feat(build): honor [packages.<X>].enable + [deployment].target_<Y>

Commit 3 of 3 in the configurator-as-SSOT chain:
  Commit A (fef19cf): toml schema  -- enable flags + [deployment]
  Commit B (3ea193d): configurator -- toggles for packages + targets
  Commit C (this):    build pipe   -- honor the toggles

Build pipeline changes:

1. automation/lib/packages.sh now exports `_is_section_enabled
   <category>` -- an awk-only TOML reader (no python3 dep, safe at
   the very-early build phases when only base RPMs are present)
   that returns 0 (enabled) for missing/true values and 1
   (disabled) only when the toml explicitly has
   `[packages.<category>].enable = false`.

   `install_packages` and `install_packages_optional` consult
   `_is_section_enabled` first and skip the dnf invocation entirely
   when the operator unchecked the group in /configurator.html:

       [packages.gaming].enable=false -- skipping (operator disabled
       via /configurator.html)

   `install_packages_strict` is unchanged on purpose -- it's used
   for foundation-required packages (base, kernel, critical, etc.)
   which the configurator HTML doesn't expose as toggles.

2. /usr/libexec/mios/mios-build-driver builds BIB_FORMATS from
   [deployment].target_<key> in the layered toml. Resolution
   precedence:
     a. $MIOS_BIB_FORMATS env override (fast-iter dev)
     b. ~/.config/mios/mios.toml [deployment].target_X = true
     c. /etc/mios/mios.toml         [deployment].target_X = true
     d. /usr/share/mios/mios.toml   [deployment].target_X = true
     e. historical hard-default: "vhdx qcow2 iso raw wsl"

   Underscore-to-hyphen translation for BIB --type:
       toml: target_anaconda_iso  ->  BIB --type anaconda-iso

   Default behavior with shipped vendor toml: identical to before
   (vhdx qcow2 iso raw wsl). Difference is the operator can now
   toggle ami / ova / anaconda_iso ON via the configurator without
   editing build-mios.ps1 / mios-build-driver.

Verified the awk parsers against the real
/usr/share/mios/mios.toml on this box:

    [packages.bloat].enable        -> false (will be skipped)
    [packages.gaming].enable       -> true  (will install)
    [deployment] targets enabled   -> vhdx qcow2 iso raw wsl

Bash syntax of both edited files: clean.

End-to-end behavior the operator now sees:

  1. Open /configurator.html in Epiphany (mios-build-driver step).
  2. Uncheck e.g. "ceph" + "freeipa" + check "ami" + "ova".
  3. Save -> mios.toml writes
       [packages.ceph].enable    = false
       [packages.freeipa].enable = false
       [deployment].target_ami   = true
       [deployment].target_ova   = true
  4. Build proceeds:
       [packages.sh] [packages.ceph].enable=false -- skipping
       [packages.sh] [packages.freeipa].enable=false -- skipping
       building vhdx ... qcow2 ... iso ... raw ... wsl ... ami ... ova
  5. Output artifacts in /var/lib/mios/build/output/ now include
     ami + ova in addition to the 5 portable formats.

The full configurator-as-SSOT chain is in place. The operator's
choices in the HTML drive the actual build with no terminal
prompts (other than password when password_policy=interactive,
per the toml schema's secrets policy).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94

automation/lib/packages.sh

@@ -126,10 +126,46 @@ _PKG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=automation/lib/common.sh
 source "${_PKG_DIR}/common.sh"
 
+# _is_section_enabled <section>
+# Returns 0 (enabled) if [packages.<section>].enable is missing OR true.
+# Returns 1 (disabled) only when explicitly set to false in the toml.
+# This is the runtime side of the configurator HTML's package toggles --
+# the operator unchecks a box, the configurator writes
+# `[packages.<name>].enable = false` to mios.toml, and this helper
+# tells install_packages* to skip that group's dnf install.
+#
+# Parses with awk (no python3 dependency -- safe even at very-early
+# build phases before python is layered in).
+_is_section_enabled() {
+    local section="$1"
+    local toml result
+    toml=$(_resolve_mios_toml) || return 0  # no toml at all -> default enabled
+    result=$(awk -v sect="[packages.$section]" '
+        $0 == sect { in_section = 1; next }
+        /^\[/ && in_section { in_section = 0 }
+        in_section && /^[[:space:]]*enable[[:space:]]*=/ {
+            # match "enable = false" or "enable = true" (any whitespace).
+            # Anything other than literal "false" is treated as enabled
+            # (covers "true", missing-quote variants, comments after the
+            # value, etc.) since the schema default is true.
+            if ($0 ~ /=[[:space:]]*false[[:space:]]*($|#)/) print "false"
+            else print "true"
+            exit
+        }
+    ' "$toml" 2>/dev/null)
+    [[ "$result" != "false" ]]
+}
+
 # install_packages <section>
 # Best-effort: warns on per-package install failures, doesn't return non-zero.
+# Honors [packages.<section>].enable -- if the operator unchecked the
+# group in /configurator.html, this is a no-op.
 install_packages() {
     local category="$1"
+    if ! _is_section_enabled "$category"; then
+        echo "[packages.sh] [packages.${category}].enable=false -- skipping (operator disabled via /configurator.html)"
+        return 0
+    fi
     local packages
     packages=$(get_packages "$category")
     if [[ -n "${packages// }" ]]; then
@@ -165,11 +201,14 @@ install_packages_strict() {
 }
 
 # install_packages_optional <section>
-# Silent skip when the section is absent / empty (intentionally disabled
-# via the configurator HTML or a /etc/mios/mios.toml host override).
+# Silent skip when the section is absent / empty / disabled.
 # Otherwise behaves like install_packages (best-effort).
 install_packages_optional() {
     local category="$1"
+    if ! _is_section_enabled "$category"; then
+        echo "[packages.sh] INFO: [packages.${category}].enable=false -- skipping (operator disabled via /configurator.html)"
+        return 0
+    fi
     local packages
     packages=$(get_packages "$category")
     if [[ -z "${packages// }" ]]; then

usr/libexec/mios/mios-build-driver

@@ -353,23 +353,59 @@ else
     _log "BIB image: $BIB_IMG"
     _log "Output dir: $BIB_OUT"
 
-    # The artifact format list. Operator can override via
-    # MIOS_BIB_FORMATS="vhdx qcow2" to skip slow ones during iteration.
-    BIB_FORMATS="${MIOS_BIB_FORMATS:-vhdx qcow2 iso raw wsl}"
-    _log "Formats: $BIB_FORMATS"
+    # Build BIB_FORMATS from [deployment].target_<key> in the layered
+    # mios.toml -- the configurator HTML's "Deployment targets" section
+    # toggles these. Operator override via $MIOS_BIB_FORMATS="vhdx qcow2"
+    # still wins for fast-iter dev cycles. Final fallback to the
+    # historical 5-format default if the toml is missing entirely.
+    if [[ -n "${MIOS_BIB_FORMATS:-}" ]]; then
+        BIB_FORMATS="$MIOS_BIB_FORMATS"
+        _log "Formats from MIOS_BIB_FORMATS env: $BIB_FORMATS"
+    else
+        DEP_TOML=""
+        for cand in \
+            "${HOME:-/root}/.config/mios/mios.toml" \
+            /etc/mios/mios.toml \
+            /usr/share/mios/mios.toml \
+        ; do
+            if [[ -r "$cand" ]]; then DEP_TOML="$cand"; break; fi
+        done
+        BIB_FORMATS=""
+        if [[ -n "$DEP_TOML" ]]; then
+            while read -r tgt; do
+                [[ -n "$tgt" ]] && BIB_FORMATS+="${tgt} "
+            done < <(awk '
+                /^\[deployment\]$/ { in_deploy=1; next }
+                /^\[/ && in_deploy { in_deploy=0 }
+                in_deploy && /^[[:space:]]*target_[a-z0-9_]+[[:space:]]*=[[:space:]]*true/ {
+                    sub(/^[[:space:]]*target_/, "")
+                    sub(/[[:space:]]*=.*$/, "")
+                    print
+                }
+            ' "$DEP_TOML")
+            _log "Formats from $DEP_TOML [deployment]: ${BIB_FORMATS:-<none enabled>}"
+        fi
+        if [[ -z "${BIB_FORMATS// }" ]]; then
+            BIB_FORMATS="vhdx qcow2 iso raw wsl"
+            _log "Formats fallback to historical default: $BIB_FORMATS"
+        fi
+    fi
 
     BIB_OK=()
     BIB_FAIL=()
     for fmt in $BIB_FORMATS; do
+        # toml field names use underscores (target_anaconda_iso); BIB
+        # --type uses hyphens (anaconda-iso). Translate.
+        bib_type="${fmt//_/-}"
         _log ""
-        _log "→ building $fmt …"
+        _log "→ building $fmt (BIB --type $bib_type) …"
         if sudo podman run --rm --privileged \
                 --pull=newer \
                 --security-opt label=type:unconfined_t \
                 -v "$BIB_OUT:/output:Z" \
                 -v /var/lib/containers/storage:/var/lib/containers/storage \
                 "$BIB_IMG" \
-                --type "$fmt" \
+                --type "$bib_type" \
                 --local localhost/mios:latest 2>&1 | tee -a "$LOG_FILE"; then
             _log "[ok] $fmt artifact written under $BIB_OUT"
             BIB_OK+=("$fmt")