josh
43ea845ac0
update-initramfs produces a boot stub (~50 MB) that expects to mount a separate rootfs over squashfs/disk/NFS. Our PXE channel only ships vmlinuz+initrd.img, so the stub had nothing to pivot to — kernel finished hand-off and the system wedged with firmware, modules, and userspace stranded in the 545 MB rootfs dir we never delivered. Replace with an everything-in-initramfs build: cpio.zst the full rootfs (minus /boot) as the initrd, add /init -> sbin/init for the kernel's runtime entrypoint, materialize the kernel symlink into a real file. Bump check-initrd floor to 200 MB and switch the firmware grep from unmkinitramfs (boot-stub-specific) to zstd | cpio -t. Also add cpio to the CI apt deps.
86 lines
3.1 KiB
YAML
86 lines
3.1 KiB
YAML
name: Release
|
|
|
|
# Builds the full release tarball (orchestrator + agent + live image +
|
|
# deploy scripts) and publishes it to the Gitea generic package
|
|
# registry under two versions:
|
|
# - sha-<short-sha> immutable, per-commit pin
|
|
# - latest rolling alias (DELETE+PUT on each run)
|
|
#
|
|
# The LXC installer (deploy/proxmox-install.sh) curls the "latest"
|
|
# version by default; operators can pin via VETTING_VERSION=sha-abc1234.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26.x"
|
|
cache: false
|
|
|
|
- name: Install live-image build dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
debootstrap squashfs-tools dosfstools \
|
|
systemd-ukify systemd-boot kmod bubblewrap \
|
|
debian-archive-keyring python3-pip git zstd cpio
|
|
# Ubuntu's apt-packaged mkosi is too old to wire
|
|
# non-free-firmware shorthand through to debootstrap.
|
|
# mkosi isn't published on PyPI under v24+ — install the
|
|
# pinned tag from upstream git instead. bubblewrap provides
|
|
# the sandbox mkosi uses for its `cp`/chroot plumbing.
|
|
sudo pip install --break-system-packages \
|
|
"git+https://github.com/systemd/mkosi.git@v25.3"
|
|
|
|
- name: Install templ
|
|
run: go install github.com/a-h/templ/cmd/templ@v0.3.1001
|
|
|
|
- name: Build release bundle
|
|
run: make release
|
|
|
|
- name: Resolve bundle path + short sha
|
|
id: meta
|
|
run: |
|
|
short_sha=$(git rev-parse --short HEAD)
|
|
echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
|
|
echo "bundle=bin/vetting-bundle-${short_sha}.tar.gz" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Publish sha-pinned bundle
|
|
env:
|
|
REGISTRY_URL: ${{ vars.REGISTRY_URL }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
OWNER: ${{ gitea.repository_owner }}
|
|
SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
|
|
BUNDLE: ${{ steps.meta.outputs.bundle }}
|
|
run: |
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
--upload-file "${BUNDLE}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/sha-${SHORT_SHA}/vetting-bundle.tar.gz"
|
|
|
|
- name: Replace latest alias
|
|
env:
|
|
REGISTRY_URL: ${{ vars.REGISTRY_URL }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
OWNER: ${{ gitea.repository_owner }}
|
|
BUNDLE: ${{ steps.meta.outputs.bundle }}
|
|
run: |
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
-X DELETE \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz" \
|
|
|| true
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
--upload-file "${BUNDLE}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz"
|