cd5bf1b546
- release-iso.yml's "Build bread-theme from source" step grepped
bos-settings/Cargo.toml for the bread-theme tag pin, but bos-settings was
split out into its own repo (git.breadway.dev/Breadway/bos-settings) --
that path no longer exists in this checkout, so the grep would fail (or
silently find nothing). Now fetches bos-settings' Cargo.toml directly from
its own repo (dev branch, the one its own CI actually publishes the
bos-settings pacman package from) via the Forgejo raw-file endpoint.
- calamares.yml cloned the repo's default branch instead of the branch/tag
that actually triggered the run -- bibata.yml, powerlevel10k.yml, and
yay-bin.yml (the other in-house-PKGBUILD workflows in this same family)
all correctly clone --branch "${GITHUB_REF_NAME}". Brought calamares.yml
in line with them.
- breadhelp-tour.lua interpolated an untrusted, client-controlled Wayland
window class / layer-shell namespace directly into a bread.exec shell
command string -- a session-level shell injection vector (verified
exploitable with a crafted window class before this fix, e.g.
"evil; touch ~/pwned #"). bread.exec only accepts a single shell string
(always run via `sh -lc`, per breadd/src/lua/mod.rs) -- there's no
array-exec form to bypass the shell with -- so the fix is a proper POSIX
shell_quote() helper wrapping every interpolated value in single quotes
before it reaches bread.exec.
249 lines
11 KiB
YAML
249 lines
11 KiB
YAML
name: Build and release ISO
|
|
|
|
# Builds the BOS ISO on the hestia self-hosted runner (native Arch container),
|
|
# downloads all bakery ecosystem binaries from their GitHub releases, compiles
|
|
# bread-theme from source, and uploads the resulting ISO to a Forgejo pre-release.
|
|
# A matching GitHub release is created that points to Forgejo for the download
|
|
# (GitHub releases cannot host files larger than 2 GB).
|
|
#
|
|
# Required secrets:
|
|
# RELEASE_TOKEN — Forgejo API token with write:repository scope
|
|
# MIRROR_TOKEN — GitHub personal access token with repo scope (already used by mirror.yml)
|
|
# GPG_PRIVATE_KEY — armoured secret key for the dedicated "BOS Release Signing"
|
|
# identity (releases@breadway.dev); public half is committed
|
|
# at KEYS.asc for verification. No passphrase (CI-only key,
|
|
# access controlled via the Forgejo secret store, not a
|
|
# passphrase nobody could type non-interactively anyway).
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Git tag to build (e.g. v0.4.0)'
|
|
required: true
|
|
|
|
jobs:
|
|
release-iso:
|
|
runs-on: [self-hosted, hestia]
|
|
container:
|
|
image: archlinux:latest
|
|
# --privileged: mkarchiso needs CAP_SYS_ADMIN for loop mounts + mknod
|
|
# --network=host: gives localhost:3002 access to Forgejo (avoids the
|
|
# public git.breadway.dev → Aegis → Tailscale round-trip for pacman)
|
|
options: --privileged --network=host
|
|
|
|
steps:
|
|
- name: Install build dependencies
|
|
run: |
|
|
pacman -Syu --noconfirm archiso curl python git rust
|
|
|
|
- name: Determine tag and version
|
|
id: vars
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
TAG="${{ github.event.inputs.tag }}"
|
|
else
|
|
TAG="${{ github.ref_name }}"
|
|
fi
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Clone repository at tag
|
|
run: |
|
|
git clone --branch "${{ steps.vars.outputs.tag }}" --depth 1 \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /bos
|
|
|
|
- name: Download bakery ecosystem binaries
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /build-home/.local/bin \
|
|
/build-home/.local/state/bakery \
|
|
/build-home/.cache/bakery
|
|
|
|
# Fetch the canonical bakery index
|
|
curl -fsSL "https://dl.breadway.dev/index.json" \
|
|
-o /build-home/.cache/bakery/index.json
|
|
|
|
# Download each binary from dl.breadway.dev (canonical source; github_url
|
|
# is not always published for dev/patch releases) and generate the
|
|
# installed.json that bakery expects in ~/.local/state.
|
|
python3 << 'PYEOF'
|
|
import json, urllib.request, os
|
|
|
|
with open('/build-home/.cache/bakery/index.json') as f:
|
|
idx = json.load(f)
|
|
|
|
BIN_DIR = '/build-home/.local/bin'
|
|
installed = {}
|
|
|
|
for pkg_name, pkg in idx['packages'].items():
|
|
bins = []
|
|
for b in pkg['binaries']:
|
|
dest_name = b['name'].removesuffix('-x86_64')
|
|
dest = os.path.join(BIN_DIR, dest_name)
|
|
url = b['dl_url']
|
|
print(f' {dest_name} <- {url}', flush=True)
|
|
urllib.request.urlretrieve(url, dest)
|
|
os.chmod(dest, 0o755)
|
|
bins.append(dest_name)
|
|
|
|
# installed.json services field is a flat list of unit-name strings
|
|
services = [
|
|
(s['unit'] if isinstance(s, dict) else s)
|
|
for s in pkg.get('services', [])
|
|
]
|
|
installed[pkg_name] = {
|
|
'name': pkg_name,
|
|
'version': pkg['version'],
|
|
'binaries': bins,
|
|
'services': services,
|
|
'installed_at': '2024-01-01T00:00:00+00:00',
|
|
}
|
|
|
|
with open('/build-home/.local/state/bakery/installed.json', 'w') as f:
|
|
json.dump({'packages': installed}, f, indent=2)
|
|
print('installed.json written', flush=True)
|
|
PYEOF
|
|
|
|
- name: Build bread-theme from source
|
|
run: |
|
|
set -euo pipefail
|
|
# bread-theme is not in the bakery index; build it at the tag pinned
|
|
# in bos-settings' Cargo.toml so the CLI matches the library version
|
|
# the bos-settings package (and breadbar/breadbox/breadpad) were
|
|
# built against. bos-settings used to live at bos-settings/Cargo.toml
|
|
# inside this repo; it's since been split into its own repo
|
|
# (git.breadway.dev/Breadway/bos-settings), so fetch its Cargo.toml
|
|
# from there instead of a path that no longer exists in this
|
|
# checkout. Uses bos-settings' default branch (dev) — the branch its
|
|
# own CI actually publishes the `bos-settings` pacman package from.
|
|
REPO_OWNER="${GITHUB_REPOSITORY%%/*}"
|
|
curl -fsSL "https://git.breadway.dev/${REPO_OWNER}/bos-settings/raw/branch/dev/Cargo.toml" \
|
|
-o /tmp/bos-settings-Cargo.toml
|
|
THEME_TAG=$(grep 'bread-theme.*tag' /tmp/bos-settings-Cargo.toml \
|
|
| grep -oP '"v[^"]+"' | tr -d '"')
|
|
echo "Building bread-theme @ $THEME_TAG"
|
|
git clone --branch "$THEME_TAG" --depth 1 \
|
|
https://github.com/Breadway/bread-ecosystem /bread-ecosystem
|
|
cd /bread-ecosystem
|
|
cargo build --release -p bread-theme
|
|
install -m 755 target/release/bread-theme /build-home/.local/bin/bread-theme
|
|
echo "bread-theme built OK"
|
|
|
|
- name: Build ISO
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /bos-work /bos-out
|
|
cd /bos
|
|
LAPTOP_HOME=/build-home \
|
|
WORK=/bos-work \
|
|
OUT=/bos-out \
|
|
CI_BUILD=1 \
|
|
bash build-local.sh
|
|
ls -lh /bos-out/*.iso
|
|
|
|
- name: Checksum and sign
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${{ steps.vars.outputs.version }}"
|
|
ISO=$(ls /bos-out/*.iso | head -1)
|
|
ISO_NAME="bos-${VERSION}-x86_64.iso"
|
|
cd /bos-out
|
|
mv "$(basename "$ISO")" "$ISO_NAME"
|
|
|
|
sha256sum "$ISO_NAME" > SHA256SUMS
|
|
cat SHA256SUMS
|
|
|
|
pacman -S --noconfirm --needed gnupg
|
|
export GNUPGHOME=/tmp/gnupg-release
|
|
mkdir -m 700 -p "$GNUPGHOME"
|
|
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
gpg --batch --yes --local-user releases@breadway.dev \
|
|
--detach-sign --armor -o SHA256SUMS.asc SHA256SUMS
|
|
echo "Signed SHA256SUMS -> SHA256SUMS.asc"
|
|
|
|
- name: Create Forgejo release and upload assets
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
TAG="${{ steps.vars.outputs.tag }}"
|
|
VERSION="${{ steps.vars.outputs.version }}"
|
|
ISO_NAME="bos-${VERSION}-x86_64.iso"
|
|
|
|
# Use an existing release for this tag if one exists (e.g. created
|
|
# manually or by a prior re-run), otherwise create a fresh one.
|
|
EXISTING=$(curl -sf \
|
|
-H "Authorization: token ${FORGEJO_TOKEN}" \
|
|
"http://localhost:3002/api/v1/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
|
|
2>/dev/null || true)
|
|
RELEASE_ID=$(echo "${EXISTING}" | python3 -c \
|
|
"import json,sys; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || true)
|
|
|
|
if [ -z "${RELEASE_ID}" ]; then
|
|
RELEASE=$(curl -fsS -X POST \
|
|
-H "Authorization: token ${FORGEJO_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
"http://localhost:3002/api/v1/repos/${GITHUB_REPOSITORY}/releases" \
|
|
-d "{
|
|
\"tag_name\": \"${TAG}\",
|
|
\"name\": \"BOS ${TAG}\",
|
|
\"prerelease\": false,
|
|
\"body\": \"ISO image attached below. Verify with SHA256SUMS + SHA256SUMS.asc (signed by the BOS Release Signing key — see KEYS.asc in the repo).\\n\\nSee the [README](https://github.com/Breadway/bos#testing-in-a-vm) for VM testing instructions.\"
|
|
}")
|
|
RELEASE_ID=$(echo "${RELEASE}" | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
|
|
fi
|
|
echo "Using release ID: ${RELEASE_ID}"
|
|
|
|
upload_asset() {
|
|
local file="$1" name
|
|
name="$(basename "$file")"
|
|
local asset_id
|
|
asset_id=$(curl -sf \
|
|
-H "Authorization: token ${FORGEJO_TOKEN}" \
|
|
"http://localhost:3002/api/v1/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets" \
|
|
| python3 -c "
|
|
import json,sys
|
|
assets=json.load(sys.stdin)
|
|
match=[a['id'] for a in assets if a['name']=='${name}']
|
|
print(match[0] if match else '')
|
|
" 2>/dev/null || true)
|
|
if [ -n "${asset_id}" ]; then
|
|
curl -fsS -X DELETE \
|
|
-H "Authorization: token ${FORGEJO_TOKEN}" \
|
|
"http://localhost:3002/api/v1/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets/${asset_id}"
|
|
echo "Removed existing ${name} asset"
|
|
fi
|
|
curl -fsS -X POST \
|
|
-H "Authorization: token ${FORGEJO_TOKEN}" \
|
|
-F "attachment=@${file};filename=${name}" \
|
|
"http://localhost:3002/api/v1/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets"
|
|
echo "Uploaded: ${name}"
|
|
}
|
|
|
|
upload_asset "/bos-out/${ISO_NAME}"
|
|
upload_asset "/bos-out/SHA256SUMS"
|
|
upload_asset "/bos-out/SHA256SUMS.asc"
|
|
|
|
- name: Create GitHub release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.MIRROR_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
TAG="${{ steps.vars.outputs.tag }}"
|
|
VERSION="${{ steps.vars.outputs.version }}"
|
|
FORGEJO_URL="https://git.breadway.dev/${GITHUB_REPOSITORY}/releases/tag/${TAG}"
|
|
|
|
printf '**Download ISO:** %s\n\nGitHub releases cannot host files >2 GB; the `bos-%s-x86_64.iso` (~2.5 GB), SHA256SUMS, and SHA256SUMS.asc (signed by the BOS Release Signing key — public half at [KEYS.asc](https://github.com/Breadway/bos/blob/main/KEYS.asc)) are all on Forgejo.\n\nSee the [README](https://github.com/Breadway/bos#testing-in-a-vm) for VM testing instructions.' \
|
|
"${FORGEJO_URL}" "${VERSION}" > /tmp/gh-release-notes.md
|
|
|
|
gh release create "${TAG}" \
|
|
--repo "Breadway/bos" \
|
|
--title "BOS ${TAG}" \
|
|
\
|
|
--notes-file /tmp/gh-release-notes.md \
|
|
2>/dev/null || echo "GitHub release already exists — skipping"
|