fedora.yaml

name: Build (fedora)

on:
    workflow_dispatch:
        inputs:
            version:
                description: 'Enter a tagged OGC kernel version in the format <kernel-version>-ogc<rev>'
                required: true
    push:
        tags:
            - 'v*'

env:
    OCI_REPO: ghcr.io/${{ github.repository }}-fedora

permissions:
    contents: read

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

jobs:
    build-rpm:
        strategy:
            fail-fast: false
            matrix:
                fedora_version: [43, 44]
        runs-on: ubuntu-latest

        permissions:
            contents: read
            packages: write
            id-token: write
            attestations: write
            artifact-metadata: write

        container:
            image: fedora:${{ matrix.fedora_version }}
            volumes:
                - /usr:/usr-host
                - /opt:/opt-host
            options: --privileged

        steps:
            - name: Prepare environment
              shell: bash
              run: |
                # Lowercase the image uri
                echo "OCI_REPO=${OCI_REPO,,}" >> ${GITHUB_ENV}

            - name: Maximize build space
              run: |
                  df -h
                  rm -rf /usr-host/share/dotnet
                  rm -rf /usr-host/share/swift
                  rm -rf /usr-host/share/java
                  rm -rf /usr-host/local/lib/android
                  rm -rf /opt-host/ghc
                  rm -rf /opt-host/hostedtoolcache
                  rm -rf /opt-host/az
                  df -h

            - name: Checkout sources
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false

            - name: Get version
              id: version
              shell: bash
              run: |
                  if [ -n "${{ github.event.inputs.version }}" ]; then
                    OGC_VERSION="${{ github.event.inputs.version }}"
                  else
                    TAG="${{ github.ref_name }}"
                    OGC_VERSION="${TAG#v}"
                  fi
                  KERNEL_VERSION="${OGC_VERSION%-ogc*}"
                  MAJOR_VERSION="${KERNEL_VERSION%%.*}.x"
                  OGC_REV="${OGC_VERSION##*-ogc}"
                  BASE_KVER="${KERNEL_VERSION%.*}"
                  STABLE_KVER="${KERNEL_VERSION##*.}"
                  if [ "$STABLE_KVER" = "0" ]; then
                    TAR_KVER="$BASE_KVER"
                  else
                    TAR_KVER="$KERNEL_VERSION"
                  fi
                  echo "ogc_version=$OGC_VERSION" >> "$GITHUB_OUTPUT"
                  echo "kernel_version=$KERNEL_VERSION" >> "$GITHUB_OUTPUT"
                  echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT"
                  echo "ogc_rev=$OGC_REV" >> "$GITHUB_OUTPUT"
                  echo "base_kver=$BASE_KVER" >> "$GITHUB_OUTPUT"
                  echo "stable_kver=$STABLE_KVER" >> "$GITHUB_OUTPUT"
                  echo "tar_kver=$TAR_KVER" >> "$GITHUB_OUTPUT"

            - name: Setup ORAS
              uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1

            - name: Compute content hash
              id: content-hash
              shell: bash
              run: |
                  HASH=$(
                    {
                      echo "ogc_version=${{ steps.version.outputs.ogc_version }}"
                      echo "fedora_version=${{ matrix.fedora_version }}"
                      sha256sum \
                        fedora/kernel.spec \
                        fedora/config \
                        fedora/kvm_stat.logrotate \
                        config/fedora.config.set \
                        config/ogc.config.set \
                        config/fedora.config.unset \
                        config/ogc.config.unset \
                        .github/workflows/fedora.yaml
                    } | sha256sum | cut -d' ' -f1
                  )
                  SHORT_HASH="${HASH:0:12}"
                  echo "hash=$SHORT_HASH" >> "$GITHUB_OUTPUT"
                  echo "Content hash: $SHORT_HASH"

            - name: Check for existing build
              id: check-existing
              shell: bash
              run: |
                  REPO="${OCI_REPO,,}"
                  TAG="sha-${{ steps.content-hash.outputs.hash }}-fc${{ matrix.fedora_version }}"
                  if oras manifest fetch "${REPO}:${TAG}" > /dev/null 2>&1; then
                    echo "exists=true" >> "$GITHUB_OUTPUT"
                    echo "::notice::Skipping build, artifact with content hash ${TAG} already exists"
                  else
                    echo "exists=false" >> "$GITHUB_OUTPUT"
                    echo "No existing artifact for ${TAG}, proceeding with build"
                  fi

            - name: Get build number
              if: steps.check-existing.outputs.exists != 'true'
              id: buildnum
              shell: bash
              run: |
                  VERSION_PREFIX="${{ steps.version.outputs.ogc_version }}"
                  REPO="${OCI_REPO,,}"
                  EXISTING=$(oras repo tags "${REPO}" 2>/dev/null || true)
                  EXISTING=$(echo "$EXISTING" | { grep -cE "^${VERSION_PREFIX}\.[0-9]+-fc${{ matrix.fedora_version }}$" || true; })
                  BUILD_NUM=$((EXISTING + 1))
                  echo "build_num=$BUILD_NUM" >> "$GITHUB_OUTPUT"
                  echo "Build number: $BUILD_NUM"

            - name: Substitute versions
              if: steps.check-existing.outputs.exists != 'true'
              shell: bash
              run: |
                  sed -i \
                    -e "s/@@BASEKVER@@/${{ steps.version.outputs.base_kver }}/" \
                    -e "s/@@STABLEKVER@@/${{ steps.version.outputs.stable_kver }}/" \
                    -e "s/@@OGCVER@@/${{ steps.version.outputs.ogc_rev }}/" \
                    -e "s/@@BUILDNUM@@/${{ steps.buildnum.outputs.build_num }}/" \
                    fedora/kernel.spec

            - name: Dependencies
              if: steps.check-existing.outputs.exists != 'true'
              run: |
                  dnf -y builddep fedora/kernel.spec
                  dnf -y install gnupg2 jq sed wget

            - name: Build dwarves from source
              if: steps.check-existing.outputs.exists != 'true'
              shell: bash
              run: |
                  # Fedora ships pahole 1.30, which breaks sched_ext. Fixed in 1.31.
                  dnf -y install cmake make gcc elfutils-devel zlib-devel
                  wget https://fedorapeople.org/~acme/dwarves/dwarves-1.31.tar.xz
                  echo "0a7f255ccacf8cc7f8cd119099eb327179b4b3c67cb015af646af6d0cb03054d  dwarves-1.31.tar.xz" | sha256sum -c
                  tar -xf dwarves-1.31.tar.xz
                  cmake -B dwarves-1.31/build -S dwarves-1.31 \
                    -DCMAKE_BUILD_TYPE=Release \
                    -DCMAKE_INSTALL_PREFIX=/usr \
                    -D__LIB=lib
                  make -C dwarves-1.31/build -j"$(nproc)" install
                  command -v pahole
                  pahole --version

            - name: Download and verify kernel source
              if: steps.check-existing.outputs.exists != 'true'
              shell: bash
              run: |
                  TAR_KVER="${{ steps.version.outputs.tar_kver }}"
                  MAJOR_VERSION="${{ steps.version.outputs.major_version }}"
                  OGC_VERSION="${{ steps.version.outputs.ogc_version }}"
                  wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.xz
                  wget https://cdn.kernel.org/pub/linux/kernel/v${MAJOR_VERSION}/linux-${TAR_KVER}.tar.sign
                  wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch
                  wget https://github.com/OpenGamingCollective/linux/releases/download/v${OGC_VERSION}/monolithic.patch.sig
                  # Import kernel.org signing keys (Linus Torvalds & Greg Kroah-Hartman)
                  gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys \
                    ABAF11C65A2970B130ABE3C479BE3E4300411886 \
                    647F28654894E3BD457199BE38DBBDC86092693E
                  # Import OGC patch signing key
                  gpg --import $GITHUB_WORKSPACE/public.key
                  # Verify kernel tarball signature
                  xz -dc linux-${TAR_KVER}.tar.xz | gpg --verify linux-${TAR_KVER}.tar.sign -
                  # Verify OGC monolithic patch signature
                  gpg --verify monolithic.patch.sig monolithic.patch
                  tar -xf linux-${TAR_KVER}.tar.xz
                  cd linux-${TAR_KVER}
                  patch -Np1 < ../monolithic.patch

            - name: Merge kernel configuration files
              if: steps.check-existing.outputs.exists != 'true'
              uses: OpenGamingCollective/kernel-configurator@5b4abc58a2edf89941180dbbe33b26415db23b0b # v1.0.1
              with:
                  config: fedora/config
                  set: |
                      config/fedora.config.set
                      config/ogc.config.set
                  unset: |
                      config/fedora.config.unset
                      config/ogc.config.unset
                  output: linux-${{ steps.version.outputs.tar_kver }}/.config

            - name: Validate combined kernel config file
              if: steps.check-existing.outputs.exists != 'true'
              shell: bash
              run: |
                  cd linux-${{ steps.version.outputs.tar_kver }}
                  make olddefconfig

            - name: Build
              if: steps.check-existing.outputs.exists != 'true'
              run: |
                  TAR_KVER="${{ steps.version.outputs.tar_kver }}"
                  TOPDIR="$(pwd)/rpmbuild"
                  mkdir -p "$TOPDIR"/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
                  # Pre-populate SOURCES with already-downloaded files
                  cp linux-${TAR_KVER}.tar.xz "$TOPDIR/SOURCES/"
                  cp monolithic.patch "$TOPDIR/SOURCES/"
                  cp fedora/kvm_stat.logrotate "$TOPDIR/SOURCES/"
                  # Copy patched config
                  cp linux-${TAR_KVER}/.config "$TOPDIR/SOURCES/config"
                  rpmbuild --define "_topdir $TOPDIR" -ba ./fedora/kernel.spec

            - name: Setup Cosign
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

            - name: Login to ghcr.io
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              run: |
                  echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin

            - name: Push OCI artifact
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              id: push
              run: |
                  VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
                  REPO="${{ env.OCI_REPO }}"
                  TOPDIR="$(pwd)/rpmbuild"
                  mkdir -p /tmp/rpms
                  cp "$TOPDIR"/RPMS/x86_64/*.rpm /tmp/rpms/ 2>/dev/null || true
                  cp "$TOPDIR"/RPMS/noarch/*.rpm /tmp/rpms/ 2>/dev/null || true
                  cd /tmp/rpms
                  DIGEST=$(oras push --format json "${REPO}:${VERSION}-fc${{ matrix.fedora_version }}" ./*.rpm | jq -r '.digest')
                  if [ -z "$DIGEST" ]; then
                      echo "::error::Failed to capture digest from oras push"
                      exit 1
                  fi
                  oras tag "${REPO}:${VERSION}-fc${{ matrix.fedora_version }}" latest-fc${{ matrix.fedora_version }}
                  echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

            - name: Tag with content hash
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              run: |
                  REPO="${{ env.OCI_REPO }}"
                  VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
                  oras tag "${REPO}:${VERSION}-fc${{ matrix.fedora_version }}" \
                    "sha-${{ steps.content-hash.outputs.hash }}-fc${{ matrix.fedora_version }}"

            - name: Sign artifacts
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              run: |
                  VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
                  REPO="${{ env.OCI_REPO }}"
                  cosign sign --yes "${REPO}:${VERSION}-fc${{ matrix.fedora_version }}"
                  cosign sign --yes "${REPO}:latest-fc${{ matrix.fedora_version }}"

            - name: Attest build provenance
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
              with:
                  subject-name: ${{ env.OCI_REPO }}
                  subject-digest: ${{ steps.push.outputs.digest }}
                  push-to-registry: true

            - name: Verify signature
              if: startsWith(github.ref, 'refs/tags/') && steps.check-existing.outputs.exists != 'true'
              run: |
                  VERSION="${{ steps.version.outputs.ogc_version }}.${{ steps.buildnum.outputs.build_num }}"
                  REPO="${{ env.OCI_REPO }}"
                  cosign verify \
                    --certificate-identity-regexp=".*" \
                    --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
                    "${REPO}:${VERSION}-fc${{ matrix.fedora_version }}"