diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8ac6b8c..5ace460 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,4 +3,4 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "monthly" + interval: "weekly" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..e7db14b --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,54 @@ +name: Release + +on: + push: + tags: + - '*' + workflow_dispatch: + +env: + REGISTRY_USER: ${{ github.actor }} + REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} + +jobs: + verify-image: + runs-on: ubuntu-latest + + steps: + - name: Verify Base Image Integrity + run: + gh attestation verify oci://ghcr.io/vanilla-os/pico:main --owner Vanilla-OS + env: + GH_TOKEN: ${{ github.token }} + + release: + runs-on: ubuntu-latest + needs: verify-image + permissions: + contents: write # Allow actions to create release + attestations: write # To create and write attestations + id-token: write # Additional permissions for the persistence of the attestations + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: vanilla-os/vib-gh-action@v0.7.4 + + - uses: actions/upload-artifact@v4 + with: + name: Containerfile + path: Containerfile + + - name: Create Release + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh release create "${{ github.ref_name }}" --generate-notes Containerfile + + - name: Attest Release Files + id: attest + uses: actions/attest-build-provenance@v1 + with: + subject-path: 'Containerfile' diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1ca57e6 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +Containerfile +downloads/ +plugins/ +sources/ diff --git a/README.md b/README.md index 75df42f..4e6717a 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ podman image build -t vanillaos/dev . ## Verify Image Build Provenance Attestation -All the image builds/pushes are attested for build provenance and integrity using the [attest-build-provenance`](https://github.com/actions/attest-build-provenance) action. The attestations can be verified [here](https://github.com/Vanilla-OS/dev-image/attestations) or by having the latest version of [GitHub CLI](https://github.com/cli/cli/releases/latest) installed in your system. Then, execute the following command: +All the image builds/pushes are attested for build provenance and integrity using the [attest-build-provenance](https://github.com/actions/attest-build-provenance) action. The attestations can be verified [here](https://github.com/Vanilla-OS/dev-image/attestations) or by having the latest version of [GitHub CLI](https://github.com/cli/cli/releases/latest) installed in your system. Then, execute the following command: ```sh gh attestation verify oci://ghcr.io/vanilla-os/dev:main --owner Vanilla-OS diff --git a/modules/101-abroot-deps.yml b/modules/101-abroot-deps.yml index 28666a6..42f30e5 100644 --- a/modules/101-abroot-deps.yml +++ b/modules/101-abroot-deps.yml @@ -5,5 +5,5 @@ source: - libbtrfs-dev - libdevmapper-dev - libgpgme-dev - - pkg-config build-essential + - pkg-config - libdpkg-dev diff --git a/modules/20-build-tools.yml b/modules/20-build-tools.yml index 9dd0b90..6f14642 100644 --- a/modules/20-build-tools.yml +++ b/modules/20-build-tools.yml @@ -3,7 +3,6 @@ type: apt source: packages: - meson - - build-essential - ninja-build - cmake - clang diff --git a/modules/200-vib.yml b/modules/200-vib.yml new file mode 100644 index 0000000..9512638 --- /dev/null +++ b/modules/200-vib.yml @@ -0,0 +1,10 @@ +name: vib +type: shell +source: + type: file + url: https://github.com/Vanilla-OS/Vib/releases/download/v0.7.4/vib + checksum: 8f95d449cacedcac7bb38f7cfd422689fa5a800c10580e663dea7384473c767f +commands: + - mkdir -p /usr/bin + - cp /sources/vib/vib /usr/bin/vib + - chmod +x /usr/bin/vib diff --git a/recipe.yml b/recipe.yml index c3bbc35..2e0398a 100644 --- a/recipe.yml +++ b/recipe.yml @@ -24,12 +24,17 @@ stages: - modules/30-gtk.yml - modules/40-rust.yml - modules/100-apx-gui-deps.yml + - modules/101-abroot-deps.yml + - modules/200-vib.yml - name: host-spawn type: shell + source: + type: file + url: https://github.com/1player/host-spawn/releases/download/v1.6.0/host-spawn-x86_64 + checksum: 75159f0d3924a0bd6d230c6414d19ad44609b5a16671db6624681c910f9bb4ff commands: - - wget https://github.com/1player/host-spawn/releases/download/v1.6.0/host-spawn-x86_64 - - mv host-spawn-x86_64 /usr/bin/host-spawn + - cp /sources/host-spawn/host-spawn /usr/bin/host-spawn - chmod +x /usr/bin/host-spawn - name: cleanup