Skip to content

Commit 0986b6a

Browse files
alexirialexiri
authored
Initial commit
0 parents  commit 0986b6a

File tree

20 files changed

+1491
-0
lines changed

20 files changed

+1491
-0
lines changed

‎.github/README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Purpose
2+
3+
This repository is a template repository for generating Atomic AlmaLinux respins.
4+
5+
[Create a new repository](https://github.com/new?template_name=atomic-respin-template&template_owner=AlmaLinux)
6+
using this template to get started! Once that's done, there you can follow [the instructions](/README.md) of your
7+
newly-created repository to start customizing your image.
8+
9+
# Contributing
10+
11+
We welcome contributions to all parts of the AlmaLinux project. If you'd like to get involved, please feel free to reach out through [the chat](https://chat.almalinux.org/almalinux/channels/sigatomic)!
12+
13+
## Contributing - Code and Design
14+
15+
This project is a template for starting new Atomic AlmaLinux respins.
16+
17+
Before submitting code changes, please check if there are any open issues or pull requests that cover your proposal. If not, open an issue with a brief description and so you can discuss it with us first. This helps avoid duplicated work and ensures proposed changes align with project goals. This can be your anticipated workflow:
18+
19+
- Create an issue describing your changes.
20+
- Await confirmation from contributors.
21+
- Fork the project.
22+
- Create a new branch for your feature or bug fix.
23+
- Add your code, documentation, etc.
24+
- Submit a pull request (PR). All PRs should target the `main` branch.
25+
26+
After review and approval, the changes will be merged and deployed.
27+
28+
## Reporting a Bug
29+
30+
If you find a bug, please report it [here](https://github.com/AlmaLinux/atomic-respin-template/issues)!
31+
32+
## Requesting a Feature
33+
34+
We're open to feature requests! Please follow this workflow:
35+
36+
1. [Search existing issues](https://github.com/AlmaLinux/atomic-respin-template/issues) to see if the feature has already been requested. If so, give it a thumbs up, +1, or a comment on your use-case.
37+
2. If no similar request exists, open a new issue. Please clearly explain why the feature is needed and provide a detailed use case.
38+
39+
## Change Approval Process
40+
41+
- Minor or cosmetic changes (typos, small style tweaks) can be reviewed and approved by any contributor with merge rights.
42+
- Larger changes should be agreed on as a SIG.
43+
44+
# Getting help
45+
46+
This repo is managed by the Atomic SIG. You can see how best to contact us in the [AlmaLinux wiki](https://wiki.almalinux.org/sigs/Atomic.html).

‎.github/actions/config/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
name: Set Environment Variables
3+
4+
inputs:
5+
SIGNING_SECRET:
6+
description: "The secret used for signing the image. If not provided, the image will not be signed."
7+
required: false
8+
9+
outputs:
10+
LATEST_TAG:
11+
description: "The latest tag based on the event type"
12+
value: ${{ steps.set.outputs.LATEST_TAG }}
13+
REGISTRY:
14+
description: "The container registry to use"
15+
value: ${{ steps.set.outputs.REGISTRY }}
16+
REGISTRY_USER:
17+
description: "The user for the container registry"
18+
value: ${{ steps.set.outputs.REGISTRY_USER }}
19+
PLATFORMS:
20+
description: "The platforms to build for"
21+
value: ${{ steps.set.outputs.PLATFORMS }}
22+
IMAGE_PATH:
23+
description: "The path to the image in the registry"
24+
value: ${{ steps.set.outputs.IMAGE_PATH }}
25+
IMAGE_NAME:
26+
description: "The name of the image"
27+
value: ${{ steps.set.outputs.IMAGE_NAME }}
28+
IMAGE_REF:
29+
description: "The full reference to the image in the registry"
30+
value: ${{ steps.set.outputs.IMAGE_REF }}
31+
IS_SIGNED:
32+
description: "Whether the image is signed"
33+
value: ${{ steps.set.outputs.IS_SIGNED }}
34+
35+
runs:
36+
using: "composite"
37+
steps:
38+
- name: Set environment variables
39+
id: set
40+
shell: bash
41+
run: |
42+
# Pick a latest tag based on the event type
43+
if [[ "${{ github.ref }}" != "refs/heads/${{ github.event.repository.default_branch }}" ]]; then
44+
echo "LATEST_TAG=${{ github.ref_name }}" >> $GITHUB_OUTPUT
45+
else
46+
echo "LATEST_TAG=latest" >> $GITHUB_OUTPUT
47+
fi
48+
49+
REGISTRY=ghcr.io
50+
REGISTRY_USER=${{ github.actor }}
51+
IMAGE_PATH=${{ github.repository_owner }}
52+
IMAGE_NAME=${{ github.event.repository.name }}
53+
PLATFORMS="amd64"
54+
55+
echo "REGISTRY=${REGISTRY}" >> $GITHUB_OUTPUT
56+
echo "REGISTRY_USER=${REGISTRY_USER}" >> $GITHUB_OUTPUT
57+
echo "IMAGE_PATH=${IMAGE_PATH}" >> $GITHUB_OUTPUT
58+
echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_OUTPUT
59+
echo "IMAGE_REF=${REGISTRY}/${IMAGE_PATH}/${IMAGE_NAME}" >> $GITHUB_OUTPUT
60+
echo "PLATFORMS=${PLATFORMS}" >> $GITHUB_OUTPUT
61+
62+
# This is a workaround so that the expansion of SIGNING_SECRET doesn't break the if statement
63+
SECRET=$(cat <<EOF
64+
${{ inputs.SIGNING_SECRET }}
65+
EOF
66+
)
67+
if [ -z "${SECRET}" ]; then
68+
echo "IS_SIGNED=false" >> $GITHUB_OUTPUT
69+
else
70+
echo "IS_SIGNED=true" >> $GITHUB_OUTPUT
71+
fi

‎.github/dependabot.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
# ba0fde3d-bee7-4307-b97b-17d0d20aff50
3+
version: 2
4+
updates:
5+
6+
# Maintain dependencies for GitHub Actions
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"
11+
time: "07:00"
12+
open-pull-requests-limit: 5
13+
14+
# Maintain dependencies for Docker
15+
- package-ecosystem: "docker"
16+
directory: "/"
17+
schedule:
18+
interval: "daily"
19+
time: "07:00"
20+
open-pull-requests-limit: 5
21+
ignore:
22+
- dependency-name: "*"
23+
update-types: ["version-update:semver-minor", "version-update:semver-patch"]

‎.github/workflows/auto-merge-dependabot.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Dependabot auto-approve
2+
on: pull_request_target
3+
4+
permissions:
5+
contents: write
6+
pull-requests: write
7+
8+
jobs:
9+
dependabot:
10+
runs-on: ubuntu-latest
11+
if: ${{ github.actor == 'dependabot[bot]' }}
12+
steps:
13+
- name: Dependabot metadata
14+
id: metadata
15+
uses: dependabot/fetch-metadata@v2.4.0
16+
with:
17+
github-token: "${{ secrets.GITHUB_TOKEN }}"
18+
19+
- name: Enable auto-merge for Dependabot PRs
20+
if: ${{ contains(steps.metadata.outputs.package-ecosystem, 'docker') }}
21+
run: gh pr merge --auto --merge "$PR_URL"
22+
env:
23+
PR_URL: ${{github.event.pull_request.html_url}}
24+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/build-iso.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
# ba0fde3d-bee7-4307-b97b-17d0d20aff50
3+
name: Build ISO
4+
on:
5+
workflow_dispatch:
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
9+
cancel-in-progress: true
10+
11+
jobs:
12+
set-env:
13+
if: github.repository != 'AlmaLinux/atomic-respin-template'
14+
runs-on: ubuntu-latest
15+
outputs:
16+
LATEST_TAG: ${{ steps.set.outputs.LATEST_TAG }}
17+
REGISTRY: ${{ steps.set.outputs.REGISTRY }}
18+
REGISTRY_USER: ${{ steps.set.outputs.REGISTRY_USER }}
19+
PLATFORMS: ${{ steps.set.outputs.PLATFORMS }}
20+
IMAGE_PATH: ${{ steps.set.outputs.IMAGE_PATH }}
21+
IMAGE_NAME: ${{ steps.set.outputs.IMAGE_NAME }}
22+
IMAGE_REF: ${{ steps.set.outputs.IMAGE_REF }}
23+
IS_SIGNED: ${{ steps.set.outputs.IS_SIGNED }}
24+
steps:
25+
- name: Checkout github actions
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
27+
28+
- name: Set environment variables
29+
uses: ./.github/actions/config
30+
id: set
31+
with:
32+
SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
33+
34+
build-iso:
35+
name: Build ISO
36+
needs: [set-env]
37+
uses: AlmaLinux/atomic-ci/.github/workflows/build-iso.yml@v6
38+
with:
39+
image-name: "${{ needs.set-env.outputs.IMAGE_NAME }}"
40+
image: "${{ needs.set-env.outputs.IMAGE_REF }}:${{ needs.set-env.outputs.LATEST_TAG }}"
41+
update_origin_ref: "${{ needs.set-env.outputs.IMAGE_REF }}:${{ needs.set-env.outputs.LATEST_TAG }}"
42+
update_is_signed: ${{ needs.set-env.outputs.IS_SIGNED == 'true' }}
43+
config-file: ./iso.toml
44+
platforms: ${{ needs.set-env.outputs.PLATFORMS }}
45+
REGISTRY: ${{ needs.set-env.outputs.REGISTRY }}
46+
REGISTRY_USER: ${{ needs.set-env.outputs.REGISTRY_USER }}
47+
upload-to-cloudflare: false
48+
# bucket: ${{ secrets.R2_BUCKET }}
49+
secrets:
50+
REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51+
# R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
52+
# ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
53+
# SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}

‎.github/workflows/build.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
---
2+
# ba0fde3d-bee7-4307-b97b-17d0d20aff50
3+
name: Build image
4+
on:
5+
pull_request:
6+
push:
7+
branches:
8+
- 'main'
9+
paths-ignore:
10+
- '**/README.md'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
set-env:
19+
if: github.repository != 'AlmaLinux/atomic-respin-template'
20+
runs-on: ubuntu-latest
21+
outputs:
22+
LATEST_TAG: ${{ steps.set.outputs.LATEST_TAG }}
23+
REGISTRY: ${{ steps.set.outputs.REGISTRY }}
24+
REGISTRY_USER: ${{ steps.set.outputs.REGISTRY_USER }}
25+
PLATFORMS: ${{ steps.set.outputs.PLATFORMS }}
26+
IMAGE_PATH: ${{ steps.set.outputs.IMAGE_PATH }}
27+
IMAGE_NAME: ${{ steps.set.outputs.IMAGE_NAME }}
28+
IMAGE_REF: ${{ steps.set.outputs.IMAGE_REF }}
29+
IS_SIGNED: ${{ steps.set.outputs.IS_SIGNED }}
30+
steps:
31+
- name: Checkout github actions
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
33+
34+
- name: Set environment variables
35+
uses: ./.github/actions/config
36+
id: set
37+
with:
38+
SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
39+
40+
build-image:
41+
name: Build image
42+
uses: AlmaLinux/atomic-ci/.github/workflows/build-image.yml@v6
43+
needs: set-env
44+
with:
45+
containerfile: Dockerfile
46+
image-name: "${{ needs.set-env.outputs.IMAGE_NAME }}"
47+
previous-image: "${{ needs.set-env.outputs.IMAGE_REF }}:latest"
48+
upstream-public-key: atomic-desktop.pub
49+
platforms: ${{ needs.set-env.outputs.PLATFORMS }}
50+
skip-maximize-build-space: true
51+
image-path: ${{ needs.set-env.outputs.IMAGE_PATH }}
52+
REGISTRY: ${{ needs.set-env.outputs.REGISTRY }}
53+
REGISTRY_USER: ${{ needs.set-env.outputs.REGISTRY_USER }}
54+
secrets:
55+
REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
56+
SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
57+
permissions:
58+
contents: read
59+
packages: write
60+
id-token: write
61+
62+
test-image:
63+
name: Test image
64+
runs-on: ubuntu-latest
65+
needs: [set-env, build-image]
66+
67+
env:
68+
IMAGE_REF: "${{ needs.build-image.outputs.image-ref }}@${{ needs.build-image.outputs.digest }}"
69+
70+
steps:
71+
- name: Login to Container Registry
72+
run: echo ${{ secrets.GITHUB_TOKEN }} | podman login -u ${{ needs.set-env.outputs.REGISTRY_USER }} --password-stdin ${{ needs.set-env.outputs.REGISTRY }}
73+
74+
- name: Test container
75+
run: |
76+
# Create a short script to test the image using heredoc
77+
cat << 'EOF' > /tmp/test.sh
78+
set -ex
79+
80+
cat /etc/os-release
81+
bootc -V
82+
EOF
83+
84+
podman run --rm \
85+
-v /tmp/test.sh:/tmp/test.sh \
86+
${{ env.IMAGE_REF }} \
87+
/bin/bash /tmp/test.sh
88+
89+
promote-image:
90+
name: Promote image
91+
needs: [set-env, build-image, test-image]
92+
if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
93+
uses: AlmaLinux/atomic-ci/.github/workflows/retag-image.yml@v6
94+
with:
95+
image: ${{ needs.build-image.outputs.image-ref }}@${{ needs.build-image.outputs.digest }}
96+
tag: |
97+
${{ needs.set-env.outputs.LATEST_TAG }}
98+
${{ needs.build-image.outputs.redhat-version-id }}
99+
${{ needs.build-image.outputs.version }}
100+
REGISTRY: ${{ needs.set-env.outputs.REGISTRY }}
101+
REGISTRY_USER: ${{ needs.set-env.outputs.REGISTRY_USER }}
102+
secrets:
103+
REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
104+
permissions:
105+
packages: write
106+
107+
create-release:
108+
name: Create Release
109+
needs: [set-env, build-image, test-image, promote-image]
110+
if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
111+
uses: AlmaLinux/atomic-ci/.github/workflows/create-release.yml@v6
112+
with:
113+
image-name: "${{ needs.set-env.outputs.IMAGE_NAME }}"
114+
version: ${{ needs.build-image.outputs.version }}
115+
pretty-version: ${{ needs.build-image.outputs.redhat-version-id }}
116+
latest-image-ref: "${{ needs.build-image.outputs.image-ref }}:${{ needs.set-env.outputs.LATEST_TAG }}"
117+
permissions:
118+
contents: write

‎.github/workflows/initial_setup.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
name: Initial Setup
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
start:
13+
runs-on: ubuntu-latest
14+
if: github.repository != 'AlmaLinux/atomic-respin-template'
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v4
18+
19+
- name: Run initial setup script
20+
run: |
21+
# sed -i "/if: github.repository != 'AlmaLinux\/atomic-respin-template'/d" .github/workflows/*.yml
22+
rm -rf \
23+
.github/README.md \
24+
.github/workflows/auto-merge-dependabot.yml \
25+
.github/workflows/initial_setup.yml
26+
27+
- name: Commit changes
28+
run: |
29+
git config --global user.name 'GitHub Actions'
30+
git config --global user.email 'actions@github.com'
31+
git commit -a -m "Initial setup: remove template files"
32+
git push

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cosign.key
2+
output/

0 commit comments

Comments
 (0)