-
Notifications
You must be signed in to change notification settings - Fork 40
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: use kernel-cache images and fedora for builds (#214)
- Loading branch information
Showing
28 changed files
with
149 additions
and
253 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,7 +31,6 @@ jobs: | |
| - main | ||
| - asus | ||
| - fsync | ||
| - fsync-lts | ||
| - surface | ||
| - coreos-stable | ||
| - coreos-testing | ||
|
|
@@ -44,8 +43,9 @@ jobs: | |
| kernel_flavor: fsync | ||
| - fedora_version: 39 | ||
| kernel_flavor: asus | ||
| - fedora_version: 40 | ||
| kernel_flavor: fsync-lts # kernel-ba packages are not being built for F40 yet. | ||
| - fedora_version: 39 | ||
| kernel_flavor: coreos-testing | ||
|
|
||
| steps: | ||
| # Checkout push-to-registry action GitHub repository | ||
| - name: Checkout Push to Registry action | ||
|
|
@@ -59,11 +59,56 @@ jobs: | |
| else | ||
| echo "IMAGE_NAME=${{ env.IMAGE_BASE_NAME }}-${{ matrix.cfile_suffix }}" >> $GITHUB_ENV | ||
| fi | ||
| export SOURCE_IMAGE=base | ||
| export SOURCE_ORG=fedora-ostree-desktops | ||
| echo "SOURCE_IMAGE=${SOURCE_IMAGE}" >> $GITHUB_ENV | ||
| echo "SOURCE_ORG=${SOURCE_ORG}" >> $GITHUB_ENV | ||
| echo "FQ_SOURCE_IMAGE=quay.io/${SOURCE_ORG}/${SOURCE_IMAGE}:${{ matrix.fedora_version }}" >> $GITHUB_ENV | ||
| export BUILDER_IMAGE=quay.io/fedora/fedora | ||
| echo "BUILDER_IMAGE=${BUILDER_IMAGE}" >> $GITHUB_ENV | ||
| echo "FQ_BUILDER_IMAGE=${BUILDER_IMAGE}:${{ matrix.fedora_version }}" >> $GITHUB_ENV | ||
| export KERNEL_IMAGE=${{ matrix.kernel_flavor }}-kernel | ||
| echo "KERNEL_IMAGE=${KERNEL_IMAGE}" >> $GITHUB_ENV | ||
| echo "FQ_KERNEL_IMAGE=${{ env.IMAGE_REGISTRY }}/${KERNEL_IMAGE}:${{ matrix.fedora_version }}" >> $GITHUB_ENV | ||
| - name: AppArmor Disable | ||
| run: | | ||
| set -x | ||
| systemctl status apparmor | ||
| sudo systemctl stop apparmor | ||
| systemctl status apparmor || true | ||
| - name: Pull build images | ||
| uses: Wandalen/[email protected] | ||
| with: | ||
| attempt_limit: 3 | ||
| attempt_delay: 15000 | ||
| command: | | ||
| # pull the base image used for FROM in containerfile so | ||
| # we can retry on that unfortunately common failure case | ||
| podman pull ${{ env.FQ_BUILDER_IMAGE }} | ||
| podman pull ${{ env.FQ_KERNEL_IMAGE }} | ||
| - name: Get current version | ||
| shell: bash | ||
| run: | | ||
| set -eo pipefail | ||
| #skopeo inspect containers-storage:${{ env.FQ_KERNEL_IMAGE }} > kernel.json | ||
| # We SHOULD be able to use container-storage to inspect already pulled image here | ||
| # BUT... ubuntu-24.04 builders prevent with this error: | ||
| # Error during unshare(...): Operation not permitted | ||
| # I intend to investigate/fix later, but need to move forward | ||
| skopeo inspect docker://${{ env.FQ_KERNEL_IMAGE }} > kernel.json | ||
| linux=$(jq -r '.["Labels"]["ostree.linux"]' kernel.json) | ||
| if [ -z "$linux" ] || [ "null" = "$linux" ]; then | ||
| echo "inspected linux version must not be empty or null" | ||
| exit 1 | ||
| fi | ||
| echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV | ||
| img_version=$(jq -r '.["Labels"]["org.opencontainers.image.version"]' kernel.json) | ||
| if [ -z "$img_version" ] || [ "null" = "$img_version" ]; then | ||
| echo "inspected image version must not be empty or null" | ||
| exit 1 | ||
| fi | ||
| echo "KERNEL_IMAGE_VERSION=$img_version" >> $GITHUB_ENV | ||
| - name: Generate tags | ||
| id: generate-tags | ||
|
|
@@ -101,94 +146,6 @@ jobs: | |
| echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT | ||
| - name: Retrieve akmods signing key | ||
| run: | | ||
| mkdir -p certs | ||
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | ||
| echo "Using test signing key" | ||
| else | ||
| echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key.priv | ||
| fi | ||
| # DEBUG: get character count of key | ||
| wc -c certs/private_key.priv | ||
| - name: Pull build image | ||
| uses: Wandalen/[email protected] | ||
| with: | ||
| attempt_limit: 3 | ||
| attempt_delay: 15000 | ||
| command: | | ||
| # pull the base image used for FROM in containerfile so | ||
| # we can retry on that unfortunately common failure case | ||
| podman pull ${{ env.FQ_SOURCE_IMAGE }} | ||
| - name: Get current version | ||
| run: | | ||
| set -eo pipefail | ||
| # skopeo must always run to inspect image labels for build version | ||
| skopeo inspect docker://${{ env.FQ_SOURCE_IMAGE }} > inspect.json | ||
| ver=$(jq -r '.Labels["org.opencontainers.image.version"]' inspect.json) | ||
| if [ -z "$ver" ] || [ "null" = "$ver" ]; then | ||
| echo "inspected image version must not be empty or null" | ||
| exit 1 | ||
| fi | ||
| if [ "main" == "${{ matrix.kernel_flavor }}" ]; then | ||
| # main kernel_flavor: use ostree.linux to determine kernel version | ||
| linux=$(jq -r '.Labels["ostree.linux"]' inspect.json) | ||
| else | ||
| # other kernel_flavor: start container use dnf to find kernel version | ||
| container_name="fq-$(uuidgen)" | ||
| podman run --entrypoint /bin/bash --name "$container_name" -dt "${{ env.FQ_SOURCE_IMAGE }}" | ||
| podman exec $container_name rpm-ostree install dnf dnf-plugins-core | ||
| # Fetch kernel version | ||
| dnf="podman exec $container_name dnf" | ||
| case "${{ matrix.kernel_flavor }}" in | ||
| "asus") | ||
| $dnf copr enable -y lukenukem/asus-kernel | ||
| linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:lukenukem:asus-kernel --whatprovides kernel | tail -n1 | sed 's/.*://') | ||
| ;; | ||
| "fsync") | ||
| $dnf copr enable -y sentry/kernel-fsync | ||
| linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:sentry:kernel-fsync --whatprovides kernel | tail -n1 | sed 's/.*://') | ||
| ;; | ||
| "fsync-lts") | ||
| $dnf copr enable -y sentry/kernel-ba | ||
| linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:sentry:kernel-ba --whatprovides kernel | tail -n1 | sed 's/.*://') | ||
| ;; | ||
| "main") | ||
| linux=$($dnf repoquery --whatprovides kernel | tail -n1 | sed 's/.*://') | ||
| ;; | ||
| "surface") | ||
| $dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo | ||
| linux=$($dnf repoquery --repoid linux-surface --whatprovides kernel-surface | tail -n1 | sed 's/.*://') | ||
| ;; | ||
| "coreos-stable"|"coreos-testing") | ||
| coreos_stream=$(echo "${{ matrix.kernel_flavor }}" | cut -f2 -d-) | ||
| coreos_kernel_release=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:${coreos_stream} | jq -r '.Labels["ostree.linux"] | split(".x86_64")[0]') | ||
| coreos_fedora_version=$(echo $coreos_kernel_release | grep -oP 'fc\K[0-9]+') | ||
| if [[ "${{ matrix.fedora_version }}" == "$coreos_fedora_version" ]]; then | ||
| linux="${coreos_kernel_release}" | ||
| elif [[ "$(( "${coreos_fedora_version}" - 1 ))" == ${{ matrix.fedora_version }} ]]; then | ||
| major_minor_patch=$(echo "$coreos_kernel_release" | cut -d '-' -f 1) | ||
| linux="${major_minor_patch}-200.fc$(($coreos_fedora_version - 1))" | ||
| fi | ||
| ;; | ||
| *) | ||
| echo "unexpected kernel_flavor '${{ matrix.kernel_flavor }}' for dnf repoquery" | ||
| ;; | ||
| esac | ||
| fi | ||
| if [ -z "$linux" ] || [ "null" = "$linux" ]; then | ||
| echo "inspected image linux version must not be empty or null" | ||
| exit 1 | ||
| fi | ||
| echo "SOURCE_IMAGE_VERSION=$ver" >> $GITHUB_ENV | ||
| echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV | ||
| # Build metadata | ||
| - name: Image Metadata | ||
| uses: docker/metadata-action@v5 | ||
|
|
@@ -199,11 +156,22 @@ jobs: | |
| labels: | | ||
| org.opencontainers.image.title=${{ env.IMAGE_BASE_NAME }} | ||
| org.opencontainers.image.description=A caching layer for pre-built akmod RPMs | ||
| org.opencontainers.image.version=${{ env.SOURCE_IMAGE_VERSION }} | ||
| org.opencontainers.image.version=${{ env.KERNEL_IMAGE_VERSION }} | ||
| ostree.linux=${{ env.KERNEL_VERSION }} | ||
| io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md | ||
| io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4 | ||
| - name: Retrieve akmods signing key | ||
| run: | | ||
| mkdir -p certs | ||
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | ||
| echo "Using test signing key" | ||
| else | ||
| echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key.priv | ||
| fi | ||
| # DEBUG: get character count of key | ||
| wc -c certs/private_key.priv | ||
| # Build image using Buildah action | ||
| - name: Build Image | ||
| id: build_image | ||
|
|
@@ -215,10 +183,9 @@ jobs: | |
| tags: | | ||
| ${{ steps.generate-tags.outputs.alias_tags }} | ||
| build-args: | | ||
| SOURCE_IMAGE=${{ env.SOURCE_IMAGE }} | ||
| SOURCE_ORG=${{ env.SOURCE_ORG }} | ||
| BUILDER_IMAGE=${{ env.BUILDER_IMAGE }} | ||
| KERNEL_ORG=${{ github.repository_owner }} | ||
| KERNEL_FLAVOR=${{ matrix.kernel_flavor }} | ||
| KERNEL_VERSION=${{ env.KERNEL_VERSION }} | ||
| FEDORA_MAJOR_VERSION=${{ matrix.fedora_version }} | ||
| RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.