docs: note that tmpfiles C rules do not retighten existing machines #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bluebuild | |
| on: | |
| schedule: | |
| - cron: | |
| "00 06 * * *" # build at 06:00 UTC every day | |
| # (20 minutes after last ublue images start building) | |
| push: | |
| paths-ignore: # don't rebuild if only documentation has changed | |
| - "**.md" | |
| pull_request: | |
| workflow_dispatch: # allow manually triggering builds | |
| concurrency: | |
| # only run one build at a time | |
| group: ${{ github.workflow }}-${{ github.ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| bluebuild: | |
| name: Build Custom Image | |
| runs-on: ubuntu-latest | |
| # Bound a wedged build (e.g. a hung RPM Fusion codec mirror) so it fails fast and | |
| # can be re-run, instead of hanging up to GitHub's 6h default. | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false # stop GH from cancelling all matrix builds if one fails | |
| matrix: | |
| recipe: | |
| # !! Add your recipes here | |
| - recipe.yml | |
| steps: | |
| # the build is fully handled by the reusable github action | |
| # | |
| # Pinned to a commit SHA, not the `v1.12` tag: this step receives the cosign | |
| # signing key, and the laptop's /etc/containers/policy.json trusts whatever | |
| # that key signs (rpm-ostreed-automatic then stages it for the next boot). A | |
| # mutable tag means the action owner — or anyone who compromises that repo — | |
| # can change what runs with the key in hand. Dependabot still bumps SHA pins | |
| # and keeps the trailing version comment in sync. | |
| - name: Build Custom Image | |
| uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad # v1.12 | |
| with: | |
| recipe: ${{ matrix.recipe }} | |
| cosign_private_key: ${{ secrets.SIGNING_SECRET }} | |
| registry_token: ${{ github.token }} | |
| pr_event_number: ${{ github.event.number }} | |
| # enabled by default, disable if your image is small and you want faster builds | |
| maximize_build_space: true |