build: switch gha and justfile to the latest ublue-os/image-template #525
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Build container image | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: '05 10 * * *' # 10:05am UTC everyday | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '**/README.md' | |
| workflow_dispatch: | |
| env: | |
| IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| build_push: | |
| name: Build and push image | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| # These stage versions are pinned by https://github.com/renovatebot/renovate | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Maximize build space | |
| uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 | |
| - name: Install just | |
| uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 | |
| - name: Check Just Syntax | |
| shell: bash | |
| run: | | |
| just check | |
| - name: Image Name | |
| id: image-name | |
| run: | | |
| IMAGE_NAME=$(just image_name) | |
| echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV | |
| - name: Default Tag | |
| id: gen-default-tag | |
| run: | | |
| DEFAULT_TAG=$(just generate-default-tag) | |
| echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV | |
| - name: Prepare environment | |
| run: | | |
| # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 | |
| echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} | |
| echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} | |
| # This actually builds the container image | |
| - name: Build Image | |
| id: build-image | |
| run: | | |
| just build \ | |
| ${IMAGE_NAME} \ | |
| ${DEFAULT_TAG} | |
| # This is optional, this provides smaller delta updates | |
| - name: Rechunk with rpm-ostree | |
| id: rechunk | |
| run: | | |
| just ostree-rechunk \ | |
| ${IMAGE_NAME} \ | |
| ${DEFAULT_TAG} | |
| # If you are feeling adventurous, use the new distro agnostic rechunker | |
| # https://github.com/coreos/chunkah | |
| # You can delete the Rechunk with rpm-ostree portion then if you use this | |
| #- name: Rechunk with Chunkah | |
| # id: rechunk | |
| # run: | | |
| # just rechunk \ | |
| # ${IMAGE_NAME} \ | |
| # ${DEFAULT_TAG} | |
| - name: Generate Build Tags | |
| id: gen-build-tags | |
| run: | | |
| alias_tags="$(just generate-build-tags \ | |
| ${IMAGE_NAME} \ | |
| ${DEFAULT_TAG})" | |
| echo "Tags for this Action..." | |
| echo "${alias_tags}" | |
| echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT | |
| - name: Tag Image | |
| id: tag-images | |
| env: | |
| ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} | |
| run: | | |
| just tag-images \ | |
| "${IMAGE_NAME}" \ | |
| "${DEFAULT_TAG}" \ | |
| "${ALIAS_TAGS}" | |
| # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing | |
| # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 | |
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Push To GHCR | |
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | |
| id: push-image | |
| env: | |
| ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} | |
| run: | | |
| set -euox pipefail | |
| for tag in ${ALIAS_TAGS}; do | |
| podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} | |
| done | |
| digest=$(< /tmp/digestfile) | |
| echo "digest=${digest}" >> $GITHUB_OUTPUT | |
| # This section is optional and only needs to be enabled if you plan on distributing | |
| # your project for others to consume. You will need to create a public and private key | |
| # using Cosign and save the private key as a repository secret in Github for this workflow | |
| # to consume. For more details, review the image signing section of the README. | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | |
| with: | |
| # be careful when upgrading major versions | |
| cosign-release: 'v3.1.2' | |
| - name: Sign container image | |
| id: sign-image | |
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | |
| env: | |
| COSIGN_EXPERIMENTAL: false | |
| COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} | |
| DIGEST: ${{ steps.push-image.outputs.digest }} | |
| run: | | |
| # https://github.com/containers/container-libs/issues/388 | |
| # https://github.com/coreos/rpm-ostree/issues/5509 | |
| # use old bundle format, so we can use newer cosign 3.X.X instead of 2.X.X | |
| cosign sign -y --new-bundle-format=false --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} |