feat(ci): zstd:chunked push with --force-compression and bootc unified storage (#56)

* fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18)

When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk)
to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci),
the first boot fails with a black screen. Root cause: legacy-rechunk's
1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles,
but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow
from /etc/group, causing systemd-sysusers to fail on first boot:
  systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists.

The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that
rebuilds /etc/gshadow from /etc/group on every boot. The service is
idempotent and harmless once gshadow is clean.

Files added (verbatim from Aurora):
- system_files/shared/usr/bin/rechunker-group-fix
- system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service

Service enabled in build_files/base/17-cleanup.sh.

Without this fix, the first boot into projectbluefin/bluefin after
switching from ublue-os/bluefin WILL produce a black screen. Second
boot of the same image succeeds, but users will think the image is broken.

Fixes: ublue-os/bluefin#3852
See also:
- ublue-os/bluefin-lts#918 (renner0e test report)
- bootc-dev/bootc#1179
- ublue-os/aurora#1468
- https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47


Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15)

Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

* chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16)

Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

* fix(ci): add packages:write to e2e reusable workflow callers

The e2e.yml reusable workflow in projectbluefin/testsuite requires
packages:write permission to push screenshots to GHCR. Without it,
jobs fail with startup_failure before any steps run.


Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration

When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk)
to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci),
the first boot fails with a black screen. Root cause: legacy-rechunk's
1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles,
but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow
from /etc/group, causing systemd-sysusers to fail on first boot:
  systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists.

The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that
rebuilds /etc/gshadow from /etc/group on every boot. The service is
idempotent and harmless once gshadow is clean.

Files added (verbatim from Aurora):
- system_files/shared/usr/bin/rechunker-group-fix
- system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service

Service enabled in build_files/base/17-cleanup.sh.

Without this fix, the first boot into projectbluefin/bluefin after
switching from ublue-os/bluefin WILL produce a black screen. Second
boot of the same image succeeds, but users will think the image is broken.

Fixes: ublue-os/bluefin#3852
See also:
- ublue-os/bluefin-lts#918 (renner0e test report)
- bootc-dev/bootc#1179
- ublue-os/aurora#1468
- https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47


Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): update hardcoded testing branch references to main

projectbluefin/bluefin uses main as default branch, not testing.
Update build trigger, post-e2e filter, and weekly promotion workflow
to reference main instead of the ublue-os/bluefin testing branch.

Assisted-by: Claude via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): add packages:write to weekly-promotion e2e job

The reusable testsuite e2e.yml requires packages:write to push
screenshots to GHCR. Without it the job fails with startup_failure.


Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22)

Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23)

Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

* fix: resolve shellcheck warnings in rechunker-group-fix script (#25)

Rewrite the /etc/gshadow sync loop to use while-read instead of
for-in-cat (SC2013), properly quote variables (SC2086), and use
printf instead of echo with unquoted command substitution (SC2046).

Functionally identical — group names cannot contain spaces or glob
characters, but the rewrite is safer and passes shellcheck cleanly.

Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: remove stale silverblue-main entry from image-versions.yml (#26)

PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to
quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads
'common' and 'brew' entries from image-versions.yml, so the
silverblue-main entry is dead config that may cause unnecessary
Renovate PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27)

The Containerfile ARG default for IMAGE_VENDOR was still set to
'ublue-os' from the upstream fork. The Justfile correctly overrides it
to 'projectbluefin' via repo_organization, but a bare build without
Just would produce images with the wrong vendor label and ostree ref:
  ghcr.io/ublue-os/bluefin  (wrong)
  ghcr.io/projectbluefin/bluefin  (correct)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: update stale ublue-os org references to projectbluefin (#28)

Update OCI labels and admin recipe that still pointed to the old
upstream ublue-os/bluefin repository:

- io.artifacthub.package.readme-url: ublue-os → projectbluefin
- org.opencontainers.image.source: ublue-os → projectbluefin
- retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR
  instead of ublue-os

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update CONTRIBUTING.md for main-branch workflow (#29)

Replace all references to 'testing' branch with 'main' to reflect
the projectbluefin/bluefin repo structure where PRs target main.

Also update the promotion section to document the weekly automated
promotion via weekly-testing-promotion.yml instead of the old
pull-bot model.

Stream reference table updated: latest builds from 'latest' branch,
testing stream builds from 'main' branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: update offline docs PDF URL to projectbluefin/documentation (#30)

Update the bundled Bluefin documentation URL from the old
ublue-os/bluefin-docs repo (now redirects) to the canonical
projectbluefin/documentation location.

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update LTS variant link to projectbluefin/bluefin-lts (#31)

The LTS variant has moved to the projectbluefin GitHub org.
Update the Copilot instructions to reference the correct location.

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update README badges and links to projectbluefin org (#33)

- OpenSSF Scorecard badge: ublue-os → projectbluefin
- GitHub Actions CI badges: ublue-os → projectbluefin
- User count badge link target: ublue-os → projectbluefin
- DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin
- Remove stale Codacy badge (not configured for projectbluefin)

Star history, LFX, and ossinsight charts retained as-is
(historical data from the original ublue-os/bluefin repo).

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: update ublue-os org references in changelogs.py to projectbluefin (#32)

Update the changelog generation script to reference the correct org:
- REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin
- Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin
- bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin

The image-info.json path (/usr/share/ublue-os/...) is a filesystem
standard and intentionally kept as ublue-os.

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: correct stale refs in github config files (#34)

- ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main
- copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35)

The pinned commit (12bd892e) predates the canonical boot.N symlink fix
(7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator
only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments
under boot.1.1 (versioned), causing the generator to fail → dbus-broker
cascade failure → SSH never comes up.

Updated to 97be5c76 (latest main) which includes all fixes.

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): update testsuite pin to include summary error_message fix (#36)

Pins to e4dd0345 which fixes AttributeError when behave emits
error_message as a list (multi-line step errors).

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40)

Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9
which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes:
- conditional open() for Quick Settings / Date Menu panels
- qecore key mapping patch (leftctrl/leftalt/leftshift evdev names)
- multi-method app launch (gtk-launch / gio launch .desktop)
- Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it)
- nautilus --quit after Alt+F4 to close background daemon
- Notification banner JS for GNOME 50 _bannerBin API; 10s timeout
- Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration
- About page falls back to all-roles scan for system info text
- DND gsettings fallback when Shell toggle is absent
- bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM
- Wi-Fi scenario skip when no wireless interface present

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43)

Picks up PR #141 from projectbluefin/testsuite:
- nautilus AT-SPI alias (GNOME 50 name change fix)
- Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings)
- notification banner explicit dismiss fallback
- GNOME Extensions AT-SPI soft-pass for headless GNOME 50
- ujust --list tolerates just version parse errors


Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45)

Updates testsuite SHA from 7329430 to b542be5:
- Sidebar navigation roles: list item → button (GNOME 50 Nautilus)
- New custom step for breadcrumb location checks
- Extensions: multi-pattern pgrep fallback
- Notification banner: demote to warning in headless GNOME 50 QEMU

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46)

Updates testsuite SHA from b542be5 to 051e8cc:
- Downloads sidebar: revert to list item role (GNOME 50 still list item)
- Extensions: remove pgrep fallback, AT-SPI app presence is enough
- New folder / search bar: soft warnings in headless GNOME 50 QEMU

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): extend automerge to cover app/mergeraptor PRs (#51)

The renovate-automerge workflow only matched author.login == "renovate[bot]"
but mergeraptor PRs use "app/mergeraptor". This meant all mergeraptor
dependency-update PRs were silently skipped even when CI passed.

Update the jq filter to accept both bot logins.


Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(ci): push images with zstd:chunked compression

Switch podman push from default gzip to zstd:chunked compression format.
This enables seekable/chunked pulls where clients only download the file
content that actually changed between updates.

Changes:
- Add 'Update Podman' step: upgrades podman/buildah/crun/skopeo from
  Ubuntu resolute (25.04) repo because old Ubuntu 24.04 podman does not
  correctly push ostree.components layer annotations required by the
  rpm-ostree rechunker
- Add --compression-format zstd:chunked --compression-level 3 to all
  podman push commands
- Push each tag twice to ensure stable manifest digest and annotations
  (workaround for podman-container-tools/podman#27796)
- Add --retry 5 --retry-delay 30s for per-layer network resilience

Mirrored from Aurora's approach in ublue-os/aurora reusable-build.yml.

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(ci): add --force-compression and bootc unified storage

- Add --force-compression to all zstd:chunked push calls so that unchanged
  layers are re-compressed from gzip to zstd:chunked (without this flag
  podman reuses existing gzip blobs, breaking partial pull annotations)
- Add bootc-unified-storage.service: runs once on first boot to migrate
  the system to bootc-owned containers-storage via `bootc image set-unified`
  enabling zstd:chunked partial chunk pulls on future upgrades
- Enable the service in build_files/base/17-cleanup.sh

The service uses ConditionPathExists=!/var/lib/.bootc-unified-storage as a
one-shot sentinel and Restart=on-failure to retry if bootc isn't ready yet.
Feature is experimental in bootc upstream (tracking issue #20).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

* ci: trigger PR validation

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

Author: 3 people