build-iso.yml

name: Build ISOs
on:
  pull_request:
    branches:
      - main
    paths:
      - 'iso_files/**'
  schedule:
    - cron: "0 1 2 * *" # The second of every month at 1am UTC
  merge_group:
  workflow_dispatch:
    inputs:
      upload_r2:
        description: 'Upload built ISOs to Cloudflare R2'
        required: false
        default: false
        type: boolean
      upload_artifacts:
        description: 'Upload built ISOs to GitHub Artifacts'
        required: false
        default: false
        type: boolean
      image_variant:
        description: 'Image variant to build (yellowfin, albacore, centos, fedora, all)'
        required: false
        default: 'all'
        type: choice
        options:
          - yellowfin
          - albacore
          # - skipjack
          # - bonito
          - all
      flavor:
        description: 'Flavor (base, dx, gdx)'
        required: false
        default: 'base,dx,gdx'
        type: choice
        options:
          - base
          - base,dx
          - base,dx,gdx
          - dx
          - gdx
          - dx,gdx
      platforms:
        description: 'Platforms to build'
        required: false
        default: 'default'
        type: choice
        options:
          - 'default'
          - linux/amd64
          - linux/amd64/v2
          - linux/arm64
          - linux/amd64,linux/arm64
          - linux/amd64,linux/amd64/v2,linux/arm64


concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.image_variant || 'auto' }}-${{ inputs.flavor || 'auto' }}
  cancel-in-progress: true

jobs:
  # Generate build matrix for image variants
  generate_matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout for config
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4

      - name: Generate image variant build matrix
        id: set-matrix
        run: |
          FILTER_VARIANT="${{ github.event_name == 'workflow_dispatch' && inputs.image_variant || 'all' }}"
          FILTER_PLATFORMS="${{ github.event_name == 'workflow_dispatch' && inputs.platforms || 'default' }}"

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            TAG="pr-${{ github.event.pull_request.number }}"
          elif [[ "${{ github.ref_name }}" == "main" ]]; then
            TAG="latest"
          else
            TAG="${{ github.sha }}"
          fi

          if [[ "$FILTER_VARIANT" == "all" ]]; then
            FILTER_VARIANT=""
          fi

          FULL_MATRIX=$(yq -o=json '.variants[]' .github/build-config.yml | jq -c --arg filter "$FILTER_VARIANT" --arg platforms "$FILTER_PLATFORMS" '
            select($filter == "" or .id == $filter)
            | . as $v
            | {
                variant:       $v.id,
                description:   $v.description,
                builder_distro: $v.builder_distro,
                platforms:     (if $platforms == "default" then $v.platforms else [$platforms] end)
              }
          ' | jq -c -s '.')

          FLAVORS="${{ github.event_name == 'workflow_dispatch' && inputs.flavor || 'base' }}"
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            FLAVORS="base"
            FULL_MATRIX=$(echo "$FULL_MATRIX" | jq '[.[] | select(.variant == "albacore")]')
          fi

          MATRIX="{\"include\":[]}"
          for row in $(echo "$FULL_MATRIX" | jq -r '.[] | @base64'); do
            _jq() { echo "$row" | base64 -d | jq -r "$1"; }
            image_variant=$(_jq '.variant')
            DESCRIPTION=$(_jq '.description')
            BUILDER_DISTRO=$(_jq '.builder_distro')
            PLATFORMS=$(_jq '.platforms | join(",")')

            for flavor in $(echo $FLAVORS | sed "s/,/ /g"); do
              for platform in $(echo $PLATFORMS | sed "s/,/ /g"); do
                runner_platform=$(echo $platform | cut -d'/' -f2)
                MATRIX="$(echo "${MATRIX}" | jq ".include += [{
                  \"image_variant\": \"${image_variant}\",
                  \"image_name\": \"${image_variant}\",
                  \"default_tag\": \"${TAG}\",
                  \"flavor\": \"${flavor}\",
                  \"platform\": \"${platform}\",
                  \"runner_platform\": \"${runner_platform}\",
                  \"description\": \"${DESCRIPTION}\",
                  \"builder_distro\": \"${BUILDER_DISTRO}\",
                  \"rechunk\": ${{ github.event_name != 'pull_request' }},
                  \"sbom\": false,
                  \"publish\": true,
                }]")"
              done
            done
          done
          echo "matrix=$(echo "${MATRIX}" | jq -c '.')" >> $GITHUB_OUTPUT

  build:
    name: Build ISOs
    runs-on: ${{ matrix.runner_platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
    needs: generate_matrix
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.generate_matrix.outputs.matrix) }}
    permissions:
      contents: read
      packages: read
      id-token: write

    steps:
      - name: Install dependencies
        if: matrix.platform == 'arm64'
        run: |
          set -x
          sudo apt update -y
          sudo apt install -y \
            podman

      - name: Maximize build space (remove-software)
        if: matrix.platform != 'arm64'
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
        with:
          remove-codeql: true

      - name: Maximize build space
        uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140
        continue-on-error: true
        with:
          target-dir: /var/lib/containers
          mount-opts: compress-force=zstd:2
          loopback-free: 0.9

      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v5

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Install Just via Homebrew
        run: brew install just

      - name: Check Just Syntax
        shell: bash
        run: |
          just check

      - name: get image ref
        id: get_image_ref
        shell: bash
        run: |
          if [[ "${{ matrix.flavor }}" == "base" ]]; then
            IMAGE_SUFFIX=""
          else
            IMAGE_SUFFIX="-${{ matrix.flavor }}"
          fi
          if [[ "${{ matrix.platform }}" == "linux/amd64/v2" ]]; then
            IMAGE_TAG=${{ matrix.default_tag }}-linux-amd64-v2
          else
            IMAGE_TAG=${{ matrix.default_tag }}
          fi
          UNSAFE_PLATFORM=${{ matrix.platform }}
          SAFE_PLATFORM="${UNSAFE_PLATFORM//\//-}"
          echo "safe_platform=${SAFE_PLATFORM}" >> $GITHUB_OUTPUT
          echo "image_suffix=${IMAGE_SUFFIX}" >> $GITHUB_OUTPUT
          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT


      - name: Build ISO
        id: build
        uses: hanthor/titanoboa@main
        with:
          image-ref: >-
            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}${{
            steps.get_image_ref.outputs.image_suffix }}:${{
            steps.get_image_ref.outputs.image_tag }}
          flatpaks-list: ${{ github.workspace }}/system_files/etc/ublue-os/system-flatpaks.list
          hook-post-rootfs: ${{ github.workspace }}/iso_files/configure_lts_iso_anaconda.sh
          builder-distro: ${{ matrix.builder_distro }}
          platform: ${{ matrix.platform }}

      - name: Rename ISO
        id: rename
        env:
          OUTPUT_PATH: ${{ steps.build.outputs.iso-dest }}
          FLAVOR: ${{ matrix.flavor }}
        run: |
          set -x
          mkdir -p output
          OUTPUT_DIRECTORY="$(realpath output)"
          PLATFORM_NAME="${{ steps.get_image_ref.outputs.safe_platform }}"
          PLATFORM_NAME="${PLATFORM_NAME#linux}"
          ISO_NAME="${{ matrix.image_variant }}${{ steps.get_image_ref.outputs.image_suffix }}${PLATFORM_NAME}"
          sha256sum "${OUTPUT_PATH}" | tee "${OUTPUT_DIRECTORY}/${ISO_NAME}.iso-CHECKSUM"
          mv "${OUTPUT_PATH}" "${OUTPUT_DIRECTORY}/${ISO_NAME}.iso"
          echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}"

      - name: Upload to Job Artifacts
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.upload_artifacts == 'true'
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4.3.3
        with:
          name: "${{ matrix.image_variant }}-${{ matrix.flavor }}-${{ steps.get_image_ref.outputs.safe_platform }}-${{ github.run_id }}"
          if-no-files-found: error
          path: ${{ steps.rename.outputs.output_directory }}

      - name: Upload to CloudFlare
        if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || github.event.inputs.upload_r2 == 'true')
        shell: bash
        env:
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID_2025 }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY_2025 }}
          RCLONE_CONFIG_R2_REGION: auto
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT_2025 }}
          SOURCE_DIR: ${{ steps.rename.outputs.output_directory }}
        run: |
          sudo apt-get update
          sudo apt-get install -y rclone
          rclone copy --log-level INFO --checksum --s3-no-check-bucket "${SOURCE_DIR}" R2:bluefin