From fd385bafae4018f71134d55338c7487c7c2264f5 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 23:47:03 +0800
Subject: [PATCH] ci: install grub on the ISO builder

profiledef.sh uses uefi.grub. mkarchiso checks for grub-install on the
host before building; archiso does not pull grub, so the v0.6.0 bake
aborted after bakery staging.
---
 .forgejo/workflows/release-iso.yml | 5 ++++-
 scripts/ci-verify-bake.sh          | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/release-iso.yml b/.forgejo/workflows/release-iso.yml
index 7191c22..a30e291 100644
--- a/.forgejo/workflows/release-iso.yml
+++ b/.forgejo/workflows/release-iso.yml
@@ -41,7 +41,10 @@ jobs:
     steps:
       - name: Install build dependencies
         run: |
-          pacman -Syu --noconfirm archiso curl python git minisign
+          # grub is required by profiledef.sh bootmodes=('uefi.grub'):
+          # mkarchiso validates grub-install on the *builder*, not the image.
+          # archiso pulls syslinux/squashfs-tools/libisoburn; it does not pull grub.
+          pacman -Syu --noconfirm archiso grub curl python git minisign
 
       - name: Determine tag and version
         id: vars
diff --git a/scripts/ci-verify-bake.sh b/scripts/ci-verify-bake.sh
index 1b01cab..d02d0b0 100755
--- a/scripts/ci-verify-bake.sh
+++ b/scripts/ci-verify-bake.sh
@@ -42,6 +42,12 @@ PY
 
 echo "== lockfile $LOCKFILE =="
 echo "   ${#REQUIRED_BINS[@]} required, ${#OPTIONAL_BINS[@]} optional"
+echo "== host tools =="
+if command -v grub-install >/dev/null 2>&1; then
+  ok "grub-install (uefi.grub bootmode)"
+else
+  bad "grub-install missing — mkarchiso uefi.grub will abort (install grub on the builder)"
+fi
 echo "== builder home $LAPTOP_HOME =="
 
 check_exec() {