_build-iso.yml

name: Build ISO

on:
  workflow_call:
    inputs:
      image-registry:
        required: true
        type: string
      image-name:
        required: true
        type: string
      image-tag:
        required: true
        type: string
      flatpak-manifest-lists:
        required: true
        type: string
      installer-version:
        required: true
        type: number
      upload-to-cloudflare:
        required: false
        type: boolean
        default: false
      r2-bucket:
        required: false
        type: string
      arch:
        required: false
        type: string
        default: x86_64

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Get Flatpak dependencies
        id: flatpak-dependencies
        env:
          IMAGE_FULL: ${{ inputs.image-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
        shell: bash
        run: |
          set -euox pipefail

          IMAGE="${IMAGE_FULL}"

          # Create temporary directory
          TEMP_FLATPAK_INSTALL_DIR=$(mktemp -d -p /tmp flatpak-XXXXXX)
          FLATPAK_REFS_DIR=./flatpak-refs
          FLATPAK_REFS_DIR_ABS=$(realpath "${FLATPAK_REFS_DIR}")
          mkdir -p "${FLATPAK_REFS_DIR}"

          # Combine the list of Flatpak manifests into a single file
          manifest_list=$(echo "${{ inputs.flatpak-manifest-lists }}" | sed '/^$/d')
          for manifest in $manifest_list; do
            cat "${manifest}" >> "${FLATPAK_REFS_DIR}/flatpaks.txt"
          done

          echo "Flatpak manifests combined into ${FLATPAK_REFS_DIR}/flatpaks.txt"
          cat "${FLATPAK_REFS_DIR}/flatpaks.txt"

          # Read the list of Flatpak packages from the manifest
          FLATPAK_REFS=()
          while IFS= read -r line; do
            FLATPAK_REFS+=("$line")
          done < "${FLATPAK_REFS_DIR}/flatpaks.txt"

          # Generate installation script
          cat <<EOF > "${TEMP_FLATPAK_INSTALL_DIR}/install-flatpaks.sh"
          mkdir -p /flatpak/flatpak /flatpak/triggers
          mkdir /var/tmp
          chmod -R 1777 /var/tmp
          flatpak config --system --set languages "*"
          flatpak remote-add --system flathub https://flathub.org/repo/flathub.flatpakrepo
          flatpak install --system -y flathub ${FLATPAK_REFS[@]}
          ostree refs --repo=\${FLATPAK_SYSTEM_DIR}/repo | grep '^deploy/' | grep -v 'org\.freedesktop\.Platform\.openh264' | sed 's/^deploy\///g' > /output/flatpaks-with-deps
          EOF
          docker run --rm --privileged \
            --entrypoint /bin/bash \
            -e FLATPAK_SYSTEM_DIR=/flatpak/flatpak \
            -e FLATPAK_TRIGGERS_DIR=/flatpak/triggers \
            -v ${FLATPAK_REFS_DIR_ABS}:/output \
            -v ${TEMP_FLATPAK_INSTALL_DIR}:/temp_flatpak_install_dir \
            ${IMAGE} /temp_flatpak_install_dir/install-flatpaks.sh
          docker rmi ${IMAGE}
          cat ${FLATPAK_REFS_DIR}/flatpaks-with-deps

          echo "FLATPAK_REFS_DIR=${FLATPAK_REFS_DIR}" >> $GITHUB_OUTPUT

      - name: Build ISO
        uses: jasonn3/build-container-installer@a1ce6da2d6c1af0561bec053366d0f3aa7e38743 # v1.2.3
        id: build-iso
        with:
          arch: ${{ inputs.arch }}
          image_name: ${{ inputs.image-name }}
          image_repo: ${{ inputs.image-registry }}
          image_tag: ${{ inputs.image-tag }}
          variant: Kinoite
          version: ${{ inputs.installer-version }}
          secure_boot_key_url: "https://github.com/rsturla/akmods/raw/main/_certs/public_key.der"
          enrollment_password: "password"
          iso_name: "${{ inputs.image-name }}-${{ inputs.image-tag }}-${{ inputs.arch }}.iso"
          enable_cache_dnf: false
          enable_cache_skopeo: false
          flatpak_remote_refs_dir: ${{ steps.flatpak-dependencies.outputs.FLATPAK_REFS_DIR }}
          enable_flatpak_dependencies: false

      - name: Upload ISO to GitHub
        if: inputs.upload-to-cloudflare == false
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
        with:
          name: ${{ inputs.image-name }}-${{ inputs.image-tag }}-${{ inputs.arch }}-iso
          path: |
            ${{ steps.build-iso.outputs.iso_path }}/${{ steps.build-iso.outputs.iso_name }}

      - name: Upload ISO to CloudFlare R2
        if: inputs.upload-to-cloudflare == true
        shell: bash
        env:
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          RCLONE_CONFIG_R2_REGION: auto
          RCLONE_CONFIG_R2_ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
          SOURCE_FILE: ${{ steps.build-iso.outputs.iso_path }}/${{ steps.build-iso.outputs.iso_name }}
          DEST_BUCKET: ${{ inputs.r2-bucket }}
        run: |
          sudo apt-get update
          sudo apt-get install -y rclone
          rclone copy $SOURCE_FILE R2:$DEST_BUCKET