Skip to content

CI.md

Latest commit

 

History

History
94 lines (70 loc) · 3.96 KB

CI.md

File metadata and controls

94 lines (70 loc) · 3.96 KB
Raw

Remote builds with GitHub Actions

The repository keeps quick validation separate from the large operating-system builds. This protects Actions minutes and avoids repeating multi-gigabyte downloads while the source is changing.

GitHub only loads workflow files from .github/workflows/ at the repository root. The prototype source remains below prototype/, but its workflows are at the root for that reason.

Workflows

Validate prototype

validate.yml runs automatically for pull requests and pushes to main. It:

  • checks the source, image policy, metadata and shell syntax;
  • builds the small Developer OS session RPM in a pinned Fedora container;
  • does not download or compose the full Kinoite image.

Build OS container

build-container.yml is manual because it downloads and composes the full OS. From the repository's Actions tab, choose Build OS container, select Run workflow, and normally leave Publish enabled.

The job builds on an x86_64 GitHub-hosted runner and verifies the completed filesystem as part of the image composition. When Publish is enabled, BuildKit pushes the image directly as:

ghcr.io/OWNER/REPOSITORY:foundation

It uses GitHub's BuildKit cache, so unchanged layers can be reused by later runs. The built image belongs in GitHub Container Registry rather than an Actions artifact: a registry is designed for layered images and lets the disk job pull the result directly. No custom secret is required; the workflow uses the short-lived GITHUB_TOKEN with package permission.

When Publish is disabled, the verified result remains only in BuildKit's reusable cache. Bootc images are deliberately not loaded into Docker's classic local image store because their deep layer history can exceed Docker's import limit.

Leave Reset cache disabled for normal builds. Enable it if BuildKit reports a truncated cached layer, short read, or unexpected EOF; the run will ignore the damaged entry and replace it with a fresh cache.

Build bootable disk

Run build-disk.yml after the container workflow succeeds. It starts a privileged Fedora build container, pulls the verified image from GitHub Container Registry, runs Fedora Image Builder, and uploads the qcow2 plus SHA256SUMS for seven days.

The default ubuntu-latest runner is worth trying first. A full OS plus a bootable disk can exceed its available storage. If that happens, create a GitHub larger Linux runner and enter its label in the workflow's runner field. A runner with at least 75 GB is the practical target; 150 GB gives more comfortable build and cache headroom.

The disk workflow uses --privileged only inside GitHub's disposable build machine because Image Builder and nested container storage need elevated Linux capabilities. The resulting disk still keeps SELinux enforcing.

Cost and bandwidth controls

  • Full container and disk workflows run only when manually requested.
  • Re-running source validation does not rebuild the OS.
  • BuildKit caches reusable container layers.
  • An in-progress heavy job is not automatically cancelled by a new run.
  • Disk artifacts expire after seven days.
  • GitHub downloads Fedora inputs; the local Mac only uploads Git source and later downloads the final artifact when wanted.

GitHub Actions usage and larger-runner billing depend on whether the repository is public or private and on the account plan. Check the repository's Settings → Actions → Usage before repeatedly running the heavy jobs.

Required repository setup

Before workflows can run:

  1. Create a GitHub repository for this folder and push main.
  2. In Settings → Actions → General, allow GitHub Actions.
  3. Keep workflow permissions at their default unless an organization policy overrides package writes.
  4. Run Validate prototype first.
  5. Run Build OS container with publication enabled.
  6. Run Build bootable disk.

Do not add registry passwords to the repository. The included workflows use only GitHub-provided credentials.