[pull] stable-f44 from main - #2357
Closed
pull[bot] wants to merge 57 commits into
Closed
Conversation
…digest to 47fe6aa (#2355) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Chunkah is actively maintained and the algorithm seems to be more stable for the layer plan which results in smaller sizes for weekly updates compared to rpm-ostree. Although it looks like daily updates are slightly bigger for the time being. In the future there may be a way to consume previous build manifests as well to further shrink down image sizes. I am not deleting the old build-chunked-oci code yet, to make this PR easier to revert in case we have to. Rpm-ostree is basically the only blocker for rootless CI, which is generally what we should be doing, PolP and all that. Now we only need root privileges for bootc install. Althought to keep this PR more simple I will implement this later. It seems like bootc install needs more space now, not sure exactly why that happens but seems to be related due to pruned /sysroot. xref #2324 Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
pull
Bot
requested review from
NiHaiden,
inffy,
ledif and
renner0e
as code owners
June 9, 2026 09:18
renner0e
requested changes
Jun 9, 2026
renner0e
left a comment
renner0e
left a comment
Member
There was a problem hiding this comment.
This change includes the chunkah change, I want to test this for at least 3 weeks, so do not merge this.
We also have to test if our ISOs still work....
We are just running a couple lines of bash here. See: #1728
…digest to 3222e2b (#2359) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 61fcd0a (#2364) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
The retry function is lifted straight from our base images [1]. Shold make CI flakes a little less likely [2] as seen in [3]. [1]: https://forge.fedoraproject.org/atomic-desktops/config/src/commit/8301eaad962065b653df30cce9658021df1c24f2/justfile#L33-L53 [2]: #2337 [3]: https://github.com/ublue-os/aurora/actions/runs/27338439302/job/80768647685
…digest to 4528632 (#2373) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
This recipe doesn't actually work yet without any changes to the image because we don't add the bootc module to the initramfs and don't install systemd-boot. This makes it easier to test the composefs native backend.
…t to e6540a6 (#2366) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…t to 18e3fa7 (#2376) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to b4a1ff3 (#2378) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
* chore: simplify container pinning for common brew This is just less complex and fully uses image-versions.yml * make akmods_flavor a separate recipe Helps in further splitting up the big monolith that is the build recipe. * set right just group * set full name for alpine image
We are not using docker in CI and I don't think it's worth the complexity to keep (rather poorly) supporting builds with docker. Bootc and Fedora only test/use the podman/buildah ecosystem so we should probably do the same. Docker prefixes images with docker.io instead of localhost like podman does if you don't specific a tag prefix, so we can drop those prefixes everywhere. I'm sure that some things are already broken to some degree with docker as I don't use it at all to test the various recipes. I'm keeping the PODMAN variable to make it easy to at least replace the path of the podman binary, compiling podman from source, homebrew...
fixup of d029a02. rpm-ostree needs the full reference.
May help us when spotting [1]. [1]: #2377
…0032 (#2390) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to ae0ee5d (#2391) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
This should minimize the network flakes we run into when we have to pull images as part of the many `FROM`s, the default is 3 tries with 2s delay, which is really low. I'm not 100% sure it will help us, let's just try it! See: #2337
…digest to 6f208c9 (#2397) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
This is the right way to do this, credentials would be missing if we do run into the case where we have to retry the login. xref: #2337
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…t to 7d8d7dc (#2423) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
This is probably the way we should be doing it instead of having a separate pull, also works for the other images, mainly useful for akmods and kinoite as we do not pin those by a digest. Which we should be doing at some point. In the future we probably want to have some kind of mechanism that ensures that we are only pulling the blessed verified image (configuring the runner environment with a policy). Currently we are verifying the tag and then pulling the image a short while later. This is not very likely to happen but leaves a couple seconds of room where an untrusted image could be published that we did not verify the authenticity of. This ties a little bit into [1]. [1]: #2381
…digest to f351cca (#2428) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…t to ca24863 (#2430) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…t to f229dc0 (#2432) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…4115 (#2433) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to aea17b2 (#2434) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to a2f9ca4 (#2438) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 1ffdff1 (#2441) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 1975db5 (#2447) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 8f5a379 (#2451) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…t to 34ef110 (#2453) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 91ffbf1 (#2455) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to b0ff866 (#2461) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
* refactor(ci): initial work for using flag/arg-based workflow The goal of this is to make the buildsystem function like any other CLI program. The only recipes I haven't touched in this PR are the very simple recipes like verify-container, retag-nvidia-ghcr and login-registry. In the future I want to split up this Justfile in multiple smaller ones where it feels right to do that. resolves: #2436 * document minimum just version * build recipe * feat: redo the way we do kernel pins This allows an independent pinning of kernels for future ARM builds regardless of x86. Probably the way we should have done it from the beginning. * get rid of build-ghcr and build-pipeline related things We are not using the build-pipeline recipe anywhere right now. I think a build-rechunk recipe is good enough for now. I think build-ghcr doesn't make any sense anymore as it's now just a single additional flag. The rechunk recipe with chunkah currently doesn't alter any behavior when run in ghcr so we can delete this. But this will likely change when chunkah implements some form of passing a previous manifest. I want to do a recipe at some point which replaces the general idea of the pipeline recipe and is as close to github as possible. Build -> Rechunk -> Secureboot-> tag + push an image to a local registry bootc install. * do deprecated build-chunked-oci recipe * remove build-pipeline parts of ostree-rechunk * export oci * load rootful recipe currently not used in CI as we are running everything as root. * secureboot * generate-point * gen-sbom * package cache * bootc install * some remaining shebangs best practice to use env bash here instead * push recipe * redo generate-build-tags and tag-images I removed the version input here. This has been broken for probably a very long time, this didn't do anything for months at least, oldest log I could find here: ``` Error: no such object: "aurora:latest" Tags for this Action... latest latest-43.20260424 latest-20260424 43 43-43.20260424 43-20260424 ``` Kernel input is now done through just, so no reason to pass that, no idea why we had that here in the first place. * fix kernel pin for build-rechunk This convenience recipe needs to take all the options from the build one
…b1e9 (#2463) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 9abf432 (#2464) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to 9f2854d (#2467) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
oopsie made in: cfd014f
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
…digest to ce90f03 (#2472) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Member
|
closing in favor of: #2474 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )