build-bootc-image.yaml

---
name: Build Image
on:
  workflow_call:
    inputs:
      image-name:
        description: "The name of the image to build"
        required: true
        type: string
      image-desc:
        description: "The description of the image to build"
        required: false
        type: string
      image-tag:
        description: "Default tag to push to"
        required: false
        type: string
        default: "latest"
      rechunk:
        description: "Rechunk the build"
        required: false
        type: boolean
        default: true
      publish:
        description: "Publish this image"
        required: false
        type: boolean
        default: ${{  github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
      profiles:
        description: "Extra mkosi profiles to use"
        required: false
        type: string
        default: ""
      release:
        description: "Release to build for"
        required: false
        type: string
    secrets:
      SIGNING_SECRET:
        description: "The private key used to sign the image"
        required: false

env:
  IMAGE_DESC: "Easy to use and up to date desktop bootc image"
  IMAGE_KEYWORDS: "bootc,archlinux"
  IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/120078124?s=200&v=4"
  IMAGE_NAME: "${{ inputs.image-name }}"
  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
  DEFAULT_TAG: "${{ inputs.image-tag }}"
  IMAGE_LICENSE: Apache-2.0

jobs:
  build_push:
    name: Build and push image
    permissions:
      contents: read
      packages: write
      id-token: write
    timeout-minutes: 60
    strategy:
      fail-fast: false
    runs-on: ubuntu-24.04
    outputs:
      image_version: ${{ steps.getversion.outputs.image_version }}
    steps:
      - name: Free disk space
        uses: hastd/free-disk-space@68572aeaadb7f76bd408246328e95926323402b5 # v0.1.2
        with:
          exclude: |
            /opt/hostedtoolcache/Python
          skip-if-available: "64G"

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          submodules: true

      # We need newer podman due to old podman not supporting lots of flags
      - name: Update podman and install just
        shell: bash
        run: |
          set -eux
          # Require the runner is ubuntu-24.04
          IDV=$(. /usr/lib/os-release && echo ${ID}-${VERSION_ID})
          test "${IDV}" = "ubuntu-24.04"
          # resolute is the next release. The azure.archive.ubuntu.com mirror only carries amd64.
          # Other architectures like arm64 use ports.ubuntu.com/ubuntu-ports.
          if [ "$(dpkg --print-architecture)" = "amd64" ]; then
            mirror="http://azure.archive.ubuntu.com/ubuntu"
          else
            mirror="http://ports.ubuntu.com/ubuntu-ports"
          fi
          echo "deb ${mirror} resolute universe main" | sudo tee /etc/apt/sources.list.d/resolute.list
          /bin/time -f '%E %C' sudo apt update
          # skopeo is currently older in resolute for some reason hence --allow-downgrades
          /bin/time -f '%E %C' sudo apt install -y --allow-downgrades crun/resolute buildah/resolute podman/resolute skopeo/resolute just/resolute
          podman --version

      - name: Install mkosi
        uses: systemd/mkosi@c4c3d793d0f6f0a2f26895de5ed9382396f36bb5

      - name: Set mkosi.version
        # We need to do this because mkosi.version is not persistent between builds on CI
        run: skopeo list-tags docker://${IMAGE_REGISTRY}/${IMAGE_NAME} | jq --arg date "$(date -u +%Y%m%d)" -r '.Tags[] | select(startswith($date+"."))' | sort -n | tail -1 > mkosi.version

      - name: Render configuration (for debugging)
        run: mkosi cat-config --debug

      - name: Build image
        id: build
        env:
          IMAGE_PROFILES: ${{ inputs.profiles }}
          CI_MKOSI_RELEASE: ${{ inputs.release }}
          IMAGE_FULL: localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
        run: |
          args="" 
          RELEASE_ARGUMENTS=()

          for profile in $IMAGE_PROFILES; do
            args="$args --profile $profile"
          done

          if [ "$CI_MKOSI_RELEASE" != "" ] ; then
            RELEASE_ARGUMENTS+=("--release=$CI_MKOSI_RELEASE")
          fi
          
          sudo mkosi -B --profile bootc ${args} --debug -ff --tools-tree-distribution=arch ${RELEASE_ARGUMENTS}

      - name: Get Version
        id: getversion
        run: |
          set -e
          echo "image_version=$(cat mkosi.version)" >> "$GITHUB_OUTPUT"

      - name: Load image
        id: load
        run: |
          set -e
          sudo env IMAGE_FULL="localhost/${IMAGE_NAME}:${DEFAULT_TAG}" "$(which just)" load

      - name: Rechunk image
        if: inputs.rechunk
        run: |
          set -e
          sudo env IMAGE_FULL="localhost/${IMAGE_NAME}:${DEFAULT_TAG}" "$(which just)" rechunk

      - name: Lint image
        run: |
          set -e
          sudo env IMAGE_FULL="localhost/${IMAGE_NAME}:${DEFAULT_TAG}" "$(which just)" lint

      - name: Login to GitHub Container Registry
        if: inputs.publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LOGIN_USER: ${{ github.actor }}
        run: echo "${GITHUB_TOKEN}" | sudo podman login -u "${LOGIN_USER}" --password-stdin "ghcr.io"

      - name: Push to GHCR
        if: inputs.publish
        id: push
        env:
          IMAGE_DIGEST: ${{ steps.load.outputs.digest }}
          MAX_RETRIES: 3
          PLATFORM: ${{ matrix.platform }}
          REPOSITORY_OWNER: ${{ github.repository_owner }}
          SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
          FINAL_NAME: ${{ env.IMAGE_NAME }}
        run: |
          set -x
          PRIVATE_KEY_FILE="$(mktemp)"
          echo "${SIGNING_SECRET}" > "${PRIVATE_KEY_FILE}"
          trap 'rm -f $PRIVATE_KEY_FILE' EXIT
          sudo mkdir -p "/etc/containers/registries.d/"
          echo -e "docker:\n  ${IMAGE_REGISTRY}:\n    use-sigstore-attachments: true" | sudo tee "/etc/containers/registries.d/${REPOSITORY_OWNER}.yaml"

          DIGESTFILE="/tmp/digestfile" # This needs to be r/w, non-existent so that podman can write to it
          # HACK: push two times so layer annotations are present
          # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed
          for _ in $(seq 2); do
            sudo podman push --retry "${MAX_RETRIES}" --compression-format=zstd --digestfile="${DIGESTFILE}" "localhost/${IMAGE_NAME}:${DEFAULT_TAG}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${DEFAULT_TAG}-${PLATFORM}" "--sign-passphrase-file=/dev/null" "--sign-by-sigstore-private-key=${PRIVATE_KEY_FILE}"
          done
          echo "remote_image_digest=$(< "${DIGESTFILE}")" | tee "${GITHUB_OUTPUT}"

      - name: Create Job Outputs
        if: inputs.publish
        env:
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          PLATFORM: ${{ matrix.platform }}
          DIGEST: ${{ steps.push.outputs.remote_image_digest }}
        run: |
          set -x
          mkdir -p /tmp/outputs/digests
          echo "${DIGEST}" | tee "/tmp/outputs/digests/${IMAGE_NAME}-${PLATFORM}.txt"

      - name: Upload Output Artifacts
        if: inputs.publish
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.IMAGE_NAME }}-${{ matrix.platform }}
          retention-days: 1
          if-no-files-found: error
          path: |
            /tmp/outputs/digests/*.txt

  manifest:
    name: Create Manifest
    runs-on: ubuntu-latest
    if: always()
    needs:
      - build_push
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Exit on failure
        shell: bash
        env:
          JOBS: ${{ toJson(needs) }}
        run: |
          for i in $(jq -r 'to_entries[] | .value.result' <<< "${JOBS}"); do
            if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
              echo "Status check not okay!"
              exit 1
            fi
          done

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

        # This generates a timestamp like what is defined on the ArtifactHub documentation
        # E.G: 2022-02-08T15:38:15Z'
        # https://artifacthub.io/docs/topics/repositories/container-images/
        # https://linux.die.net/man/1/date
      - name: Get current date
        id: date
        run:
          set -xeuo pipefail
          echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> "${GITHUB_OUTPUT}"

      - name: Get mkosi metadata
        id: imagemetadata
        env:
          MANUAL_RELEASE: ${{ inputs.release }}
        run: |
          set -xeuo pipefail
          if [ "$MANUAL_RELEASE" != "" ] ; then
            echo "distributionversion=${MANUAL_RELEASE}" >> "${GITHUB_OUTPUT}"
          else
            echo "distributionversion=$(grep "Release=" mkosi.conf | cut -d= -f2)" >> "${GITHUB_OUTPUT}"
          fi

      - name: Image Metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        if: inputs.publish
        id: metadata
        with:
          tags: |
            type=raw,value=${{ env.DEFAULT_TAG }}
            type=raw,value=${{ env.DEFAULT_TAG }}-${{ github.sha }}
            type=raw,value=${{ env.DEFAULT_TAG }}.${{ needs.build_push.outputs.image_version }}
            type=raw,value=${{ env.DEFAULT_TAG }}.${{ needs.build_push.outputs.image_version }}-${{ github.sha }}
            type=raw,value=${{ needs.build_push.outputs.image_version }},enable=${{ env.DEFAULT_TAG == 'latest' }}
            type=ref,event=pr
            type=sha,enable=${{ github.event_name == 'pull_request' }}
          labels: |
            containers.bootc=1
            io.artifacthub.package.deprecated=false
            io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
            io.artifacthub.package.license=${{ env.IMAGE_LICENSE }}
            io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
            io.artifacthub.package.prerelease=false
            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
            org.opencontainers.image.created=${{ steps.date.outputs.date }}
            org.opencontainers.image.description=${{ env.IMAGE_DESC }}
            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
            org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }}
            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/commit/${{ github.sha }}
            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
            org.opencontainers.image.vendor=${{ github.repository_owner }}
            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.${{ needs.build_push.outputs.image_version }}

      - name: Login to GitHub Container Registry
        if: inputs.publish
        env:
          REGISTRY: ghcr.io
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
        run: echo "${GITHUB_TOKEN}" | podman login -u "${GITHUB_ACTOR}" --password-stdin "${REGISTRY}"

      - name: Update podman and install just
        shell: bash
        run: |
          set -eux
          # Require the runner is ubuntu-24.04
          test "$(. /usr/lib/os-release && echo "${ID}-${VERSION_ID}")" = "ubuntu-24.04"
          # resolute is the next release. The azure.archive.ubuntu.com mirror only carries amd64.
          # Other architectures like arm64 use ports.ubuntu.com/ubuntu-ports.
          if [ "$(dpkg --print-architecture)" = "amd64" ]; then
            mirror="http://azure.archive.ubuntu.com/ubuntu"
          else
            mirror="http://ports.ubuntu.com/ubuntu-ports"
          fi
          echo "deb ${mirror} resolute universe main" | sudo tee /etc/apt/sources.list.d/resolute.list
          /bin/time -f '%E %C' sudo apt update
          # skopeo is currently older in resolute for some reason hence --allow-downgrades
          /bin/time -f '%E %C' sudo apt install -y --allow-downgrades crun/resolute podman/resolute
          podman --version

      - name: Fetch Build Outputs
        if: inputs.publish
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: ${{ env.IMAGE_NAME }}-*
          merge-multiple: true
          path: /tmp/artifacts

      - name: Publish manifest with unified architecture and sign
        shell: bash
        if: inputs.publish
        env:
          SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
          LABELS: ${{ steps.metadata.outputs.labels }}
          TAGS: ${{ steps.metadata.outputs.tags }}
        run: |
          set -x

          PRIVATE_KEY_FILE="$(mktemp)"
          echo "${SIGNING_SECRET}" > "${PRIVATE_KEY_FILE}"
          trap 'rm -f $PRIVATE_KEY_FILE' EXIT
          sudo mkdir -p "/etc/containers/registries.d/"
          echo -e "docker:\n  ${IMAGE_REGISTRY}:\n    use-sigstore-attachments: true" | sudo tee "/etc/containers/registries.d/${REPOSITORY_OWNER}.yaml"

          for digest_file in /tmp/artifacts/*.txt; do
            # Extract the platform from the file name
            TARGET_PLATFORM="$(basename "${digest_file}" ".txt" | sed 's/.*-//g')"
            TARGET_IMAGE="$(basename "${digest_file}" ".txt" | grep -Po ".*-" | sed 's/-$//')"
            TARGET_DIGEST="$(< "${digest_file}")"

            TARGET_MANIFEST="${IMAGE_REGISTRY}/${TARGET_IMAGE}"
            if ! podman images | grep -F -e "${TARGET_MANIFEST}" ; then
              podman manifest create "${TARGET_MANIFEST}"
            fi

            podman manifest add "${TARGET_MANIFEST}" "${TARGET_MANIFEST}@${TARGET_DIGEST}" --arch "${TARGET_PLATFORM}"
          done

          # We want one per image instead
          for digest_file in $(find /tmp/artifacts/*.txt | sed 's/[-]$//' | uniq); do
            TARGET_IMAGE="$(basename "${digest_file}")"
            TARGET_MANIFEST="${IMAGE_REGISTRY}/${IMAGE_NAME}"
            while IFS= read -r LABEL; do
              podman manifest annotate --index --annotation "${LABEL}" "${TARGET_MANIFEST}"
            done <<< "${LABELS}"
            # HACK: push two times so layer annotations are present
            # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed
            for _ in $(seq 2); do
              while IFS= read -r TAG; do
                podman manifest push --all=false --compression-format=zstd "${TARGET_MANIFEST}" "${TARGET_MANIFEST}:${TAG}" "--sign-passphrase-file=/dev/null" "--sign-by-sigstore-private-key=${PRIVATE_KEY_FILE}"
              done <<< "${TAGS}"
            done
          done