feat: move base image to quay.io/fedora-ostree-desktops/silverblue

.github/renovate.json5

@@ -3,7 +3,7 @@
   "extends": [
     "config:best-practices",
   ],
-  "baseBranches": ["main"],
+  "baseBranchPatterns": ["main"],
 
   "git-submodules": {
     "enabled": true
@@ -67,9 +67,14 @@
       "automerge": true,
       "matchUpdateTypes": ["digest"],
       "matchDepNames": [
-        "ghcr.io/ublue-os/silverblue-main"
+        "quay.io/fedora-ostree-desktops/silverblue"
       ]
     },
+    {
+      "matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
     {
       "matchDepTypes": ["gnome-extension"],
       "matchPackageNames": ["micheleg/dash-to-dock"],

.github/workflows/build-images.yml

@@ -16,6 +16,3 @@ jobs:
     build-image-latest-main:
         uses: ./.github/workflows/build-image-latest-main.yml
         secrets: inherit
-    build-image-beta:
-        uses: ./.github/workflows/build-image-beta.yml
-        secrets: inherit

.github/workflows/e2e-dispatch.yml

@@ -71,9 +71,11 @@ jobs:
           SHA=$(echo "$PR_DATA" | jq -r '.sha')
           BRANCH=$(echo "$PR_DATA" | jq -r '.branch')
           SHORT_SHA="${SHA:0:7}"
-          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
-          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
-          echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
+          {
+            echo "sha=${SHA}"
+            echo "short_sha=${SHORT_SHA}"
+            echo "branch=${BRANCH}"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Trigger PR build
         if: steps.permission.outputs.authorized == 'true'

.github/workflows/generate-release.yml

@@ -55,8 +55,10 @@ jobs:
         run: |
           just changelogs "${{ matrix.version }}" "${{ inputs.handwritten }}"
           source ./output.env
-          echo "title=${TITLE}" >> $GITHUB_OUTPUT
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          {
+            echo "title=${TITLE}"
+            echo "tag=${TAG}"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Download SBOM release assets
         if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name))

.github/workflows/reusable-build.yml

@@ -12,7 +12,6 @@ on:
         type: string
       brand_name:
         description: "The Brand Name: bluefin"
-        required: true
         default: bluefin
         type: string
       stream_name:
@@ -84,7 +83,7 @@ jobs:
         shell: bash
         run: |
           IMAGE_NAME="$(just image_name ${{ matrix.base_name }} ${{ matrix.stream_name }} ${{ matrix.image_flavor }})"
-          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
 
       - name: Default Tag
         shell: bash
@@ -93,7 +92,7 @@ jobs:
                        ${{ matrix.stream_name }} \
                        "1")"
           echo "Default Tag: ${DEFAULT_TAG}"
-          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
+          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV"
 
       - name: DNF Package Cache Setup
         shell: bash
@@ -128,7 +127,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \
+          sudo -E "$(command -v just)" repo_organization="${{ github.repository_owner }}" \
                     build-ghcr "${{ matrix.base_name }}" \
                                "${{ matrix.stream_name }}" \
                                "${{ matrix.image_flavor }}" \
@@ -166,7 +165,7 @@ jobs:
           MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
           SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
         run: |
-          sudo -E $(command -v just) gen-sbom "${MATRIX_BASE_NAME}" \
+          sudo -E "$(command -v just)" gen-sbom "${MATRIX_BASE_NAME}" \
                             "${MATRIX_STREAM_NAME}" \
                             "${MATRIX_IMAGE_FLAVOR}" \
                             "${SYFT_CMD}"
@@ -177,7 +176,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo -E $(command -v just) rechunk "${{ matrix.base_name }}" \
+          sudo -E "$(command -v just)" rechunk "${{ matrix.base_name }}" \
                             "${{ matrix.stream_name }}" \
                             "${{ matrix.image_flavor }}" \
                             "1"
@@ -186,15 +185,15 @@ jobs:
         id: load-rechunk
         shell: bash
         run: |
-          sudo -E $(command -v just) load-rechunk "${{ matrix.base_name }}" \
+          sudo -E "$(command -v just)" load-rechunk "${{ matrix.base_name }}" \
                             "${{ env.DEFAULT_TAG }}" \
                             "${{ matrix.image_flavor }}"
 
       - name: Secureboot Check
         id: secureboot
         shell: bash
         run: |
-          sudo -E $(command -v just) secureboot "${{ matrix.base_name }}" \
+          sudo -E "$(command -v just)" secureboot "${{ matrix.base_name }}" \
                           "${{ env.DEFAULT_TAG }}" \
                           "${{ matrix.image_flavor }}"
 
@@ -214,14 +213,14 @@ jobs:
 
           echo "Tags for this Action..."
           echo "$alias_tags"
-          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
+          echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT"
 
       # Tag Images
       - name: Tag Images
         shell: bash
         run: |
           set -eoux pipefail
-          sudo -E $(command -v just) tag-images "${{ env.IMAGE_NAME }}" \
+          sudo -E "$(command -v just)" tag-images "${{ env.IMAGE_NAME }}" \
                           "${{ env.DEFAULT_TAG }}" \
                           "${{ steps.generate-tags.outputs.alias_tags }}"
 
@@ -251,6 +250,7 @@ jobs:
             set -euox pipefail
 
             rm -f "${{ env.DIGEST_FILE }}"
+            # shellcheck disable=SC2086 - word splitting on alias_tags is intentional
             for tag in ${{ steps.generate-tags.outputs.alias_tags }}; do
               dest=${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${tag}
               if [[ "${tag}" == "${{ env.DEFAULT_TAG }}" ]]; then
@@ -272,16 +272,18 @@ jobs:
       - name: PR Testing Instructions
         if: github.event_name == 'pull_request'
         run: |
-          echo "### 🫐 Test this PR build" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Download the \`.oci\` artifact, unzip it, then:" >> $GITHUB_STEP_SUMMARY
-          echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo "sudo bootc switch --transport oci /absolute/path/to/${{ env.IMAGE_NAME }}_build" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "To go back:" >> $GITHUB_STEP_SUMMARY
-          echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo "sudo bootc switch --enforce-container-sigpolicy ghcr.io/projectbluefin/${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          {
+            echo "### 🫐 Test this PR build"
+            echo ""
+            echo "Download the \`.oci\` artifact, unzip it, then:"
+            echo '```bash'
+            echo "sudo bootc switch --transport oci /absolute/path/to/${{ env.IMAGE_NAME }}_build"
+            echo '```'
+            echo "To go back:"
+            echo '```bash'
+            echo "sudo bootc switch --enforce-container-sigpolicy ghcr.io/projectbluefin/${{ env.IMAGE_NAME }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Export digest
         id: digest
@@ -315,7 +317,7 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request'
         run: |
-          cosign sign -y ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
+          cosign sign -y "${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}"
         env:
           TAGS: ${{ steps.digest.outputs.digest }}
 
@@ -341,13 +343,13 @@ jobs:
           cd "$(dirname "${SBOM}")"
           oras attach \
             --artifact-type application/vnd.spdx+json \
-            --annotation filename=$(basename "$SBOM") \
+            --annotation "filename=$(basename "$SBOM")" \
             "${IMAGE}@${DIGEST}" \
-            "$(basename ${SBOM})"
+            "$(basename "$SBOM")"
 
           sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')
 
-          echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT
+          echo "sbom_digest=${sbom_digest}" >> "$GITHUB_OUTPUT"
 
       - name: Sign SBOM OCI Artifact
         if: github.event_name != 'pull_request'
@@ -356,7 +358,7 @@ jobs:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
           SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }}
         run: |
-          cosign sign -y ${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST}
+          cosign sign -y "${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST}"
 
       - name: Attestation
         if: github.event_name != 'pull_request'
@@ -367,7 +369,7 @@ jobs:
           push-to-registry: true
 
   check:
-    name: Check all ${{ matrix.stream_name }} builds successful
+    name: Check all ${{ inputs.stream_name }} builds successful
     if: always()
     runs-on: ubuntu-latest
     needs: [build_container]
@@ -377,9 +379,9 @@ jobs:
           JOBS: ${{ toJson(needs) }}
         run: |
           echo "Job status:"
-          echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'
+          echo "$JOBS" | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'
 
-          for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
+          for i in $(echo "$JOBS" | jq -r 'to_entries[] | .value.result'); do
             if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
               echo ""
               echo "Status check not okay!"
@@ -407,9 +409,11 @@ jobs:
         id: merge
         run: |
           DIGESTS=$(cat /tmp/digests/*.txt | jq -Rs 'split("\n") | map(select(length > 0)) | map(split("=")) | map({(.[0]): .[1]}) | add')
-          echo "digests<<EOF" >> "$GITHUB_OUTPUT"
-          echo "${DIGESTS}" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
+          {
+            echo "digests<<EOF"
+            echo "${DIGESTS}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Set empty digests
         if: github.event_name == 'pull_request'

.github/workflows/validate-renovate.yml

@@ -28,7 +28,7 @@ jobs:
         shell: bash
         env:
           RENOVATE_VERSION: latest
-        run: npm install -g renovate@${RENOVATE_VERSION}
+        run: npm install -g "renovate@${RENOVATE_VERSION}"
 
       - name: Validate Renovate config
         shell: bash

.pre-commit-config.yaml

@@ -14,6 +14,6 @@ repos:
         - id: detect-private-key
         - id: check-added-large-files
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.7
+    rev: v1.7.12
     hooks:
       - id: actionlint

Containerfile

@@ -1,7 +1,6 @@
 ARG BASE_IMAGE_NAME="silverblue"
-ARG FEDORA_MAJOR_VERSION="42"
-ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main"
-ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}"
+ARG FEDORA_MAJOR_VERSION="43"
+ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue"
 ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest"
 ARG COMMON_IMAGE_SHA=""
 ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest"

Justfile

@@ -108,10 +108,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml)
     brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml)
 
-    # Base Image
-    base_image_name="silverblue"
-
-
     # AKMODS Flavor and Kernel Version
     if [[ "${flavor}" =~ hwe ]]; then
         akmods_flavor="bazzite"
@@ -130,7 +126,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
 
     # Verify Base Image with cosign
-    {{ just }} verify-container "${base_image_name}-main:${fedora_version}"
+    {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
 
     # Kernel Release/Pin
     if [[ -z "${kernel_pin:-}" ]]; then
@@ -177,7 +173,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
         target="dx"
     fi
     BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
-    BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}")
     BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}")