bluebuild #89
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bluebuild | |
| on: | |
| schedule: | |
| - cron: | |
| "00 06 * * *" # build at 06:00 UTC every day | |
| # (20 minutes after last ublue images start building) | |
| push: | |
| paths-ignore: # don't rebuild if only documentation has changed | |
| - "**.md" | |
| pull_request: | |
| workflow_dispatch: # allow manually triggering builds | |
| concurrency: | |
| # only run one build at a time | |
| group: ${{ github.workflow }}-${{ github.ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| bluebuild: | |
| name: Build Custom Image | |
| runs-on: ubuntu-latest | |
| # Dependabot PRs do not build. The build step requires the cosign signing key | |
| # (`cosign_private_key` is a required input — blue-build's action has no | |
| # keyless/OIDC path), and the key is no longer in the Dependabot secret store, | |
| # so these runs could only fail. More to the point, we do not WANT them to | |
| # have it: a Dependabot PR bumping a third-party action would otherwise run | |
| # that new action code with the image signing key in hand, before anyone has | |
| # reviewed the bump. | |
| # | |
| # The trade: an action bump merges without a green CI build behind it. That is | |
| # acceptable because a broken build on main means only "no new image today" — | |
| # the laptop keeps running the last good signed deployment (DESIGN §5). | |
| if: github.actor != 'dependabot[bot]' | |
| # Bound a wedged build (e.g. a hung RPM Fusion codec mirror) so it fails fast and | |
| # can be re-run, instead of hanging up to GitHub's 6h default. | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false # stop GH from cancelling all matrix builds if one fails | |
| matrix: | |
| recipe: | |
| # !! Add your recipes here | |
| - recipe.yml | |
| steps: | |
| # the build is fully handled by the reusable github action | |
| # | |
| # Pinned to a commit SHA, not the `v1.12` tag: this step receives the cosign | |
| # signing key, and the laptop's /etc/containers/policy.json trusts whatever | |
| # that key signs (rpm-ostreed-automatic then stages it for the next boot). A | |
| # mutable tag means the action owner — or anyone who compromises that repo — | |
| # can change what runs with the key in hand. Dependabot still bumps SHA pins | |
| # and keeps the trailing version comment in sync. | |
| - name: Build Custom Image | |
| uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad # v1.12 | |
| with: | |
| recipe: ${{ matrix.recipe }} | |
| cosign_private_key: ${{ secrets.SIGNING_SECRET }} | |
| registry_token: ${{ github.token }} | |
| pr_event_number: ${{ github.event.number }} | |
| # enabled by default, disable if your image is small and you want faster builds | |
| maximize_build_space: true |