Skip to content

Commit e11e6f6

Browse files
dylanmtaylordylanmtaylor
committed
feat: add Fedora 44 kernel build workflow
1 parent fcd9ba8 commit e11e6f6

1 file changed

Lines changed: 229 additions & 0 deletions

File tree

‎.github/workflows/fedora-44.yaml‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
name: Build (fedora 44)
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: 'Enter a tagged OGC kernel version in the format <kernel-version>-ogc<rev>'
8+
required: true
9+
push:
10+
tags:
11+
- 'v*'
12+
13+
env:
14+
OCI_REPO: ghcr.io/${{ github.repository }}-fedora
15+
16+
permissions:
17+
contents: read
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}
21+
cancel-in-progress: true
22+
23+
jobs:
24+
build-rpm:
25+
runs-on: ubuntu-latest
26+
27+
permissions:
28+
contents: read
29+
packages: write
30+
id-token: write
31+
attestations: write
32+
artifact-metadata: write
33+
34+
container:
35+
image: fedora:44
36+
volumes:
37+
- /usr:/usr-host
38+
- /opt:/opt-host
39+
options: --privileged
40+
41+
steps:
42+
- name: Prepare environment
43+
shell: bash
44+
run: |
45+
# Lowercase the image uri
46+
echo "OCI_REPO=${OCI_REPO,,}" >> ${GITHUB_ENV}
47+
48+
- name: Maximize build space
49+
run: |
50+
df -h
51+
rm -rf /usr-host/share/dotnet
52+
rm -rf /usr-host/share/swift
53+
rm -rf /usr-host/share/java
54+
rm -rf /usr-host/local/lib/android
55+
rm -rf /opt-host/ghc
56+
rm -rf /opt-host/hostedtoolcache
57+
rm -rf /opt-host/az
58+
df -h
59+
60+
- name: Checkout sources
61+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
62+
with:
63+
persist-credentials: false
64+
65+
- name: Get version
66+
id: version
67+
shell: bash
68+
run: |
69+
if [ -n "${{ github.event.inputs.version }}" ]; then
70+
OGC_VERSION="${{ github.event.inputs.version }}"
71+
else
72+
TAG="${{ github.ref_name }}"
73+
OGC_VERSION="${TAG#v}"
74+
fi
75+
KERNEL_VERSION="${OGC_VERSION%-ogc*}"
76+
MAJOR_VERSION="${KERNEL_VERSION%%.*}.x"
77+
OGC_REV="${OGC_VERSION##*-ogc}"
78+
BASE_KVER="${KERNEL_VERSION%.*}"
79+
STABLE_KVER="${KERNEL_VERSION##*.}"
80+
if [ "$STABLE_KVER" = "0" ]; then
81+
TAR_KVER="$BASE_KVER"
82+
else
83+
TAR_KVER="$KERNEL_VERSION"
84+
fi
85+
echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT"
86+
echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT"
87+
echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT"
88+
echo "ogc_rev=$OGC_REV" >> "$GITHUB_OUTPUT"
89+
echo "base_kver=$BASE_KVER" >> "$GITHUB_OUTPUT"
90+
echo "stable_kver=$STABLE_KVER" >> "$GITHUB_OUTPUT"
91+
echo "tar_kver=$TAR_KVER" >> "$GITHUB_OUTPUT"
92+
93+
- name: Setup ORAS
94+
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
95+
96+
- name: Get build number
97+
id: buildnum
98+
shell: bash
99+
run: |
100+
VERSION_PREFIX="${{ steps.version.outputs.ogc_version }}"
101+
REPO="${OCI_REPO,,}"
102+
EXISTING=$(oras repo tags "${REPO}" 2>/dev/null | { grep -cE "^${VERSION_PREFIX}\.[0-9]+$" || true; })
103+
BUILD_NUM=$((EXISTING + 1))
104+
echo "build_num=$BUILD_NUM" >> "$GITHUB_OUTPUT"
105+
echo "Build number: $BUILD_NUM"
106+
107+
- name: Substitute versions
108+
shell: bash
109+
run: |
110+
sed -i \
111+
-e "s/@@BASEKVER@@/${{ steps.version.outputs.base_kver }}/" \
112+
-e "s/@@STABLEKVER@@/${{ steps.version.outputs.stable_kver }}/" \
113+
-e "s/@@OGCVER@@/${{ steps.version.outputs.ogc_rev }}/" \
114+
-e "s/@@BUILDNUM@@/${{ steps.buildnum.outputs.build_num }}/" \
115+
fedora/kernel.spec
116+
117+
- name: Dependencies
118+
run: |
119+
dnf -y builddep fedora/kernel.spec
120+
dnf -y install gnupg2 jq sed wget
121+
122+
- name: Download and verify kernel source
123+
shell: bash
124+
run: |
125+
TAR_KVER="${{ steps.version.outputs.tar_kver }}"
126+
MAJOR_VERSION="${{ steps.version.outputs.major_version }}"
127+
OGC_VERSION="${{ steps.version.outputs.ogc_version }}"
128+
wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz
129+
wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign
130+
wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch
131+
wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch.sig
132+
# Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman)
133+
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \
134+
ABAF11C65A2970B130ABE3C479BE3E4300411886 \
135+
647F28654894E3BD457199BE38DBBDC86092693E
136+
# Import OGC patch signing key
137+
gpg --import $GITHUB_WORKSPACE/public.key
138+
# Verify kernel tarball signature
139+
xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign -
140+
# Verify OGC monolithic patch signature
141+
gpg --verify monolithic.patch.sig monolithic.patch
142+
tar -xf linux-${TAR_KVER}.tar.xz
143+
cd linux-${TAR_KVER}
144+
patch -Np1 < ../monolithic.patch
145+
146+
- name: Merge kernel configuration files
147+
uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1
148+
with:
149+
config: fedora/config
150+
set: |
151+
config/fedora.config.set
152+
config/ogc.config.set
153+
unset: |
154+
config/fedora.config.unset
155+
config/ogc.config.unset
156+
output: linux-${{ steps.version.outputs.tar_kver }}/.config
157+
158+
- name: Validate combined kernel config file
159+
shell: bash
160+
run: |
161+
cd linux-${{ steps.version.outputs.tar_kver }}
162+
make olddefconfig
163+
164+
- name: Build
165+
run: |
166+
TAR_KVER="${{ steps.version.outputs.tar_kver }}"
167+
TOPDIR="$(pwd)/rpmbuild"
168+
mkdir -p "$TOPDIR"/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
169+
# Pre-populate SOURCES with already-downloaded files
170+
cp linux-${TAR_KVER}.tar.xz "$TOPDIR/SOURCES/"
171+
cp monolithic.patch "$TOPDIR/SOURCES/"
172+
cp fedora/kvm_stat.logrotate "$TOPDIR/SOURCES/"
173+
# Copy patched config
174+
cp linux-${TAR_KVER}/.config "$TOPDIR/SOURCES/config"
175+
rpmbuild --define "_topdir $TOPDIR" -ba ./fedora/kernel.spec
176+
177+
- name: Setup Cosign
178+
if: startsWith(github.ref, 'refs/tags/')
179+
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
180+
181+
- name: Login to ghcr.io
182+
if: startsWith(github.ref, 'refs/tags/')
183+
run: |
184+
echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
185+
186+
- name: Push OCI artifact
187+
if: startsWith(github.ref, 'refs/tags/')
188+
id: push
189+
run: |
190+
VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
191+
REPO="${{ env.OCI_REPO }}"
192+
TOPDIR="$(pwd)/rpmbuild"
193+
mkdir -p /tmp/rpms
194+
cp "$TOPDIR"/RPMS/x86_64/*.rpm /tmp/rpms/ 2>/dev/null || true
195+
cp "$TOPDIR"/RPMS/noarch/*.rpm /tmp/rpms/ 2>/dev/null || true
196+
cd /tmp/rpms
197+
DIGEST=$(oras push --format json "${REPO}:${VERSION}-fc44" ./*.rpm | jq -r '.digest')
198+
if [ -z "$DIGEST" ]; then
199+
echo "::error::Failed to capture digest from oras push"
200+
exit 1
201+
fi
202+
oras tag "${REPO}:${VERSION}-fc44" latest-fc44
203+
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
204+
205+
- name: Sign artifacts
206+
if: startsWith(github.ref, 'refs/tags/')
207+
run: |
208+
VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
209+
REPO="${{ env.OCI_REPO }}"
210+
cosign sign --yes "${REPO}:${VERSION}-fc44"
211+
cosign sign --yes "${REPO}:latest-fc44"
212+
213+
- name: Attest build provenance
214+
if: startsWith(github.ref, 'refs/tags/')
215+
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
216+
with:
217+
subject-name: ${{ env.OCI_REPO }}
218+
subject-digest: ${{ steps.push.outputs.digest }}
219+
push-to-registry: true
220+
221+
- name: Verify signature
222+
if: startsWith(github.ref, 'refs/tags/')
223+
run: |
224+
VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
225+
REPO="${{ env.OCI_REPO }}"
226+
cosign verify \
227+
--certificate-identity-regexp=".*" \
228+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
229+
"${REPO}:${VERSION}-fc44"

0 commit comments

Comments
 (0)