ci(os): make mkosi verification manual only

Author: kvinwang

.github/workflows/mkosi-build.yml

@@ -6,11 +6,6 @@ name: Verify mkosi reproducibility
 
 on:
   workflow_dispatch:
-  # Bootstrap this new workflow once before it exists on the default branch.
-  # Remove this trigger after the hosted-runner baseline check completes.
-  pull_request:
-    paths:
-      - '.github/workflows/mkosi-build.yml'
 
 concurrency:
   group: mkosi-build-${{ github.ref }}
@@ -118,45 +113,6 @@ jobs:
             ./os/mkosi/build.sh image "$RUNNER_TEMP/mkosi-cross-host"
           sudo chown -R "$USER:$USER" "$RUNNER_TEMP/mkosi-cross-host/out"
 
-      - name: Record canonical rootfs tree
-        if: always()
-        run: |
-          root="$RUNNER_TEMP/mkosi-cross-host/work-prod/rootfs"
-          test -d "$root" || exit 0
-          sudo python3 - "$root" > "$RUNNER_TEMP/rootfs.manifest" <<'PY'
-          import hashlib
-          import os
-          import stat
-          import sys
-
-          root = sys.argv[1]
-          hardlinks = {}
-          for base, dirs, files in os.walk(root, topdown=True, followlinks=False):
-              dirs.sort()
-              files.sort()
-              for name in dirs + files:
-                  path = os.path.join(base, name)
-                  rel = os.path.relpath(path, root)
-                  info = os.lstat(path)
-                  mode = stat.S_IMODE(info.st_mode)
-                  if stat.S_ISREG(info.st_mode):
-                      digest = hashlib.sha256()
-                      with open(path, "rb") as stream:
-                          for block in iter(lambda: stream.read(1024 * 1024), b""):
-                              digest.update(block)
-                      key = (info.st_dev, info.st_ino)
-                      first = hardlinks.setdefault(key, rel)
-                      detail = f"sha256={digest.hexdigest()} hardlink={first}"
-                  elif stat.S_ISLNK(info.st_mode):
-                      detail = f"target={os.readlink(path)}"
-                  elif stat.S_ISCHR(info.st_mode) or stat.S_ISBLK(info.st_mode):
-                      detail = f"device={os.major(info.st_rdev)}:{os.minor(info.st_rdev)}"
-                  else:
-                      detail = "-"
-                  print(f"{rel}\t{stat.S_IFMT(info.st_mode):o}\t{mode:o}\t"
-                        f"{info.st_uid}:{info.st_gid}\t{info.st_size}\t{detail}")
-          PY
-
       - name: Compare with local byte-for-byte baseline
         run: |
           cd "$RUNNER_TEMP/mkosi-cross-host/out/prod"
@@ -174,7 +130,5 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: mkosi-cross-host-sha256
-          path: |
-            ${{ runner.temp }}/mkosi-cross-host/out/prod/cross-host.sha256
-            ${{ runner.temp }}/rootfs.manifest
+          path: ${{ runner.temp }}/mkosi-cross-host/out/prod/cross-host.sha256
           retention-days: 30