Build HackerOS (Immutable) #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build HackerOS (Immutable) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| edition: | |
| description: "Edycja immutable do zbudowania (obie uzywaja hackeros-builder, NIE live-build)" | |
| required: true | |
| default: "atomic" | |
| type: choice | |
| options: | |
| - atomic | |
| - cybersecurity-default | |
| hackeros_builder_source: | |
| description: >- | |
| Skad wziac narzedzie hackeros-builder. "source" = git clone + go mod | |
| vendor + make (zawsze aktualne, dluzej trwa). "latest-release" / | |
| "specific-release" = pobranie gotowej binarki z GitHub Releases repo | |
| HackerOS-Builder (szybciej, wymaga zeby to repo faktycznie | |
| publikowalo asset "hackeros-builder" w wydaniu). | |
| required: true | |
| default: "source" | |
| type: choice | |
| options: | |
| - source | |
| - latest-release | |
| - specific-release | |
| hackeros_builder_version: | |
| description: >- | |
| Tag wydania hackeros-builder do pobrania (np. "v0.3.0") -- UZYWANE | |
| WYLACZNIE gdy powyzej wybrano "specific-release". Ignorowane dla | |
| "source" i "latest-release". | |
| required: false | |
| default: "" | |
| type: string | |
| build_target: | |
| description: >- | |
| Co ma zbudowac hackeros-builder. "all" = obraz OCI + ISO (domyslnie). | |
| "cloud" = tylko obraz OCI (push do registry, bez ISO/Calamares). | |
| "iso" = tylko ISO -- zaklada ze obraz OCI dla tagu z config/config.hk | |
| juz istnieje w registry (np. z wczesniejszego uruchomienia z | |
| build_target=cloud). | |
| required: true | |
| default: "all" | |
| type: choice | |
| options: | |
| - all | |
| - cloud | |
| - iso | |
| env: | |
| LUA_VERSION: "5.5.0" | |
| HACKEROS_BUILDER_REPO: "HackerOS-Linux-System/HackerOS-Builder" | |
| jobs: | |
| build: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 360 | |
| steps: | |
| - name: Checkout repozytorium | |
| uses: actions/checkout@v4 | |
| - name: Odczyt wersji z config.hk | |
| id: version | |
| run: | | |
| VERSION=$(awk -F'=>' '/version[[:space:]]*=>/ { gsub(/[[:space:]]/, "", $NF); print $NF }' config.hk | head -n1) | |
| if [ -z "$VERSION" ]; then | |
| echo "Nie udało się odczytać wersji z ./config.hk (oczekiwany format: 'version => X.Y' pod [metadata])" >&2 | |
| exit 1 | |
| fi | |
| echo "Wersja odczytana z config.hk: $VERSION" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Aktualizacja listy pakietów | |
| run: sudo apt-get update | |
| - name: Instalacja podstawowych narzędzi | |
| run: | | |
| sudo apt-get install -y --no-install-recommends \ | |
| tar \ | |
| git \ | |
| curl \ | |
| ca-certificates \ | |
| build-essential \ | |
| make \ | |
| gcc \ | |
| libreadline-dev | |
| - name: Instalacja Pythona 3.13 (deadsnakes PPA) | |
| run: | | |
| sudo apt-get install -y software-properties-common | |
| sudo add-apt-repository -y ppa:deadsnakes/ppa | |
| sudo apt-get update | |
| sudo apt-get install -y python3.13 python3.13-venv python3.13-dev | |
| - name: Budowa i instalacja Lua ${{ env.LUA_VERSION }} ze źródeł | |
| run: | | |
| curl -fL -o "lua-${LUA_VERSION}.tar.gz" \ | |
| "https://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz" | |
| tar -xzf "lua-${LUA_VERSION}.tar.gz" | |
| cd "lua-${LUA_VERSION}" | |
| make linux -j"$(nproc)" | |
| sudo make install | |
| cd .. | |
| # Domyślny "make install" Lua instaluje binarki jako `lua`/`luac` | |
| # (bez numeru wersji), a nasz workflow oraz build.lua wywołują | |
| # jawnie `lua5.5`. Tworzymy symlinki, żeby `lua5.5`/`luac5.5` | |
| # wskazywały na świeżo zbudowaną instalację. | |
| sudo ln -sf "$(command -v lua)" /usr/local/bin/lua5.5 | |
| sudo ln -sf "$(command -v luac)" /usr/local/bin/luac5.5 | |
| hash -r | |
| lua5.5 -v | |
| - name: Instalacja narzędzi hackeros-builder (debootstrap, squashfs, GRUB, xorriso) | |
| run: | | |
| # W przeciwieństwie do build.yml (edycje live-build), TA edycja NIE | |
| # używa "lb build" w żadnym momencie -- hackeros-builder buduje | |
| # rootfs sam (debootstrap + sandbox), a ISO przez grub-mkrescue | |
| # (BIOS+UEFI hybrid), nie przez isolinux/syslinux. Nie instalujemy | |
| # więc live-build ani isolinux/syslinux/devscripts/debhelper/po4a -- | |
| # tylko realne zależności hackeros-builder (patrz | |
| # internal/preflight/check.go w repo HackerOS-Builder). | |
| sudo apt-get install -y --no-install-recommends \ | |
| debootstrap \ | |
| debian-archive-keyring \ | |
| squashfs-tools \ | |
| xorriso \ | |
| dosfstools \ | |
| mtools \ | |
| grub-pc-bin \ | |
| grub-efi-amd64-bin \ | |
| grub-efi-ia32-bin | |
| - name: Instalacja Go | |
| # Zawsze potrzebne -- albo do zbudowania hackeros-builder ze źródeł | |
| # (hackeros_builder_source=source), albo po prostu bo Go jest tanie | |
| # w instalacji i część toolingu może z niego korzystać pośrednio. | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.22" | |
| - name: Pozyskanie hackeros-builder (źródło = ${{ inputs.hackeros_builder_source }}) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -e | |
| case "${{ inputs.hackeros_builder_source }}" in | |
| source) | |
| # 1. git clone 2. go mod tidy (dogenerowuje go.sum -- nie jest | |
| # commitowany w repo) 3. go mod vendor 4. make (offline, | |
| # -mod=vendor) | |
| rm -rf /tmp/hackeros-builder-src | |
| git clone --depth 1 "https://github.com/${HACKEROS_BUILDER_REPO}.git" /tmp/hackeros-builder-src | |
| cd /tmp/hackeros-builder-src | |
| go mod tidy | |
| go mod vendor | |
| make | |
| sudo install -Dm755 hackeros-builder /usr/local/bin/hackeros-builder | |
| cd - | |
| ;; | |
| latest-release) | |
| echo "Pobieranie najnowszego wydania hackeros-builder z GitHub Releases..." | |
| URL="https://github.com/${HACKEROS_BUILDER_REPO}/releases/latest/download/hackeros-builder" | |
| if ! curl -fL -o /tmp/hackeros-builder "$URL"; then | |
| echo "Blad: nie udalo sie pobrac $URL" >&2 | |
| echo "Upewnij sie, ze repo ${HACKEROS_BUILDER_REPO} publikuje w wydaniach" >&2 | |
| echo "(GitHub Releases) asset o nazwie dokladnie 'hackeros-builder'" >&2 | |
| echo "(statyczna binarka linux/amd64), albo uzyj hackeros_builder_source=source." >&2 | |
| exit 1 | |
| fi | |
| sudo install -Dm755 /tmp/hackeros-builder /usr/local/bin/hackeros-builder | |
| ;; | |
| specific-release) | |
| VERSION_TAG="${{ inputs.hackeros_builder_version }}" | |
| if [ -z "$VERSION_TAG" ]; then | |
| echo "Blad: hackeros_builder_source=specific-release wymaga podania" >&2 | |
| echo "'hackeros_builder_version' (np. v0.3.0) w parametrach uruchomienia." >&2 | |
| exit 1 | |
| fi | |
| echo "Pobieranie hackeros-builder $VERSION_TAG z GitHub Releases..." | |
| URL="https://github.com/${HACKEROS_BUILDER_REPO}/releases/download/${VERSION_TAG}/hackeros-builder" | |
| if ! curl -fL -o /tmp/hackeros-builder "$URL"; then | |
| echo "Blad: nie udalo sie pobrac $URL" >&2 | |
| echo "Sprawdz, czy tag '$VERSION_TAG' istnieje i czy to wydanie" >&2 | |
| echo "publikuje asset o nazwie dokladnie 'hackeros-builder'." >&2 | |
| exit 1 | |
| fi | |
| sudo install -Dm755 /tmp/hackeros-builder /usr/local/bin/hackeros-builder | |
| ;; | |
| *) | |
| echo "Blad: nieznana wartosc hackeros_builder_source: '${{ inputs.hackeros_builder_source }}'" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| hackeros-builder --version || true | |
| - name: Uruchomienie build.lua (edycja - ${{ inputs.edition }}, target - ${{ inputs.build_target }}) | |
| env: | |
| # Sekret GitHub Actions o nazwie "cybersecurity-default" (token | |
| # classic z uprawnieniami do org HackerOS-Linux-System) - używany | |
| # wyłącznie przez build/build-hackeros-cybersecurity-default do | |
| # wypełnienia [auth] -> token w config/config.hk. Nieużywany gdy | |
| # edition=atomic (skrypt build-hackeros-atomic go ignoruje). | |
| CYBERSECURITY_DEFAULT_TOKEN: ${{ secrets.CYBERSECURITY_DEFAULT_TOKEN }} | |
| # Sekret GitHub Actions o nazwie "ATOMIC_TOKEN" - używany wyłącznie | |
| # przez build/build-hackeros-atomic. Nieużywany gdy | |
| # edition=cybersecurity-default. | |
| ATOMIC_TOKEN: ${{ secrets.ATOMIC_TOKEN }} | |
| # Przekazywane do build-hackeros-atomic / build-hackeros-cybersecurity-default, | |
| # które wywołują "hackeros-builder ... build <HACKEROS_BUILD_TARGET>" | |
| # zamiast zawsze twardo "build all". | |
| HACKEROS_BUILD_TARGET: ${{ inputs.build_target }} | |
| run: | | |
| chmod +x build.lua | |
| lua5.5 build.lua --${{ inputs.edition }} | |
| - name: Wyszukanie zbudowanych obrazów ISO | |
| id: find_iso | |
| run: | | |
| echo "iso_found=$(find . -maxdepth 3 -iname '*.iso' | head -n1)" >> "$GITHUB_OUTPUT" | |
| - name: Zmiana nazwy obrazu ISO | |
| id: rename_iso | |
| if: steps.find_iso.outputs.iso_found != '' | |
| run: | | |
| SRC="${{ steps.find_iso.outputs.iso_found }}" | |
| DEST="HackerOS-V${{ steps.version.outputs.version }}-${{ inputs.edition }}.iso" | |
| mv -- "$SRC" "$DEST" | |
| echo "Zmieniono nazwę: $SRC -> $DEST" | |
| echo "iso_path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Wygenerowanie sum kontrolnych obrazu ISO (SHA256 / SHA512) | |
| id: checksums | |
| if: steps.find_iso.outputs.iso_found != '' | |
| run: | | |
| ISO="${{ steps.rename_iso.outputs.iso_path }}" | |
| sha256sum "$ISO" > "${ISO}.sha256sum" | |
| sha512sum "$ISO" > "${ISO}.sha512sum" | |
| echo "--- ${ISO}.sha256sum ---" | |
| cat "${ISO}.sha256sum" | |
| echo "--- ${ISO}.sha512sum ---" | |
| cat "${ISO}.sha512sum" | |
| - name: Wgranie ISO jako artefaktu builda | |
| if: steps.find_iso.outputs.iso_found != '' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: HackerOS-V${{ steps.version.outputs.version }}-${{ inputs.edition }} | |
| path: | | |
| ${{ steps.rename_iso.outputs.iso_path }} | |
| ${{ steps.rename_iso.outputs.iso_path }}.sha256sum | |
| ${{ steps.rename_iso.outputs.iso_path }}.sha512sum | |
| if-no-files-found: warn | |
| - name: Informacja gdy zbudowano tylko obraz OCI (build_target=cloud) | |
| if: steps.find_iso.outputs.iso_found == '' | |
| run: | | |
| echo "build_target='${{ inputs.build_target }}' nie generuje pliku ISO -- " \ | |
| "sprawdź logi kroku 'Uruchomienie build.lua' po status wypchnięcia obrazu OCI do registry." |