rootfs.yml

name: Build rootfs images

on:
  workflow_dispatch:
    inputs:
      GIT_REPO:
        description: Repository containing the rootfs configuration
        required: true
        default: kernelci/kernelci-core
        type: string
      GIT_BRANCH:
        description: Git branch or revision to build
        required: true
        default: main
        type: string
      ROOTFS_NAME:
        description: Rootfs configuration name
        required: true
        default: trixie
        type: string
      ROOTFS_ARCH:
        description: Architecture name or "all"
        required: true
        default: all
        type: string
      ROOTFS_DESTINATION:
        description: Protected publication environment
        required: true
        default: staging
        type: choice
        options:
          - staging
          - production
      ROOTFS_VERSION:
        description: Optional version in YYYYMMDD.N format
        required: false
        default: ""
        type: string

permissions:
  contents: read

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.select.outputs.matrix }}
      version: ${{ steps.select.outputs.version }}
    steps:
      - name: Check out requested KernelCI revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: ${{ inputs.GIT_REPO }}
          ref: ${{ inputs.GIT_BRANCH }}
          fetch-depth: 1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.11"
          cache: pip

      - name: Install checked-out KernelCI package
        run: python -m pip install .

      - name: Validate configuration and select variants
        id: select
        env:
          REQUESTED_NAME: ${{ inputs.ROOTFS_NAME }}
          REQUESTED_ARCH: ${{ inputs.ROOTFS_ARCH }}
          REQUESTED_VERSION: ${{ inputs.ROOTFS_VERSION }}
        run: |
          set -euo pipefail
          kci rootfs validate

          variant_args=(rootfs variants "$REQUESTED_NAME" --format json)
          if [[ "$REQUESTED_ARCH" != "all" ]]; then
            variant_args+=(--arch "$REQUESTED_ARCH")
          fi
          variants=$(kci "${variant_args[@]}")
          echo "matrix={\"include\":${variants}}" >> "$GITHUB_OUTPUT"

          version="$REQUESTED_VERSION"
          if [[ -z "$version" ]]; then
            version="$(date -u +%Y%m%d).0"
          fi
          if [[ ! "$version" =~ ^[0-9]{8}\.[0-9]+$ ]]; then
            echo "Invalid rootfs version: $version" >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

  build-and-publish:
    name: ${{ matrix.name }} / ${{ matrix.arch }}
    needs: prepare
    runs-on: ubuntu-latest
    environment: deploysecrets
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
    steps:
      - name: Check out requested KernelCI revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: ${{ inputs.GIT_REPO }}
          ref: ${{ inputs.GIT_BRANCH }}
          fetch-depth: 1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.11"
          cache: pip

      - name: Install checked-out KernelCI package
        run: python -m pip install .

      - name: Verify container engine
        run: docker version

      - name: Build rootfs
        env:
          ROOTFS_NAME: ${{ matrix.name }}
          ROOTFS_ARCH: ${{ matrix.arch }}
        run: |
          set -euo pipefail
          kci rootfs build "$ROOTFS_NAME" \
            --arch "$ROOTFS_ARCH" \
            --output-dir output \
            --cache-dir .cache/kernelci/rootfs \
            --pull always \
            --verbose

      - name: Publish rootfs to staging
        if: inputs.ROOTFS_DESTINATION == 'staging'
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345  # v1.0.0
        with:
          host: ${{ secrets.STAGING_HOST }}
          username: ${{ secrets.STAGING_USERNAME }}
          key: ${{ secrets.STAGING_KEY }}
          port: ${{ secrets.STAGING_PORT }}
          source: output/${{ matrix.name }}/${{ matrix.arch }}/*
          target: ${{ secrets.STAGING_DIR }}/${{ matrix.name }}/${{ needs.prepare.outputs.version }}/${{ matrix.arch }}
          strip_components: 3

      - name: Publish rootfs to production
        if: inputs.ROOTFS_DESTINATION == 'production'
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345  # v1.0.0
        with:
          host: ${{ secrets.PRODUCTION_HOST }}
          username: ${{ secrets.PRODUCTION_USERNAME }}
          key: ${{ secrets.PRODUCTION_KEY }}
          port: ${{ secrets.PRODUCTION_PORT }}
          source: output/${{ matrix.name }}/${{ matrix.arch }}/*
          target: ${{ secrets.PRODUCTION_DIR }}/${{ matrix.name }}/${{ needs.prepare.outputs.version }}/${{ matrix.arch }}
          strip_components: 3

      - name: Add published image to job summary
        env:
          ROOTFS_PUBLIC_URL: ${{ vars.ROOTFS_PUBLIC_URL }}
          ROOTFS_NAME: ${{ matrix.name }}
          ROOTFS_ARCH: ${{ matrix.arch }}
          ROOTFS_VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          echo "Rootfs: ${ROOTFS_PUBLIC_URL}/${ROOTFS_NAME}/${ROOTFS_VERSION}/${ROOTFS_ARCH}" >> "$GITHUB_STEP_SUMMARY"

  notify:
    if: always()
    needs:
      - prepare
      - build-and-publish
    runs-on: ubuntu-latest
    steps:
      - name: Report workflow result to Discord
        uses: Ilshidur/action-discord@d2594079a10f1d6739ee50a2471f0ca57418b554  # 0.4.0
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        with:
          args: >-
            Rootfs workflow for "${{ inputs.ROOTFS_NAME }}" completed with
            status "${{ needs.build-and-publish.result }}". Run:
            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}