[scanner] feat: add PXE installer support #118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build DDI artifacts | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: build-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-and-release: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 180 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref || github.ref }} | |
| repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | |
| - name: Set up just | |
| uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2 | |
| with: | |
| tool: just | |
| - name: Track and Resolve BuildStream Refs | |
| if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/') | |
| env: | |
| HEAD_REF: ${{ github.head_ref }} | |
| run: | | |
| set -euo pipefail | |
| git config --global user.name "github-actions[bot]" | |
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | |
| just bst source track freedesktop-sdk.bst || true | |
| just bst source track gnome-build-meta.bst || true | |
| if ! git diff --exit-code; then | |
| git add elements/ | |
| git commit -m "chore: resolve BuildStream junction refs to git-describe format" -m "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>" | |
| git push origin "HEAD:${HEAD_REF}" | |
| fi | |
| - name: Validate Element Graph | |
| run: just validate | |
| - name: Set up runner disk space | |
| run: | | |
| set -euo pipefail | |
| sudo mkdir -p /mnt/podman /mnt/buildstream | |
| sudo chown -R "$USER:$USER" /mnt/podman /mnt/buildstream | |
| mkdir -p ~/.config/containers | |
| cat > ~/.config/containers/storage.conf <<EOF | |
| [storage] | |
| driver = "overlay" | |
| runroot = "/run/user/1001" | |
| graphroot = "/mnt/podman" | |
| EOF | |
| mkdir -p ~/.cache | |
| ln -sf /mnt/buildstream ~/.cache/buildstream | |
| - name: Build and export DDI OS image | |
| run: | | |
| just build-ddi | |
| just export-ddi | |
| - name: Build and export live installer & target UKI | |
| run: | | |
| just build-installer | |
| just export-installer | |
| - name: Build and export k3s systemd-sysext | |
| run: | | |
| just build-sysext | |
| just export-sysext | |
| - name: Sign release SHA256SUMS manifest | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| SYSUPDATE_SIGNING_KEY: ${{ secrets.SYSUPDATE_SIGNING_KEY }} | |
| run: | | |
| set -euo pipefail | |
| # systemd-sysupdate fetches <Path>/SHA256SUMS as the version | |
| # manifest, so all release assets must share one combined, | |
| # flat manifest at the release root. | |
| mkdir -p dist/release | |
| cp dist/bluefin-server-installer-*.raw.zst dist/bluefin-server-*.efi dist/release/ | |
| cp dist/ddi/bluefin-server-ddi-*.raw.zst dist/release/ | |
| cp dist/sysext/k3s-*.raw.zst dist/release/ | |
| (cd dist/release && sha256sum --binary -- * > SHA256SUMS) | |
| GNUPGHOME=$(mktemp -d) | |
| export GNUPGHOME | |
| trap 'rm -rf "$GNUPGHOME"' EXIT | |
| echo "$SYSUPDATE_SIGNING_KEY" | gpg --batch --import | |
| gpg --batch --yes --detach-sign --armor -o dist/release/SHA256SUMS.gpg dist/release/SHA256SUMS | |
| - name: Upload assets to GitHub Release | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| V=$(just version) | |
| TAG="installer-v${V}" | |
| echo "Uploading release assets for tag: ${TAG}" | |
| gh release create "${TAG}" --title "Bluefin Server v${V}" --notes "Automated release triggered by Renovate dependency update on main" --prerelease=false || true | |
| gh release upload "${TAG}" \ | |
| dist/release/* \ | |
| --clobber | |