CI: stage bakery from signed stable index, drop bread-theme cargo build
The tagged ISO workflow fetched bos-settings/src/Cargo.toml from the dev branch (404 after the Tauri split) and cargo-built bread-theme. bread-theme 0.7.1 is already on the stable index. Stage required bins, units, breadhelp content, and desktop/license files from the minisign-verified index instead; optional bread-emit/module-host skip until bread publishes them. Fail the bake if a required bin is missing.
This commit is contained in:
Breadway
parent
3ab97c1634
commit
a3ead6607a
16 changed files with 687 additions and 154 deletions
|
|
@ -1,19 +1,21 @@
|
|||
name: Build and release ISO
|
||||
|
||||
# Builds the BOS ISO on the hestia self-hosted runner (native Arch container),
|
||||
# downloads all bakery ecosystem binaries from their GitHub releases, compiles
|
||||
# bread-theme from source, and uploads the resulting ISO to a Forgejo pre-release.
|
||||
# A matching GitHub release is created that points to Forgejo for the download
|
||||
# Builds the BOS ISO on the hestia self-hosted runner (native Arch container).
|
||||
# Stages bakery desktop apps from the *minisign-verified* stable index at
|
||||
# https://dl.breadway.dev/index.json (see iso/bread-lockfile.toml), then runs
|
||||
# build-local.sh and uploads the ISO to a Forgejo release. A matching GitHub
|
||||
# release is created best-effort and points at Forgejo for the download
|
||||
# (GitHub releases cannot host files larger than 2 GB).
|
||||
#
|
||||
# Required secrets:
|
||||
# RELEASE_TOKEN — Forgejo API token with write:repository scope
|
||||
# MIRROR_TOKEN — GitHub personal access token with repo scope (already used by mirror.yml)
|
||||
# MIRROR_TOKEN — GitHub personal access token with repo scope
|
||||
# GPG_PRIVATE_KEY — armoured secret key for the dedicated "BOS Release Signing"
|
||||
# identity (releases@breadway.dev); public half is committed
|
||||
# at KEYS.asc for verification. No passphrase (CI-only key,
|
||||
# access controlled via the Forgejo secret store, not a
|
||||
# passphrase nobody could type non-interactively anyway).
|
||||
# at KEYS.asc for verifying ISO SHA256SUMS only. That key
|
||||
# does not sign the [breadway] pacman repo. No passphrase
|
||||
# (CI-only key, access controlled via the Forgejo secret
|
||||
# store).
|
||||
|
||||
on:
|
||||
push:
|
||||
|
|
@ -28,6 +30,8 @@ jobs:
|
|||
release-iso:
|
||||
runs-on: [self-hosted, hestia]
|
||||
container:
|
||||
# Floating tag: this environment cannot pin a reproducible digest of
|
||||
# archlinux:latest. Do not invent one.
|
||||
image: archlinux:latest
|
||||
# --privileged: mkarchiso needs CAP_SYS_ADMIN for loop mounts + mknod
|
||||
# --network=host: gives localhost:3002 access to Forgejo (avoids the
|
||||
|
|
@ -37,7 +41,7 @@ jobs:
|
|||
steps:
|
||||
- name: Install build dependencies
|
||||
run: |
|
||||
pacman -Syu --noconfirm archiso curl python git rust
|
||||
pacman -Syu --noconfirm archiso curl python git minisign
|
||||
|
||||
- name: Determine tag and version
|
||||
id: vars
|
||||
|
|
@ -55,85 +59,17 @@ jobs:
|
|||
git clone --branch "${{ steps.vars.outputs.tag }}" --depth 1 \
|
||||
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /bos
|
||||
|
||||
- name: Download bakery ecosystem binaries
|
||||
- name: Stage bakery ecosystem from signed stable index
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p /build-home/.local/bin \
|
||||
/build-home/.local/state/bakery \
|
||||
/build-home/.cache/bakery
|
||||
cd /bos
|
||||
LAPTOP_HOME=/build-home python3 scripts/ci-stage-bakery.py
|
||||
|
||||
# Fetch the canonical bakery index
|
||||
curl -fsSL "https://dl.breadway.dev/index.json" \
|
||||
-o /build-home/.cache/bakery/index.json
|
||||
|
||||
# Download each binary from dl.breadway.dev (canonical source; github_url
|
||||
# is not always published for dev/patch releases) and generate the
|
||||
# installed.json that bakery expects in ~/.local/state.
|
||||
python3 << 'PYEOF'
|
||||
import json, urllib.request, os
|
||||
|
||||
with open('/build-home/.cache/bakery/index.json') as f:
|
||||
idx = json.load(f)
|
||||
|
||||
BIN_DIR = '/build-home/.local/bin'
|
||||
installed = {}
|
||||
|
||||
for pkg_name, pkg in idx['packages'].items():
|
||||
bins = []
|
||||
for b in pkg['binaries']:
|
||||
dest_name = b['name'].removesuffix('-x86_64')
|
||||
dest = os.path.join(BIN_DIR, dest_name)
|
||||
url = b['dl_url']
|
||||
print(f' {dest_name} <- {url}', flush=True)
|
||||
urllib.request.urlretrieve(url, dest)
|
||||
os.chmod(dest, 0o755)
|
||||
bins.append(dest_name)
|
||||
|
||||
# installed.json services field is a flat list of unit-name strings
|
||||
services = [
|
||||
(s['unit'] if isinstance(s, dict) else s)
|
||||
for s in pkg.get('services', [])
|
||||
]
|
||||
installed[pkg_name] = {
|
||||
'name': pkg_name,
|
||||
'version': pkg['version'],
|
||||
'binaries': bins,
|
||||
'services': services,
|
||||
'installed_at': '2024-01-01T00:00:00+00:00',
|
||||
}
|
||||
|
||||
with open('/build-home/.local/state/bakery/installed.json', 'w') as f:
|
||||
json.dump({'packages': installed}, f, indent=2)
|
||||
print('installed.json written', flush=True)
|
||||
PYEOF
|
||||
|
||||
- name: Build bread-theme from source
|
||||
- name: Verify staged bakery bake inputs
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# bread-theme is not in the bakery index; build it at the ref pinned
|
||||
# in bos-settings' Cargo.toml so the CLI matches the library version
|
||||
# the bos-settings package (and breadbar/breadbox/breadpad) were
|
||||
# built against. bos-settings used to live at bos-settings/Cargo.toml
|
||||
# inside this repo; it's since been split into its own repo
|
||||
# (git.breadway.dev/Breadway/bos-settings) and migrated to Tauri,
|
||||
# which moved the Rust manifest to bos-settings/src/Cargo.toml, so
|
||||
# fetch it from there. Uses bos-settings' default branch (dev) — the
|
||||
# branch its own CI actually publishes the `bos-settings` pacman
|
||||
# package from.
|
||||
REPO_OWNER="${GITHUB_REPOSITORY%%/*}"
|
||||
curl -fsSL "https://git.breadway.dev/${REPO_OWNER}/bos-settings/raw/branch/dev/src/Cargo.toml" \
|
||||
-o /tmp/bos-settings-Cargo.toml
|
||||
# bread-theme is pinned by tag once a release ships the functions
|
||||
# bos-settings needs, or by branch in the meantime — handle either.
|
||||
THEME_REF=$(grep '^bread-theme' /tmp/bos-settings-Cargo.toml \
|
||||
| grep -oP '(tag|branch)\s*=\s*"\K[^"]+')
|
||||
echo "Building bread-theme @ $THEME_REF"
|
||||
git clone --branch "$THEME_REF" --depth 1 \
|
||||
https://github.com/Breadway/bread-ecosystem /bread-ecosystem
|
||||
cd /bread-ecosystem
|
||||
cargo build --release -p bread-theme
|
||||
install -m 755 target/release/bread-theme /build-home/.local/bin/bread-theme
|
||||
echo "bread-theme built OK"
|
||||
cd /bos
|
||||
LAPTOP_HOME=/build-home bash scripts/ci-verify-bake.sh
|
||||
|
||||
- name: Build ISO
|
||||
run: |
|
||||
|
|
@ -247,9 +183,8 @@ jobs:
|
|||
gh release create "${TAG}" \
|
||||
--repo "Breadway/bos" \
|
||||
--title "BOS ${TAG}" \
|
||||
\
|
||||
--notes-file /tmp/gh-release-notes.md \
|
||||
2>/dev/null || echo "GitHub release already exists — skipping"
|
||||
|| echo "skip: GitHub release failed (MIRROR_TOKEN historically broken)"
|
||||
|
||||
# `stable` is a marker branch only — CI fast-forwards it to whatever
|
||||
# commit the latest real (non-RC) release tag points at. Never merged
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue