Daily Podman Stack Builder #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Daily Podman Stack Builder | |
| on: | |
| schedule: | |
| - cron: '0 8 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-debs: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ubuntu:26.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - package: podman | |
| repo: containers/podman | |
| - package: netavark | |
| repo: containers/netavark | |
| - package: aardvark-dns | |
| repo: containers/aardvark-dns | |
| - package: conmon | |
| repo: containers/conmon | |
| - package: skopeo | |
| repo: containers/skopeo | |
| - package: crun | |
| repo: containers/crun | |
| - package: fuse-overlayfs | |
| repo: containers/fuse-overlayfs | |
| steps: | |
| - name: Install Build Toolchain & Dependencies | |
| run: | | |
| apt-get update | |
| DEBIAN_FRONTEND=noninteractive apt-get install -y \ | |
| ca-certificates git curl jq build-essential pkg-config \ | |
| ruby-rubygems ruby-dev \ | |
| golang rustc cargo protobuf-compiler libfuse3-dev \ | |
| libseccomp-dev libgpgme-dev libbpf-dev libsystemd-dev \ | |
| libglib2.0-dev libyajl-dev autoconf automake libtool \ | |
| go-md2man libcap-dev python3 python3-pip libbtrfs-dev \ | |
| libdevmapper-dev libjson-c-dev libapparmor-dev | |
| gem install fpm | |
| - name: Fetch Latest Git Tag | |
| id: fetch_tag | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ matrix.package }}" = "crun" ]; then | |
| # crun uses bare number tags (1.28, 1.27, etc.) — use GitHub API | |
| RAW_TAG=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| "https://api.github.com/repos/${{ matrix.repo }}/releases/latest" | jq -r .tag_name) | |
| if [ "$RAW_TAG" = "null" ] || [ -z "$RAW_TAG" ]; then | |
| RAW_TAG=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| "https://api.github.com/repos/${{ matrix.repo }}/tags" | jq -r '.[0].name') | |
| fi | |
| else | |
| # All other packages: git ls-remote avoids API rate limits | |
| RAW_TAG=$(git ls-remote --tags \ | |
| "https://github.com/${{ matrix.repo }}.git" | \ | |
| grep -v '\^{}$' | \ | |
| awk '{print $2}' | sed 's|refs/tags/||' | \ | |
| grep -E '^v?[0-9]+\.[0-9]+' | \ | |
| sort -V -r | \ | |
| head -n1) | |
| fi | |
| if [ -z "$RAW_TAG" ] || [ "$RAW_TAG" = "null" ]; then | |
| echo "ERROR: Could not find any version tag for ${{ matrix.repo }}" >&2 | |
| exit 1 | |
| fi | |
| VERSION=$(echo "$RAW_TAG" | sed 's/^v//') | |
| RELEASE_TAG="${{ matrix.package }}-${VERSION}" | |
| echo "tag=$RAW_TAG" >> $GITHUB_ENV | |
| echo "version=$VERSION" >> $GITHUB_ENV | |
| echo "release_tag=$RELEASE_TAG" >> $GITHUB_ENV | |
| echo "upstream=${{ matrix.repo }}" >> $GITHUB_ENV | |
| - name: Check if Release Already Exists | |
| id: check_release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| echo "Checking for existing release: ${{ env.release_tag }}" | |
| STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| "https://api.github.com/repos/${{ github.repository }}/releases/tags/${{ env.release_tag }}") | |
| if [ "$STATUS" = "200" ]; then | |
| echo "skip=true" >> $GITHUB_OUTPUT | |
| echo "✅ Release ${{ env.release_tag }} already exists. Skipping build." | |
| else | |
| echo "skip=false" >> $GITHUB_OUTPUT | |
| echo "🆕 Release ${{ env.release_tag }} not found. Proceeding with build." | |
| fi | |
| - name: Checkout Source Code | |
| if: steps.check_release.outputs.skip != 'true' | |
| run: | | |
| git clone --branch ${{ env.tag }} --depth 1 https://github.com/${{ env.upstream }}.git build_dir | |
| - name: Compile and Install to Temporary Directory | |
| if: steps.check_release.outputs.skip != 'true' | |
| run: | | |
| cd build_dir | |
| mkdir -p dest | |
| if [ "${{ matrix.package }}" = "podman" ]; then | |
| make BUILDTAGS="seccomp systemd apparmor" PREFIX=/usr | |
| make install PREFIX=/usr DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "skopeo" ]; then | |
| make BUILDTAGS="seccomp" PREFIX=/usr bin/skopeo | |
| make install PREFIX=/usr DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "conmon" ]; then | |
| make PREFIX=/usr | |
| make install PREFIX=/usr DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "crun" ]; then | |
| # Patch: fix function signature mismatch in cgroup.h for newer GCC | |
| sed -i 's/const cgroups_subsystem_t \*libcrun_get_cgroups_subsystems ();/const cgroups_subsystem_t *libcrun_get_cgroups_subsystems (libcrun_error_t *err);/' src/libcrun/cgroup.h | |
| ./autogen.sh | |
| ./configure --prefix=/usr | |
| make | |
| make install DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "netavark" ]; then | |
| make PREFIX=/usr | |
| make install PREFIX=/usr DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "aardvark-dns" ]; then | |
| make PREFIX=/usr | |
| make install PREFIX=/usr DESTDIR=$(pwd)/dest | |
| elif [ "${{ matrix.package }}" = "fuse-overlayfs" ]; then | |
| ./autogen.sh | |
| ./configure --prefix=/usr | |
| make | |
| make install DESTDIR=$(pwd)/dest | |
| fi | |
| - name: Build Debian Package | |
| if: steps.check_release.outputs.skip != 'true' | |
| run: | | |
| cd build_dir | |
| FPM_CMD="fpm -s dir -t deb -n ${{ matrix.package }} --epoch 1 -v ${{ env.version }}-0local1 -C dest" | |
| if [ "${{ matrix.package }}" = "podman" ]; then | |
| FPM_CMD="$FPM_CMD -d conmon -d crun -d netavark -d aardvark-dns -d fuse-overlayfs" | |
| fi | |
| $FPM_CMD . | |
| - name: Upload .deb Artifacts | |
| if: steps.check_release.outputs.skip != 'true' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.package }}-${{ env.version }}.deb | |
| path: build_dir/*.deb | |
| - name: Publish to GitHub Release | |
| if: steps.check_release.outputs.skip != 'true' | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ env.release_tag }} | |
| name: "${{ matrix.package }} ${{ env.version }}" | |
| body: | | |
| Auto-built `.deb` package for **${{ matrix.package }}** ${{ env.version }}. | |
| - **Upstream:** https://github.com/${{ env.upstream }}/releases/tag/${{ env.tag }} | |
| - **Built on:** Ubuntu 26.04 | |
| Install with: | |
| ```bash | |
| sudo dpkg -i ${{ matrix.package }}_${{ env.version }}-0local1_amd64.deb | |
| # or if dependencies are missing: | |
| sudo apt-get install -f | |
| ``` | |
| files: build_dir/*.deb | |
| make_latest: false | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |