Merge pull request #2625 from renner0e/stable-promotion

renner0e · web-flow · commit 0f72ce8bdc8e · 2026-07-26T18:59:02.000+02:00
chore: stable promotion
diff --git a/.github/renovate.json5 b/.github/renovate.json5
@@ -61,6 +61,12 @@
       // to reach a stable release
       "matchBaseBranches": ["stable-f44"],
       "enabled": false
+    },
+    {
+      "matchDepNames": [
+        "github/codeql-action/upload-sarif"
+      ],
+      "extends": ["schedule:weekly"]
     }
   ]
 }
diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml
@@ -24,7 +24,7 @@ jobs:
           private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           # Use the dynamically generated GitHub App token
diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout last 500 commits (for <commits> to work)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 500
@@ -65,6 +65,7 @@ jobs:
       - name: Create Release
         if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name))
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TITLE: ${{ steps.generate-release-text.outputs.title }}
           TAG: ${{ steps.generate-release-text.outputs.tag }}
           BODY_PATH: ./changelog.md
diff --git a/.github/workflows/moderator.yml b/.github/workflows/moderator.yml
@@ -18,7 +18,7 @@ jobs:
       models: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -71,6 +71,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/trigger-schedule-stable-image.yml b/.github/workflows/trigger-schedule-stable-image.yml
@@ -15,7 +15,7 @@ jobs:
       actions: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/validate-just.yml b/.github/workflows/validate-just.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/Containerfile.in b/Containerfile.in
@@ -129,7 +129,6 @@ RUN --mount=type=tmpfs,dst=/boot \
 # /* Everything that can be done offline after things are in place should be done here */
 RUN --network=none \
     --mount=type=tmpfs,dst=/boot \
-    --mount=type=tmpfs,dst=/run \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
     /ctx/build_files/base/16-override-install.sh && \
     /ctx/build_files/base/17-cleanup.sh && \
@@ -142,5 +141,4 @@ RUN --network=none \
 CMD ["/sbin/init"]
 
 RUN --network=none \
-    --mount=type=tmpfs,dst=/run \
-    bootc container lint
+    bootc container lint --fatal-warnings --no-truncate
diff --git a/Justfile b/Justfile
@@ -23,6 +23,10 @@ tags := '(
     [testing]=testing
 )'
 
+default_image := "aurora"
+default_tag := "latest"
+default_flavor := "main"
+
 # Build Containers
 chunkah := shell("yq -r \".images[] | select(.name == \\\"chunkah\\\") | \\\"\\\\(.image)@\\\\(.digest)\\\"\" image-versions.yml")
 common := shell("yq -r \".images[] | select(.name == \\\"common\\\") | \\\"\\\\(.image)@\\\\(.digest)\\\"\" image-versions.yml")
@@ -132,7 +136,7 @@ validate $image $tag $flavor:
 [arg("retry_pull", long="retry-pull", value="true")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false" $kernel_pin="" $retry_pull="false":
+build $image=default_image $tag=default_tag $flavor=default_flavor $rechunk="false" $ghcr="false" $kernel_pin="" $retry_pull="false":
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -154,8 +158,8 @@ build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false
       case "${tag}" in
               stable)
                   if [[ "${ARCH}" == "x86_64" ]]; then
-                      # <Here is a link why we have it pinned>
-                      kernel_pin=""
+                      # https://github.com/openzfs/zfs/issues/18760
+                      kernel_pin="7.0.12-201.fc44.x86_64"
                   elif [[ "${ARCH}" == "aarch64" ]]; then
                       kernel_pin=""
                   fi
@@ -315,14 +319,14 @@ build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false
 [arg("retry_pull", long="retry-pull", value="true")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-build-rechunk $image="aurora" $tag="latest" $flavor="main" $kernel_pin="" $retry_pull="false": (build image tag flavor kernel_pin retry_pull) (rechunk image tag flavor)
+build-rechunk $image=default_image $tag=default_tag $flavor=default_flavor $kernel_pin="" $retry_pull="false": (build image tag flavor kernel_pin retry_pull) (rechunk image tag flavor)
 
 # Rechunk Image
 [arg("flavor", long="flavor", short="f")]
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-rechunk $image="aurora" $tag="latest" $flavor="main":
+rechunk $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -357,7 +361,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main":
 [arg("previous_build", long="previous-build", value="true")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-ostree-rechunk $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $previous_build="false":
+ostree-rechunk $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $previous_build="false":
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -419,7 +423,7 @@ ostree-rechunk $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $previ
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-load-rootful $image="aurora" $tag="latest" $flavor="main":
+load-rootful $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -oux pipefail
 
@@ -439,7 +443,7 @@ load-rootful $image="aurora" $tag="latest" $flavor="main":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Utility')]
-export-oci $image="aurora" $tag="latest" $flavor="main":
+export-oci $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -oux pipefail
 
@@ -455,7 +459,7 @@ export-oci $image="aurora" $tag="latest" $flavor="main":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Image')]
-run $image="aurora" $tag="latest" $flavor="main":
+run $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -482,7 +486,7 @@ changelogs branch="stable" handwritten="":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Utility')]
-secureboot $image="aurora" $tag="latest" $flavor="main":
+secureboot $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -eou pipefail
 
@@ -533,7 +537,7 @@ secureboot $image="aurora" $tag="latest" $flavor="main":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [private]
-fedora_version image="aurora" tag="latest" flavor="main":
+fedora_version image=default_image tag=default_tag flavor=default_flavor:
     #!/usr/bin/env bash
     set -eou pipefail
 
@@ -552,7 +556,7 @@ fedora_version image="aurora" tag="latest" flavor="main":
 
 [arg("tag", long="tag", short="t")]
 [private]
-akmods_flavor tag="latest":
+akmods_flavor tag=default_tag:
     #!/usr/bin/env bash
     set -eou pipefail
 
@@ -571,7 +575,7 @@ akmods_flavor tag="latest":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [private]
-image_name image="aurora" tag="latest" flavor="main":
+image_name image=default_image tag=default_tag flavor=default_flavor:
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -593,7 +597,7 @@ image_name image="aurora" tag="latest" flavor="main":
 [arg("tag", long="tag", short="t")]
 [arg("version", long="version")]
 [group('Utility')]
-generate-build-tags $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $version="" $github_event="" $github_number="":
+generate-build-tags $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $version="" $github_event="" $github_number="":
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -660,7 +664,7 @@ generate-build-tags $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [private]
-generate-point $image="aurora" $tag="latest" $flavor="main":
+generate-point $image=default_image $tag=default_tag $flavor=default_flavor:
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -718,7 +722,7 @@ tag-images $image="" $default_tag="" $tags="":
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Utility')]
-gen-sbom $image="aurora" $tag="latest" $flavor="main" $syft_cmd="syft":
+gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd="syft":
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -760,7 +764,7 @@ gen-sbom $image="aurora" $tag="latest" $flavor="main" $syft_cmd="syft":
 [arg("tag", long="tag", short="t")]
 [group('Utility')]
 [private]
-setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $pull="false" $push="false" $registry="" $github_event="":
+setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $pull="false" $push="false" $registry="" $github_event="":
     #!/usr/bin/env bash
     set -eou pipefail
 
@@ -782,7 +786,8 @@ setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $pull="fa
     CURRENT_DAY="$(LC_TIME=C date +%A)"
     BLESSED_DAY="Sunday"
 
-    if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" ]]; then
+    # Always attempt to pull cache, but don't on the first run that will publish the build on Sundays
+    if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
       echo "Not pulling build cache. Uploading fresh cache later."
     elif [[ "${pull}" == "true" ]]; then
       # We want to avoid using --allow-path-traversal
@@ -795,7 +800,9 @@ setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $pull="fa
        [[ "${pull:-false}" == "false" ]] && \
        [[ "${push}" == "true" ]] && \
        [[ "${ghcr}" == "true" ]] && \
-       [[ "${github_event}" == "workflow_dispatch" || "${CURRENT_DAY}" == "${BLESSED_DAY}" && "${POINT}" == "1" ]]; then
+       [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" ]] && \
+       [[ "${POINT}" == "1" ]] && \
+       [[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
 
       {{ just }} login-registry oras ghcr.io
       pushd "${BUILDAH_CACHE_DIR}"
@@ -808,7 +815,7 @@ setup-cache $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $pull="fa
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [private]
-bootc $image="aurora" $tag="latest" $flavor="main" *ARGS:
+bootc $image=default_image $tag=default_tag $flavor=default_flavor *ARGS:
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -838,7 +845,7 @@ bootc $image="aurora" $tag="latest" $flavor="main" *ARGS:
 [arg("image", long="image", short="i")]
 [arg("tag", long="tag", short="t")]
 [group('Utility')]
-disk-image $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $backend="ostree":
+disk-image $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $backend="ostree":
     #!/usr/bin/env bash
     set -eoux pipefail
 
@@ -887,7 +894,7 @@ disk-image $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $backend="
 [arg("temp_push", long="temp-push", value="true")]
 [arg("temp_push_tag", long="temp-push-tag")]
 [group('Utility')]
-push-image $image="aurora" $tag="latest" $flavor="main" $ghcr="false" $registry="" $temp_push="false" $temp_push_tag="":
+push-image $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $registry="" $temp_push="false" $temp_push_tag="":
     #!/usr/bin/env bash
     set -eoux pipefail
 
diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh
@@ -64,6 +64,7 @@ FEDORA_PACKAGES=(
     git-credential-libsecret
     glow
     google-noto-sans-balinese-fonts
+    google-noto-sans-cham-fonts
     google-noto-sans-cjk-fonts
     google-noto-sans-javanese-fonts
     google-noto-sans-sundanese-fonts
diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh
@@ -43,6 +43,11 @@ systemctl enable uupd.timer
 # Disable the old update timer
 systemctl disable rpm-ostreed-automatic.timer
 
+# TODO: Remove with F45 release
+if [[ "${AKMODS_FLAVOR}" =~ coreos ]]; then
+  systemctl enable aurora-zfs-deprecation-notifier.timer
+fi
+
 # Hide Desktop Files. Hidden removes mime associations
 for file in htop nvtop; do
     if [[ -f "/usr/share/applications/${file}.desktop" ]]; then
diff --git a/build_files/base/19-initramfs.sh b/build_files/base/19-initramfs.sh
@@ -7,7 +7,7 @@ set -ouex pipefail
 KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core)
 
 export DRACUT_NO_XATTR=1
-/usr/bin/dracut --no-hostonly --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
+/usr/bin/dracut --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
 chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
 
 echo "::endgroup::"
diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh
@@ -128,7 +128,6 @@ if rpm -q docker-ce >/dev/null; then
 fi
 systemctl enable podman.socket
 systemctl enable ublue-os-libvirt-workarounds.service
-systemctl enable aurora-dx-groups.service
 systemctl enable --global aurora-dx-user-vscode.service
 
 # Disable RPM Fusion repos
diff --git a/build_files/shared/clean-stage.sh b/build_files/shared/clean-stage.sh
@@ -8,6 +8,9 @@ set -eoux pipefail
 mv /etc/dnf/dnf.conf.bak /etc/dnf/dnf.conf
 dnf versionlock clear
 
+# this invalidates libdnf5 package (chunkah)
+rm -rf /usr/lib/sysimage/libdnf5/*
+
 # This comes last because we can't *ever* afford to ship fedora flatpaks on the image
 systemctl disable flatpak-add-fedora-repos.service
 systemctl mask flatpak-add-fedora-repos.service
@@ -26,9 +29,18 @@ for file in rpmdb.sqlite rpmdb.sqlite-shm rpmdb.sqlite-wal; do
     fi
 done
 
-rm -rf /.gitkeep
-
+# Things we can't delete here are mounts from podman
 find /var/* -maxdepth 0 -type d \! -name cache -exec rm -fr {} \;
+
+find /run -mindepth 1 \
+  ! -path '/run/systemd' \
+  ! -path '/run/systemd/resolve' \
+  ! -path '/run/systemd/resolve/stub-resolv.conf' \
+  ! -path '/run/secrets' \
+  ! -path '/run/secrets/*' \
+  ! -path '/run/.containerenv' \
+  -delete
+
 rm -rf /tmp/*
 mkdir -p /var/tmp
 
diff --git a/image-versions.yml b/image-versions.yml
diff --git a/system_files/shared/usr/bin/aurora-zfs-deprecation-notifier b/system_files/shared/usr/bin/aurora-zfs-deprecation-notifier
diff --git a/system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf b/system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf
diff --git a/system_files/shared/usr/lib/systemd/system/aurora-zfs-deprecation-notifier.service b/system_files/shared/usr/lib/systemd/system/aurora-zfs-deprecation-notifier.service
diff --git a/system_files/shared/usr/lib/systemd/system/aurora-zfs-deprecation-notifier.timer b/system_files/shared/usr/lib/systemd/system/aurora-zfs-deprecation-notifier.timer

Original file line number	Diff line number	Diff line change
`@@ -61,6 +61,12 @@`
`61`	`61`	`// to reach a stable release`
`62`	`62`	`"matchBaseBranches": ["stable-f44"],`
`63`	`63`	`"enabled": false`
	`64`	`+ },`
	`65`	`+ {`
	`66`	`+ "matchDepNames": [`
	`67`	`+ "github/codeql-action/upload-sarif"`
	`68`	`+ ],`
	`69`	`+ "extends": ["schedule:weekly"]`
`64`	`70`	`}`
`65`	`71`	`]`
`66`	`72`	`}`