chore(ci): use container-storage-action again - #2408
Merged
Conversation
I did some light testing regarding the variation of allocated space on / and /mnt if present the other day and sadly there is still a very low single-digit chance where our image build is just gonna fail because we got the worst possible disk configuration with 20GB free and no (additional) space on /mnt. This would at least address the cases where we do have /mnt. This came up again because we are using chunkah now which produces an image where none of the layers with the base image are shared. xref: ublue-os#2337
Up to standards ✅🟢 Issues
|
inffy
approved these changes
Jun 17, 2026
|
Successfully created backport PR for |
renner0e
added a commit
that referenced
this pull request
Jun 18, 2026
I did some light testing regarding the variation of allocated space on / and /mnt if present the other day and sadly there is still a very low single-digit chance where our image build is just gonna fail because we got the worst possible disk configuration with 20GB free and no (additional) space on /mnt. This would at least address the cases where we do have /mnt. This came up again because we are using chunkah now which produces an image where none of the layers with the base image are shared. xref: #2337 (cherry picked from commit fefad58) Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>
renner0e
added a commit
that referenced
this pull request
Jun 30, 2026
* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 47fe6aa (#2355) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * feat(ci): use chunkah for rechunking (#2349) Chunkah is actively maintained and the algorithm seems to be more stable for the layer plan which results in smaller sizes for weekly updates compared to rpm-ostree. Although it looks like daily updates are slightly bigger for the time being. In the future there may be a way to consume previous build manifests as well to further shrink down image sizes. I am not deleting the old build-chunked-oci code yet, to make this PR easier to revert in case we have to. Rpm-ostree is basically the only blocker for rootless CI, which is generally what we should be doing, PolP and all that. Now we only need root privileges for bootc install. Althought to keep this PR more simple I will implement this later. It seems like bootc install needs more space now, not sure exactly why that happens but seems to be related due to pruned /sysroot. xref #2324 Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> * chore(ci): use ubuntu-slim for check jobs (#2358) We are just running a couple lines of bash here. See: #1728 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 3222e2b (#2359) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 61fcd0a (#2364) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * feat(ci): add retries for registry logins (#2369) The retry function is lifted straight from our base images [1]. Shold make CI flakes a little less likely [2] as seen in [3]. [1]: https://forge.fedoraproject.org/atomic-desktops/config/src/commit/8301eaad962065b653df30cce9658021df1c24f2/justfile#L33-L53 [2]: #2337 [3]: https://github.com/ublue-os/aurora/actions/runs/27338439302/job/80768647685 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 4528632 (#2373) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * feat(just): add composefs-backend option to disk-image (#2370) This recipe doesn't actually work yet without any changes to the image because we don't add the bootc module to the initramfs and don't install systemd-boot. This makes it easier to test the composefs native backend. * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to e6540a6 (#2366) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * fix(release): tag selection in changelogs.py (#2363) * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 18e3fa7 (#2376) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to b4a1ff3 (#2378) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: misc cleanup (#2382) * chore: simplify container pinning for common brew This is just less complex and fully uses image-versions.yml * make akmods_flavor a separate recipe Helps in further splitting up the big monolith that is the build recipe. * set right just group * set full name for alpine image * chore(ci): remove docker compatibility + use buildah for build (#2380) We are not using docker in CI and I don't think it's worth the complexity to keep (rather poorly) supporting builds with docker. Bootc and Fedora only test/use the podman/buildah ecosystem so we should probably do the same. Docker prefixes images with docker.io instead of localhost like podman does if you don't specific a tag prefix, so we can drop those prefixes everywhere. I'm sure that some things are already broken to some degree with docker as I don't use it at all to test the various recipes. I'm keeping the PODMAN variable to make it easy to at least replace the path of the podman binary, compiling podman from source, homebrew... * fix: build-chunked-oci --from image name (#2386) fixup of d029a02. rpm-ostree needs the full reference. * feat(ci): print staging and production digest to summary (#2388) May help us when spotting [1]. [1]: #2377 * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 0b10032 (#2390) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ae0ee5d (#2391) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * feat(ci): add more aggressive retries for pulling (#2394) This should minimize the network flakes we run into when we have to pull images as part of the many `FROM`s, the default is 3 tries with 2s delay, which is really low. I'm not 100% sure it will help us, let's just try it! See: #2337 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 6f208c9 (#2397) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(backport-action): make the action fail if there is an error (#2393) * chore(backport-action): make the action fail if there is an error * change pr title to adhere to semantic pr rules * feat(ci): increase dnf timeout to combat network flakes (#2401) The default is 30s, let's see if this is already enough. Most packages should usually be cached, it's the retrieval of metadata that is often the reason for the network related flakes. xref: #2337 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9636b35 (#2403) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 86fe5f3 (#2405) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 02dba7f (#2407) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(ci): use container-storage-action again (#2408) I did some light testing regarding the variation of allocated space on / and /mnt if present the other day and sadly there is still a very low single-digit chance where our image build is just gonna fail because we got the worst possible disk configuration with 20GB free and no (additional) space on /mnt. This would at least address the cases where we do have /mnt. This came up again because we are using chunkah now which produces an image where none of the layers with the base image are shared. xref: #2337 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to d4b28ac (#2410) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: make rpm-ostree status mandatory in issue template (#2418) * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ad44bfe (#2420) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * fix(ci): properly retry registry logins (#2417) This is the right way to do this, credentials would be missing if we do run into the case where we have to retry the login. xref: #2337 * chore(deps): update actions/checkout action to v7 (#2414) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 7d8d7dc (#2423) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update softprops/action-gh-release digest to 718ea10 (#2424) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: Revert "chore: delete bootc install config (#2426) * chore: Revert "chore: delete bootc install config (#1568)" This is one of the things we need for bcvk to work with our images. This reverts commit 5f76360. * chore: drop filesystem option for bootc install * chore(ci): set pull=newer for build command (#2427) This is probably the way we should be doing it instead of having a separate pull, also works for the other images, mainly useful for akmods and kinoite as we do not pin those by a digest. Which we should be doing at some point. In the future we probably want to have some kind of mechanism that ensures that we are only pulling the blessed verified image (configuring the runner environment with a policy). Currently we are verifying the tag and then pulling the image a short while later. This is not very likely to happen but leaves a couple seconds of room where an untrusted image could be published that we did not verify the authenticity of. This ties a little bit into [1]. [1]: #2381 * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to f351cca (#2428) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to ca24863 (#2430) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to f229dc0 (#2432) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 2fb4115 (#2433) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to aea17b2 (#2434) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to a2f9ca4 (#2438) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 1ffdff1 (#2441) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update actions/cache action to v6 (#2445) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 1975db5 (#2447) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 8f5a379 (#2451) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 34ef110 (#2453) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 91ffbf1 (#2455) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update actions/attest action to v4.1.1 (#2457) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update actions/cache action to v6.1.0 (#2459) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to b0ff866 (#2461) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * refactor(ci): initial work for using flag/arg-based workflow (#2443) * refactor(ci): initial work for using flag/arg-based workflow The goal of this is to make the buildsystem function like any other CLI program. The only recipes I haven't touched in this PR are the very simple recipes like verify-container, retag-nvidia-ghcr and login-registry. In the future I want to split up this Justfile in multiple smaller ones where it feels right to do that. resolves: #2436 * document minimum just version * build recipe * feat: redo the way we do kernel pins This allows an independent pinning of kernels for future ARM builds regardless of x86. Probably the way we should have done it from the beginning. * get rid of build-ghcr and build-pipeline related things We are not using the build-pipeline recipe anywhere right now. I think a build-rechunk recipe is good enough for now. I think build-ghcr doesn't make any sense anymore as it's now just a single additional flag. The rechunk recipe with chunkah currently doesn't alter any behavior when run in ghcr so we can delete this. But this will likely change when chunkah implements some form of passing a previous manifest. I want to do a recipe at some point which replaces the general idea of the pipeline recipe and is as close to github as possible. Build -> Rechunk -> Secureboot-> tag + push an image to a local registry bootc install. * do deprecated build-chunked-oci recipe * remove build-pipeline parts of ostree-rechunk * export oci * load rootful recipe currently not used in CI as we are running everything as root. * secureboot * generate-point * gen-sbom * package cache * bootc install * some remaining shebangs best practice to use env bash here instead * push recipe * redo generate-build-tags and tag-images I removed the version input here. This has been broken for probably a very long time, this didn't do anything for months at least, oldest log I could find here: ``` Error: no such object: "aurora:latest" Tags for this Action... latest latest-43.20260424 latest-20260424 43 43-43.20260424 43-20260424 ``` Kernel input is now done through just, so no reason to pass that, no idea why we had that here in the first place. * fix kernel pin for build-rechunk This convenience recipe needs to take all the options from the build one * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 2b3b1e9 (#2463) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9abf432 (#2464) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9f2854d (#2467) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * fix(ci): add space in disk-image (#2469) oopsie made in: cfd014f * chore(deps): update korthout/backport-action action to v4.6.0 (#2470) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ce90f03 (#2472) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --------- Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I did some light testing regarding the variation of allocated space on / and /mnt if present the other day and sadly there is still a very low single-digit chance where our image build is just gonna fail because we got the worst possible disk configuration with 20GB free and no (additional) space on /mnt. This would at least address the cases where we do have /mnt.
This came up again because we are using chunkah now which produces an image where none of the layers with the base image are shared.
xref: #2337