alvinlollo
9614192416
Tests / tests (push) Successful in 2m34s
The GITEA_TOKEN lacks 'lfs' scope, causing the LFS batch API to reject uploads. Upload .zst files directly as release assets via the Gitea API instead. This eliminates git-lfs, the separate releases repo, and all LFS-related plumbing.
212 lines
7.9 KiB
YAML
212 lines
7.9 KiB
YAML
name: Automated Arch ISO Build
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 1 * *" # Runs monthly on the 1st day of the month
|
|
workflow_dispatch: # Allows manual triggers (multiple times a month)
|
|
|
|
concurrency:
|
|
group: iso-build
|
|
cancel-in-progress: false # Never kill a build that is mid-flight
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: archlinux
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup local AUR repo
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/localrepo
|
|
cp localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files* /tmp/localrepo/
|
|
sed -i 's|file:///home/alvin/alvinarch/localrepo|file:///tmp/localrepo|' pacman.conf
|
|
|
|
- name: Install archiso and dependencies
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Syu --noconfirm --needed archiso jq zstd
|
|
|
|
- name: Ensure /dev/stdin exists for mkinitcpio
|
|
run: |
|
|
set -euo pipefail
|
|
# Docker/container environments may lack /dev/stdin; mkinitcpio needs it
|
|
[ -e /dev/stdin ] || ln -sf /proc/self/fd/0 /dev/stdin
|
|
[ -e /dev/stdout ] || ln -sf /proc/self/fd/1 /dev/stdout
|
|
[ -e /dev/stderr ] || ln -sf /proc/self/fd/2 /dev/stderr
|
|
|
|
- name: Build Arch ISO
|
|
run: |
|
|
set -euo pipefail
|
|
# Clean up immediately even if this step is interrupted (cancel/exit):
|
|
# unmount leftovers first, then remove the multi-GB work dir.
|
|
trap 'umount -R "$PWD/work" 2>/dev/null || true; rm -rf "$PWD/work"' EXIT HUP INT TERM
|
|
rm -rf "$PWD/work"
|
|
# Always start from an empty out dir so stale ISOs are never re-uploaded
|
|
rm -rf "$PWD/out"
|
|
mkdir -p "$PWD/out"
|
|
mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"
|
|
|
|
- name: Generate Unique Dynamic Tag
|
|
id: tag
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$GITEA_TOKEN"
|
|
|
|
# Pre-flight: confirm the internal Gitea API is reachable so failures are clear
|
|
if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
|
|
echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
|
|
exit 1
|
|
fi
|
|
|
|
BASE_DATE=$(date -u +'%Y.%m.%d')
|
|
REVISION=1
|
|
TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
|
|
|
|
# Check if the tag already exists via Gitea API, increment revision loop if it does
|
|
while curl -sf -o /dev/null -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/tags/$TAG_NAME"; do
|
|
REVISION=$((REVISION + 1))
|
|
TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
|
|
done
|
|
|
|
echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "release_name=Arch Linux ISO (${BASE_DATE} Rev ${REVISION})" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create Release and Upload ISO
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
# Use internal Gitea URL to bypass traefik proxy timeout on large uploads
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
TAG_NAME: ${{ steps.tag.outputs.tag_name }}
|
|
RELEASE_NAME: ${{ steps.tag.outputs.release_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
test -n "$GITEA_TOKEN"
|
|
test -n "$TAG_NAME"
|
|
test -n "$RELEASE_NAME"
|
|
|
|
# Pre-flight: confirm the internal Gitea API is reachable so failures are clear
|
|
if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
|
|
echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Collect the ISOs produced by the build
|
|
isos=(out/*.iso)
|
|
if (( ${#isos[@]} == 0 )); then
|
|
echo "❌ No ISO found in out/ — nothing to upload, aborting." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Compress each ISO with zstd and record its SHA-256
|
|
zst_files=()
|
|
sha256sums=()
|
|
for iso in "${isos[@]}"; do
|
|
fname=$(basename "$iso")
|
|
size=$(stat -c %s "$iso")
|
|
# Sanity check: a real ISO is multi-GB; anything tiny is the wrong file
|
|
if (( size < 100000000 )); then
|
|
echo "❌ '$iso' is only $size bytes — refusing to upload (not an ISO)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Compressing $fname ($(( size / 1024 / 1024 )) MiB) with zstd..."
|
|
zstd -T0 -19 -f "$iso" -o "$iso.zst" --rm
|
|
sha=$(sha256sum "$iso.zst" | awk '{print $1}')
|
|
echo " ✅ ${fname}.zst: $(( $(stat -c %s "$iso.zst") / 1024 / 1024 )) MiB, sha256=$sha"
|
|
zst_files+=("$iso.zst")
|
|
sha256sums+=("$sha")
|
|
done
|
|
|
|
# Build the release body with SHA-256 checksums
|
|
printf -v body 'Arch Linux live ISO %s\n\nChecksums (SHA-256):\n' "$RELEASE_NAME"
|
|
for i in "${!zst_files[@]}"; do
|
|
printf -v line -- '- `%s`: sha256 `%s`\n' "$(basename "${zst_files[$i]}")" "${sha256sums[$i]}"
|
|
body+="$line"
|
|
done
|
|
|
|
# Create the release
|
|
payload=$(jq -nc --arg tag "$TAG_NAME" --arg name "$RELEASE_NAME" --arg body "$body" \
|
|
'{tag_name:$tag,name:$name,body:$body}')
|
|
RELEASE_ID=$(curl -sf -X POST \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases" \
|
|
-d "$payload" | jq -er '.id')
|
|
echo " ✅ Created release $TAG_NAME (ID: $RELEASE_ID)"
|
|
|
|
# Upload each .zst file as a release asset
|
|
for i in "${!zst_files[@]}"; do
|
|
fname=$(basename "${zst_files[$i]}")
|
|
size=$(stat -c %s "${zst_files[$i]}")
|
|
echo "Uploading $fname ($(( size / 1024 / 1024 )) MiB) to release $TAG_NAME..."
|
|
curl -sf -X POST \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-F "attachment=@${zst_files[$i]}" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" | jq -er '.browser_download_url'
|
|
echo " ✅ Uploaded $fname"
|
|
done
|
|
|
|
- name: Keep only latest 2 releases
|
|
if: success()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_API: http://192.168.1.168:3000/api/v1
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$GITEA_TOKEN"
|
|
|
|
echo "Pruning old releases in $REPOSITORY..."
|
|
readarray -t ids < <(curl -sf -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases" \
|
|
| jq -er 'sort_by(.created_at) | .[].id')
|
|
|
|
to_delete=$(( ${#ids[@]} - 2 ))
|
|
if (( to_delete > 0 )); then
|
|
for ((i = 0; i < to_delete; i++)); do
|
|
id=${ids[$i]}
|
|
echo "Deleting old release ID: $id"
|
|
curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
|
|
"$GITEA_API/repos/$REPOSITORY/releases/$id"
|
|
done
|
|
fi
|
|
|
|
- name: Cleanup mkarchiso mounts and workdirs
|
|
if: always() # Runs on success, failure, or cancellation
|
|
run: |
|
|
set -eu
|
|
# Steps run as root (pacman is used directly); fall back to sudo if not
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
PRIV=""
|
|
else
|
|
PRIV="sudo"
|
|
fi
|
|
|
|
# Unmount any leftover loop devices or bind mounts in the work directory
|
|
$PRIV umount -R "$PWD/work" 2>/dev/null || true
|
|
|
|
# Clean up loop devices if any remain attached to the work dir
|
|
$PRIV losetup -D || true
|
|
|
|
# Remove working directories with proper permissions
|
|
$PRIV rm -rf "$PWD/work"
|
|
|
|
- name: Remove built ISO
|
|
if: always()
|
|
run: |
|
|
set -eu
|
|
rm -rf "$PWD/out"
|
|
|