josh
28918bad15
Previous attempt (c962d6d) added firmware-linux-nonfree to mkosi.conf,
but the CI bundle was still 63 MB and Tiger Lake wedged on tgl_guc.
Two reasons: (1) firmware-linux-nonfree on bookworm is a thin
metapackage that doesn't include firmware-misc-nonfree, which is where
i915 GuC/HuC blobs actually live; (2) Ubuntu's apt-packaged mkosi is
old enough that Repositories=non-free-firmware shorthand likely isn't
wired through to the debootstrap invocation, so firmware packages
silently miss the bootstrap step entirely.
Changes:
- Enumerate firmware packages explicitly in mkosi.conf (firmware-
misc-nonfree, firmware-iwlwifi, firmware-realtek, firmware-amd-
graphics, firmware-intel-sound, intel/amd64-microcode).
- Ship mkosi.sources.d/debian.sources with explicit deb822 so the
non-free-firmware component is unambiguously available.
- Install mkosi 24.3 via pip in CI instead of apt's older build.
- Pin MODULES=most and COMPRESS=zstd via a tracked initramfs-tools
config under mkosi.extra/.
- Narrow .gitignore so only the generated agent binary is ignored,
not the whole mkosi.extra/ tree.
- New check-initrd Makefile target asserts both size (>=150 MB) and
actual presence of i915/tgl_guc_*.bin inside the built initrd, so
a silent firmware-drop regression fails the build loudly.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
84 lines
3.0 KiB
YAML
84 lines
3.0 KiB
YAML
name: Release
|
|
|
|
# Builds the full release tarball (orchestrator + agent + live image +
|
|
# deploy scripts) and publishes it to the Gitea generic package
|
|
# registry under two versions:
|
|
# - sha-<short-sha> immutable, per-commit pin
|
|
# - latest rolling alias (DELETE+PUT on each run)
|
|
#
|
|
# The LXC installer (deploy/proxmox-install.sh) curls the "latest"
|
|
# version by default; operators can pin via VETTING_VERSION=sha-abc1234.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26.x"
|
|
cache: false
|
|
|
|
- name: Install live-image build dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
debootstrap squashfs-tools dosfstools \
|
|
systemd-ukify systemd-boot kmod \
|
|
debian-archive-keyring python3-pip zstd
|
|
# Ubuntu's apt-packaged mkosi is too old to wire
|
|
# non-free-firmware shorthand through to debootstrap.
|
|
# Install a pinned recent version directly; mkosi is
|
|
# pure-Python so --break-system-packages is harmless here.
|
|
sudo pip install --break-system-packages mkosi==24.3
|
|
|
|
- name: Install templ
|
|
run: go install github.com/a-h/templ/cmd/templ@v0.3.1001
|
|
|
|
- name: Build release bundle
|
|
run: make release
|
|
|
|
- name: Resolve bundle path + short sha
|
|
id: meta
|
|
run: |
|
|
short_sha=$(git rev-parse --short HEAD)
|
|
echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
|
|
echo "bundle=bin/vetting-bundle-${short_sha}.tar.gz" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Publish sha-pinned bundle
|
|
env:
|
|
REGISTRY_URL: ${{ vars.REGISTRY_URL }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
OWNER: ${{ gitea.repository_owner }}
|
|
SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
|
|
BUNDLE: ${{ steps.meta.outputs.bundle }}
|
|
run: |
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
--upload-file "${BUNDLE}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/sha-${SHORT_SHA}/vetting-bundle.tar.gz"
|
|
|
|
- name: Replace latest alias
|
|
env:
|
|
REGISTRY_URL: ${{ vars.REGISTRY_URL }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
OWNER: ${{ gitea.repository_owner }}
|
|
BUNDLE: ${{ steps.meta.outputs.bundle }}
|
|
run: |
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
-X DELETE \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz" \
|
|
|| true
|
|
curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
|
|
--upload-file "${BUNDLE}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz"
|