +%Y%m%d-%H%M)
          {
            echo "owner=${OWNER}"
            echo "tag=${TAG}"
            echo "image_base=ghcr.io/${OWNER}/${IMAGE_NAME}"
          } >> "$GITHUB_OUTPUT"

      - name: Install cosign
        uses: sigstore/cosign-installer@v3.7.0

      - name: Install podman
        run: |
          sudo apt-get update
          sudo apt-get install -y podman
          podman --version

      - name: Render policy.json
        env:
          OWNER: ${{ steps.params.outputs.owner }}
        run: |
          sed -e "s|__REGISTRY_NAMESPACE__|${OWNER}|g" \
              policy-minimal.json.template > policy.json
          cat policy.json

      - name: Clone Fedora bootc manifests
        run: |
          git clone --depth 1 https://gitlab.com/fedora/bootc/base-images.git manifests
          git -C manifests log -1
          cp policy.json manifests/policy.json
          cp cosign.pub manifests/cosign.pub

      - name: Build minimal bootc image
        env:
          VERSION: ${{ matrix.fedora_version }}
          TAG: ${{ steps.params.outputs.tag }}
        run: |
          sudo podman build \
            --security-opt=label=disable \
            --cap-add=all \
            --device /dev/fuse \
            -f fedora-bootc-minimal.Containerfile \
            --build-arg MANIFEST=minimal \
            --build-arg BUILDER_IMAGE=quay.io/fedora/fedora:${VERSION} \
            --build-arg REPOS_IMAGE=quay.io/fedora/fedora:${VERSION} \
            -t localhost/${IMAGE_NAME}:build \
            manifests
          sudo podman inspect localhost/${IMAGE_NAME}:build > /dev/null

      - name: Rechunk image
        env:
          RECHUNKER: ${{ needs.setup.outputs.rechunker }}
        run: |
          sudo podman run --rm --privileged \
            -v /var/lib/containers:/var/lib/containers \
            quay.io/fedora/fedora-bootc:${RECHUNKER} \
            /usr/libexec/bootc-base-imagectl rechunk \
            localhost/${IMAGE_NAME}:build \
            localhost/${IMAGE_NAME}:rechunked

      - name: Login to GHCR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTOR: ${{ github.actor }}
        run: |
          echo "$GH_TOKEN" | sudo podman login ghcr.io -u "$ACTOR" --password-stdin
          echo "$GH_TOKEN" | cosign login ghcr.io -u "$ACTOR" --password-stdin

      - name: Tag and push
        id: push
        env:
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          VERSION: ${{ matrix.fedora_version }}
          TAG: ${{ steps.params.outputs.tag }}
          STABLE: ${{ needs.setup.outputs.stable }}
        run: |
          TAGS=("${VERSION}-${TAG}" "${VERSION}")
          if [ "${VERSION}" = "${STABLE}" ]; then
            TAGS+=("latest")
          fi

          FIRST=true
          for t in "${TAGS[@]}"; do
            sudo podman tag localhost/${IMAGE_NAME}:rechunked "${IMAGE_BASE}:${t}"
            if [ "${FIRST}" = "true" ]; then
              sudo podman push --digestfile /tmp/digest.txt "${IMAGE_BASE}:${t}"
              FIRST=false
            else
              sudo podman push "${IMAGE_BASE}:${t}"
            fi
          done

          DIGEST=$(cat /tmp/digest.txt)
          {
            printf 'tags<<EOF\n%s\nEOF\n' "${TAGS[*]}"
            echo "digest=${DIGEST}"
          } >> "$GITHUB_OUTPUT"

      - name: Sign images
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_SECRET }}
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          DIGEST: ${{ steps.push.outputs.digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_BASE}@${DIGEST}"

      - name: Summary
        env:
          IMAGE_BASE: ${{ steps.params.outputs.image_base }}
          TAGS: ${{ steps.push.outputs.tags }}
        run: |
          {
            echo "## Minimal bootc build complete (F${{ matrix.fedora_version }})"
            echo ""
            echo "Pushed and signed:"
            for t in $TAGS; do
              echo "- \`${IMAGE_BASE}:${t}\`"
            done
          } >> "$GITHUB_STEP_SUMMARY"