|
| 1 | +_sources := justfile_directory() / "sources.json" |
| 2 | +registry := env("REGISTRY", "ghcr.io") |
| 3 | +registry_owner := env("REGISTRY_OWNER", "bootc-dev") |
| 4 | + |
| 5 | +# Look up a field from sources.json by image key (e.g. fedora-bootc-43) |
| 6 | +[private] |
| 7 | +_field image field: |
| 8 | + @jq -re --arg n "{{image}}" '.[] | select(.name + "-" + .tag == $n) | .{{field}}' "{{_sources}}" |
| 9 | + |
| 10 | +# List available staged images |
| 11 | +list: |
| 12 | + @jq -r '.[] | .name + "-" + .tag' "{{_sources}}" |
| 13 | + |
| 14 | +# Mirror an upstream source image to our registry. |
| 15 | +# Usage: just staged-images/mirror fedora-bootc-43 |
| 16 | +mirror image: |
| 17 | + #!/bin/bash |
| 18 | + set -euo pipefail |
| 19 | + name=$(just {{justfile_directory()}}/_field {{image}} name) |
| 20 | + tag=$(just {{justfile_directory()}}/_field {{image}} tag) |
| 21 | + src=$(just {{justfile_directory()}}/_field {{image}} source) |
| 22 | + dest="{{registry}}/{{registry_owner}}/${name}-source:${tag}" |
| 23 | + # skopeo doesn't support tag@digest, use digest-only form |
| 24 | + src_by_digest="${src%%:*}@${src##*@}" |
| 25 | + echo "Mirroring ${src_by_digest} -> ${dest}" |
| 26 | + skopeo copy --all --retry-times 3 "docker://${src_by_digest}" "docker://${dest}" |
| 27 | + echo "Mirrored ${dest}" |
| 28 | + |
| 29 | +# Build a staged image locally. |
| 30 | +# Usage: just staged-images/build fedora-bootc-43 |
| 31 | +# Set SOURCE_FROM_MIRROR=1 to pull from registry mirror instead of upstream. |
| 32 | +build image: |
| 33 | + #!/bin/bash |
| 34 | + set -euo pipefail |
| 35 | + name=$(just {{justfile_directory()}}/_field {{image}} name) |
| 36 | + tag=$(just {{justfile_directory()}}/_field {{image}} tag) |
| 37 | + src=$(just {{justfile_directory()}}/_field {{image}} source) |
| 38 | + staged_name="${name}-staged" |
| 39 | + if [ "${SOURCE_FROM_MIRROR:-}" = "1" ]; then |
| 40 | + src="{{registry}}/{{registry_owner}}/${name}-source:${tag}" |
| 41 | + fi |
| 42 | + echo "=== Pulling source image ===" |
| 43 | + podman pull "${src}" |
| 44 | + echo "=== Writing source config ===" |
| 45 | + podman inspect "${src}" > "{{justfile_directory()}}/source-config.json" |
| 46 | + echo "=== Building ${staged_name}:${tag} ===" |
| 47 | + # -v is needed for buildah < 1.44 (see containers/buildah#5952) |
| 48 | + buildah build --skip-unused-stages=false \ |
| 49 | + -v "{{justfile_directory()}}:/run/src" --security-opt=label=disable \ |
| 50 | + --build-arg SOURCE_IMAGE="${src}" \ |
| 51 | + --build-arg MAX_LAYERS=128 \ |
| 52 | + -f "{{justfile_directory()}}/Containerfile" \ |
| 53 | + -t "localhost/${staged_name}:${tag}" \ |
| 54 | + "{{justfile_directory()}}" |
| 55 | + echo "=== Verifying ===" |
| 56 | + echo "Labels:" |
| 57 | + podman inspect "localhost/${staged_name}:${tag}" | jq '.[0].Config.Labels' |
| 58 | + echo "Layer count:" |
| 59 | + podman inspect "localhost/${staged_name}:${tag}" | jq '.[0].RootFS.Layers | length' |
| 60 | + echo "Built localhost/${staged_name}:${tag}" |
| 61 | + |
| 62 | +# Build all staged images |
| 63 | +build-all: |
| 64 | + #!/bin/bash |
| 65 | + set -euo pipefail |
| 66 | + for image in $(jq -r '.[] | .name + "-" + .tag' "{{_sources}}"); do |
| 67 | + just {{justfile_directory()}}/build "$image" |
| 68 | + done |
| 69 | + |
| 70 | +# Push a built staged image by digest, print only the digest to stdout. |
| 71 | +# Usage: just staged-images/push fedora-bootc-43 amd64 |
| 72 | +push image arch="": |
| 73 | + #!/bin/bash |
| 74 | + set -euo pipefail |
| 75 | + name=$(just {{justfile_directory()}}/_field {{image}} name) |
| 76 | + tag=$(just {{justfile_directory()}}/_field {{image}} tag) |
| 77 | + staged_name="${name}-staged" |
| 78 | + arch="{{arch}}" |
| 79 | + if [ -z "$arch" ]; then |
| 80 | + arch=$(podman info --format '{{{{.Host.Arch}}') |
| 81 | + fi |
| 82 | + dest="{{registry}}/{{registry_owner}}/${staged_name}" |
| 83 | + # Use a per-arch tag to avoid collisions when pushing in parallel |
| 84 | + push_tag="${tag}-${arch}" |
| 85 | + podman tag "localhost/${staged_name}:${tag}" "${dest}:${push_tag}" >&2 |
| 86 | + digestfile=$(mktemp) |
| 87 | + podman push --retry 3 --digestfile "${digestfile}" "${dest}:${push_tag}" >&2 |
| 88 | + digest=$(cat "${digestfile}") |
| 89 | + rm -f "${digestfile}" |
| 90 | + echo "${digest}" |
| 91 | + |
| 92 | +# Generate GHA matrices from sources.json (used by CI workflow) |
| 93 | +[private] |
| 94 | +ci-matrix: |
| 95 | + @jq -c '[.[] | . as $img | {name: ($img.name + "-staged"), tag: $img.tag, image_key: ($img.name + "-" + $img.tag), arch: "amd64", runner: "ubuntu-24.04"}, {name: ($img.name + "-staged"), tag: $img.tag, image_key: ($img.name + "-" + $img.tag), arch: "arm64", runner: "ubuntu-24.04-arm"}] | {include: .}' "{{_sources}}" |
| 96 | +[private] |
| 97 | +ci-mirror-matrix: |
| 98 | + @jq -c '[.[] | {name: .name, tag: .tag, source: .source, mirror_name: (.name + "-source")}] | {include: .}' "{{_sources}}" |
| 99 | +[private] |
| 100 | +ci-manifest-matrix: |
| 101 | + @jq -c '[.[] | {name: (.name + "-staged"), tag: .tag}] | {include: .}' "{{_sources}}" |
0 commit comments