Skip to content

Commit a2fbc4e

Browse files
DaniilKlDaniilKl
committed
.github: workflows: add workflows for automatic rebase
The "build-and-publish-rebased.yml" workflow has to be triggered via "workflow_run" event and not on the "create" or "push" events, because the "create" and "push" events seems to expect the "build-and-publish-rebased.yml" be present on the branch that is being created or on the branch the commits are being pushed on. The condition on the "github.event.workflow_run.conclusion" is needed so the workflow will not try to build the component from the branch "tb-dev-rebased" after the "rebase.yml" fails. If the "rebase.yml" fails it is almost certain the "tb-dev-rebased" either will not exist or will contain commmits we do not want to build from. So this condition will prevent surplus fails. --- Regarding the "rebase.yml". We cannot simply rebase commits from TrenchBoot/grub on top of the commits in the QubesOS/qubes-grub2, because: 1. The actual history for grub component is held in patches in the QubesOS/qubes-grub2 repository, so we need to do a convertion from patches to commits every time we want to try to rebase. 2. We want to track the changes to the other files from the QubesOS/qubes-grub2 except the patches for the grub component, as versions of these files might be closesly related to the changes in the patches for the grub component. Other changes that should be done due to history format difference between the QubesOS/qubes-grub2 and TrenchBoot/grub should will be resolved by TrenchBoot the follwoing commit when the actual rebase happen: 2f477ee Signed-off-by: Danil Klimuk <daniil.klimuk@3mdeb.com>
1 parent 7259d55 commit a2fbc4e

2 files changed

Lines changed: 147 additions & 0 deletions

File tree

‎.github/workflows/build-and-publish-rebased.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Build the last successful automatic rebase of tb-dev branch
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_run:
6+
workflows:
7+
- 'Rebase on top of QubesOS main and build RPMs'
8+
types:
9+
- completed
10+
11+
jobs:
12+
get-version:
13+
runs-on: ubuntu-latest
14+
if: github.event.workflow_run.conclusion == 'success'
15+
outputs:
16+
version: ${{ steps.read-version.outputs.version }}
17+
steps:
18+
- uses: actions/checkout@v6
19+
with:
20+
ref: 'aem-next-rebased'
21+
- name: Read version of the QubesOS Component from version file
22+
id: read-version
23+
run: echo "version=$(cat version)" >> $GITHUB_OUTPUT
24+
qubes-dom0-package:
25+
uses: TrenchBoot/.github/.github/workflows/qubes-dom0-packagev2.yml@master
26+
with:
27+
qubes-component: 'grub2'
28+
qubes-component-branch: 'tb-dev-rebased'
29+
qubes-pkg-src-dir: '.'
30+
qubes-pkg-version: ${{ needs.get-version.outputs.version }}
31+
trigger-gitea-cicd:
32+
needs: qubes-dom0-package
33+
uses: TrenchBoot/.github/.github/workflows/trigger-woodpecker-pipeline.yml@master
34+
secrets:
35+
woodpecker-token: ${{ secrets.WOODPECKER_TOKEN }}
36+
with:
37+
api-url: 'https://ci.3mdeb.com'
38+
owner: 'zarhus'
39+
repo: 'trenchboot-release-cicd-pipeline'
40+
ref: 'sign-and-publish-rc-rpms'
41+
inputs: >-
42+
--input GITHUB_REPO=grub
43+
--input GITHUB_SHA=${{ github.sha }}
44+
--input GITHUB_RUN_ID=${{ github.run_id }}
45+
--input QUBES_COMPONENT=grub2
46+
--input WORKFLOW=sign-and-publish-test-rpms

‎.github/workflows/rebase.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: Rebase on top of QubesOS main and build RPMs
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '0 0 * * 6'
7+
8+
jobs:
9+
prep-rebase:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
steps:
14+
- name: Checkout qubes-grub2
15+
uses: actions/checkout@v6
16+
with:
17+
repository: QubesOS/qubes-grub2
18+
path: qubes-grub2
19+
20+
- name: Checkout downstream grub repository
21+
uses: actions/checkout@v6
22+
with:
23+
repository: TrenchBoot/grub
24+
token: ${{ secrets.TRENCHBOOT_REBASE_TOKEN }}
25+
path: grub
26+
27+
- name: Read upstream version from qubes-grub2
28+
id: version
29+
run: echo "version=$(tr -d '[:space:]' < qubes-grub2/version)" >> "$GITHUB_OUTPUT"
30+
31+
- name: Add upstream remote and fetch version tag
32+
working-directory: grub
33+
env:
34+
UPSTREAM_TAG: grub-${{ steps.version.outputs.version }}
35+
run: |
36+
git remote add upstream https://git.savannah.gnu.org/git/grub.git
37+
git fetch upstream "refs/tags/${UPSTREAM_TAG}:refs/tags/${UPSTREAM_TAG}"
38+
- name: Remove unused Source1 sig declaration from grub2 spec
39+
run: sed -i '/^Source1:[[:space:]]*.*\.sig/d' qubes-grub2/grub2.spec.in
40+
- name: Apply qubes-grub2 patches on top of upstream tag
41+
working-directory: grub
42+
env:
43+
UPSTREAM_TAG: grub-${{ steps.version.outputs.version }}
44+
run: |
45+
git config user.name 'github-actions[bot]'
46+
git config user.email 'github-actions[bot]@users.noreply.github.com'
47+
git checkout -b qubes-grub2-with-patches-rebase-prep "$UPSTREAM_TAG"
48+
SPEC="../qubes-grub2/grub2.spec.in"
49+
mapfile -t PATCHES < <(grep -E '^Patch[0-9]+:' "$SPEC" | awk '{print $2}')
50+
for patch_file in "${PATCHES[@]}"; do
51+
git am "../qubes-grub2/${patch_file}"
52+
escaped=$(printf '%s' "$patch_file" | sed 's/\./\\./g')
53+
sed -i "/^Patch[0-9]*:[[:space:]]*${escaped}[[:space:]]*$/d" "$SPEC"
54+
rm -f "../qubes-grub2/${patch_file}"
55+
done
56+
- name: Copy QubesOS RPM files to downstream repository
57+
run: |
58+
cp -r qubes-grub2/* grub/
59+
cd grub
60+
git add -A
61+
git commit -m "QubesOS RPM files and Qubes builder metadata"
62+
- name: Push qubes-grub2-with-patches branch to downstream
63+
working-directory: grub
64+
run: |
65+
git push origin qubes-grub2-with-patches-rebase-prep || \
66+
echo "Cannot prepare for automatic rebase!" >&2
67+
try-rebase:
68+
needs: prep-rebase
69+
uses: TrenchBoot/.github/.github/workflows/rebase.yml@master
70+
secrets:
71+
first-remote-token: ${{secrets.TRENCHBOOT_REBASE_TOKEN}}
72+
permissions:
73+
# For creation/deletion/pushing to branches and creating PRs
74+
contents: write
75+
with:
76+
downstream-repo: 'https://github.com/TrenchBoot/grub.git'
77+
downstream-branch: 'tb-dev'
78+
upstream-repo: 'https://github.com/TrenchBoot/grub.git'
79+
upstream-branch: 'qubes-grub2-with-patches-rebase-prep'
80+
commit-user-name: 'github-actions[bot]'
81+
commit-user-email: 'github-actions[bot]@users.noreply.github.com'
82+
cicd-trigger-resume: '7. Rerun the workflow https://github.com/TrenchBoot/grub/actions/runs/${{ github.run_id }} to resume automated rebase.'
83+
cleanup-on-rebase-failure:
84+
needs: try-rebase
85+
runs-on: ubuntu-latest
86+
permissions:
87+
contents: read
88+
steps:
89+
- name: Checkout downstream grub repository
90+
uses: actions/checkout@v6
91+
with:
92+
repository: TrenchBoot/grub
93+
token: ${{ secrets.TRENCHBOOT_REBASE_TOKEN }}
94+
path: grub
95+
- name: Delete qubes-grub2-with-patches branch from downstream
96+
working-directory: grub
97+
env:
98+
TOKEN: ${{ secrets.TRENCHBOOT_REBASE_TOKEN }}
99+
run: |
100+
git push "https://${TOKEN}@github.com/TrenchBoot/grub.git" \
101+
--delete qubes-grub2-with-patches-rebase-prep

0 commit comments

Comments
 (0)