277 lines
11 KiB
YAML
277 lines
11 KiB
YAML
name: Automated Arch ISO Build
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 1 * *" # Runs monthly on the 1st day of the month
|
|
workflow_dispatch: # Allows manual triggers (multiple times a month)
|
|
|
|
concurrency:
|
|
group: iso-build
|
|
cancel-in-progress: false # Never kill a build that is mid-flight
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: archlinux
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup local AUR repo
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/localrepo
|
|
cp localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files* /tmp/localrepo/
|
|
sed -i 's|file:///home/alvin/AlvinArch/localrepo|file:///tmp/localrepo|' pacman.conf
|
|
|
|
- name: Install archiso and dependencies
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Syu --noconfirm --needed archiso jq
|
|
|
|
- name: Ensure /dev/stdin exists for mkinitcpio
|
|
run: |
|
|
set -euo pipefail
|
|
# Docker/container environments may lack /dev/stdin; mkinitcpio needs it
|
|
[ -e /dev/stdin ] || ln -sf /proc/self/fd/0 /dev/stdin
|
|
[ -e /dev/stdout ] || ln -sf /proc/self/fd/1 /dev/stdout
|
|
[ -e /dev/stderr ] || ln -sf /proc/self/fd/2 /dev/stderr
|
|
|
|
- name: Build Arch ISO
|
|
run: |
|
|
set -euo pipefail
|
|
# Clean up immediately even if this step is interrupted (cancel/exit):
|
|
# unmount leftovers first, then remove the multi-GB work dir.
|
|
trap 'umount -R "$PWD/work" 2>/dev/null || true; rm -rf "$PWD/work"' EXIT HUP INT TERM
|
|
rm -rf "$PWD/work"
|
|
# Always start from an empty out dir so stale ISOs are never re-uploaded
|
|
rm -rf "$PWD/out"
|
|
mkdir -p "$PWD/out"
|
|
mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"
|
|
|
|
- name: Generate Unique Dynamic Tag
|
|
id: tag
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$GITEA_TOKEN"
|
|
|
|
# Pre-flight: confirm the internal Gitea API is reachable so failures are clear
|
|
if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
|
|
echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
|
|
exit 1
|
|
fi
|
|
|
|
BASE_DATE=$(date -u +'%Y.%m.%d')
|
|
REVISION=1
|
|
TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
|
|
|
|
# Check if the tag already exists via Gitea API, increment revision loop if it does
|
|
while curl -sf -o /dev/null -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/tags/$TAG_NAME"; do
|
|
REVISION=$((REVISION + 1))
|
|
TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
|
|
done
|
|
|
|
echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "release_name=Arch Linux ISO (${BASE_DATE} Rev ${REVISION})" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create Release and Upload ISO
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
# Use internal Gitea URL to bypass traefik proxy timeout on large uploads
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
TAG_NAME: ${{ steps.tag.outputs.tag_name }}
|
|
RELEASE_NAME: ${{ steps.tag.outputs.release_name }}
|
|
run: |
|
|
set -eu
|
|
shopt -s nullglob
|
|
tmpdir=$(mktemp -d)
|
|
trap 'rm -rf "$tmpdir"' EXIT
|
|
if [ -z "$GITEA_TOKEN" ]; then
|
|
echo "❌ GITEA_TOKEN is empty" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "$TAG_NAME" ]; then
|
|
echo "❌ TAG_NAME is empty" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "$RELEASE_NAME" ]; then
|
|
echo "❌ RELEASE_NAME is empty" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Pre-flight: confirm the internal Gitea API is reachable so failures are clear
|
|
if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
|
|
echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Collect the ISOs produced by the build and record SHA-256
|
|
isos=(out/*.iso)
|
|
if (( ${#isos[@]} == 0 )); then
|
|
echo "❌ No ISO found in out/ — nothing to upload, aborting." >&2
|
|
exit 1
|
|
fi
|
|
|
|
sha256sums=()
|
|
for iso in "${isos[@]}"; do
|
|
fname=$(basename "$iso")
|
|
size=$(stat -c %s "$iso")
|
|
# Sanity check: a real ISO is multi-GB; anything tiny is the wrong file
|
|
if (( size < 100000000 )); then
|
|
echo "❌ '$iso' is only $size bytes — refusing to upload (not an ISO)." >&2
|
|
exit 1
|
|
fi
|
|
sha=$(sha256sum "$iso" | awk '{print $1}')
|
|
if [ -z "$sha" ]; then
|
|
echo "❌ Failed to compute SHA-256 for '$iso'" >&2
|
|
exit 1
|
|
fi
|
|
echo " ✅ $fname: $(( size / 1024 / 1024 )) MiB, sha256=$sha"
|
|
sha256sums+=("$sha")
|
|
done
|
|
|
|
# Build the release body with SHA-256 checksums
|
|
printf -v body 'Arch Linux live ISO %s\n\nChecksums (SHA-256):\n' "$RELEASE_NAME"
|
|
for i in "${!isos[@]}"; do
|
|
printf -v line -- '- `%s`: sha256 `%s`\n' "$(basename "${isos[$i]}")" "${sha256sums[$i]}"
|
|
body+="$line"
|
|
done
|
|
|
|
# Create the release (curl result written to a file, checked with if)
|
|
payload=$(jq -nc --arg tag "$TAG_NAME" --arg name "$RELEASE_NAME" --arg body "$body" \
|
|
'{tag_name:$tag,name:$name,body:$body}')
|
|
if ! curl -sf -X POST \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases" \
|
|
-d "$payload" -o "$tmpdir/release.json"; then
|
|
echo "❌ Failed to create release $TAG_NAME" >&2
|
|
exit 1
|
|
fi
|
|
if ! RELEASE_ID=$(jq -er '.id' "$tmpdir/release.json"); then
|
|
echo "❌ Release response contained no id" >&2
|
|
exit 1
|
|
fi
|
|
echo " ✅ Created release $TAG_NAME (ID: $RELEASE_ID)"
|
|
|
|
# Upload each ISO as a release asset, up to 3 attempts per file
|
|
MAX_ATTEMPTS=3
|
|
for i in "${!isos[@]}"; do
|
|
iso=${isos[$i]}
|
|
fname=$(basename "$iso")
|
|
size=$(stat -c %s "$iso")
|
|
echo "Uploading $fname ($(( size / 1024 / 1024 )) MiB) to release $TAG_NAME..."
|
|
uploaded=0
|
|
attempt=1
|
|
while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
|
|
# A previous attempt may have saved the asset but lost the
|
|
# response; Gitea rejects duplicate names, so only after the
|
|
# first attempt check for and remove same-name leftovers
|
|
if [ "$attempt" -gt 1 ]; then
|
|
if curl -sf -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
|
|
-o "$tmpdir/assets.json"; then
|
|
asset_ids=$(jq -r --arg name "$fname" \
|
|
'.[] | select(.name == $name) | .id' "$tmpdir/assets.json")
|
|
while read -r asset_id; do
|
|
if [ -n "$asset_id" ]; then
|
|
echo " ↻ Removing leftover asset id=$asset_id from a previous attempt"
|
|
if ! curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets/$asset_id" \
|
|
-o /dev/null; then
|
|
echo " ⚠️ Could not remove leftover asset id=$asset_id (continuing)" >&2
|
|
fi
|
|
fi
|
|
done <<< "$asset_ids"
|
|
fi
|
|
fi
|
|
|
|
if curl -sf -X POST --max-time 600 \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-F "attachment=@$iso" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
|
|
-o "$tmpdir/upload.json"; then
|
|
if download_url=$(jq -er '.browser_download_url' "$tmpdir/upload.json"); then
|
|
echo " ✅ Uploaded $fname (attempt $attempt/$MAX_ATTEMPTS): $download_url"
|
|
uploaded=1
|
|
break
|
|
fi
|
|
echo " ⚠️ Upload of $fname returned no download URL (attempt $attempt/$MAX_ATTEMPTS)" >&2
|
|
else
|
|
echo " ⚠️ Upload of $fname failed (attempt $attempt/$MAX_ATTEMPTS)" >&2
|
|
fi
|
|
|
|
if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
|
|
sleep $(( attempt * 10 ))
|
|
fi
|
|
attempt=$(( attempt + 1 ))
|
|
done
|
|
|
|
if [ "$uploaded" -ne 1 ]; then
|
|
echo "❌ Failed to upload $fname after $MAX_ATTEMPTS attempts — aborting." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "✅ All ISOs uploaded to release $TAG_NAME"
|
|
exit 0
|
|
|
|
- name: Keep only latest 2 releases
|
|
if: success()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$GITEA_TOKEN"
|
|
|
|
echo "Pruning old releases in $REPOSITORY..."
|
|
readarray -t ids < <(curl -sf -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases" \
|
|
| jq -er 'sort_by(.created_at) | .[].id')
|
|
|
|
to_delete=$(( ${#ids[@]} - 2 ))
|
|
if (( to_delete > 0 )); then
|
|
for ((i = 0; i < to_delete; i++)); do
|
|
id=${ids[$i]}
|
|
echo "Deleting old release ID: $id"
|
|
curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$id"
|
|
done
|
|
fi
|
|
|
|
- name: Cleanup mkarchiso mounts and workdirs
|
|
if: always() # Runs on success, failure, or cancellation
|
|
run: |
|
|
set -eu
|
|
# Steps run as root (pacman is used directly); fall back to sudo if not
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
PRIV=""
|
|
else
|
|
PRIV="sudo"
|
|
fi
|
|
|
|
# Unmount any leftover loop devices or bind mounts in the work directory
|
|
$PRIV umount -R "$PWD/work" 2>/dev/null || true
|
|
|
|
# Clean up loop devices if any remain attached to the work dir
|
|
$PRIV losetup -D || true
|
|
|
|
# Remove working directories with proper permissions
|
|
$PRIV rm -rf "$PWD/work"
|
|
|
|
- name: Remove built ISO
|
|
if: always()
|
|
run: |
|
|
set -eu
|
|
rm -rf "$PWD/out"
|