build.yml

name: Build

on:
  pull_request:
    # Build on changes to this workflow files in PRs to test proposed changes
    paths:
      - '.github/workflows/build.yml'
  push:
    branches:
      - main
      - dev
  workflow_dispatch:
    inputs:
      os-ref:
        description: The seedsigner-os ref (tag/branch/sha1) to use
        default: main
        required: true

# Explicitly restrict the auto-provisioned GITHUB_TOKEN to the least privilege required
# for this workflow.
permissions:
  contents: read

# Cancel superseded runs on the same branch/PR. Intermediate builds on dev/main
# have no downstream consumers (official releases are built offline), so only
# the latest commit per ref needs to be built.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

# Increment this number as part of a PR to trigger an image build for the PR
# trigger = 0

jobs:
  build:
    name: build
    runs-on: ubuntu-latest
    timeout-minutes: 120
    # Prevent resource consuming cron triggered runs in forks
    if: (!github.event.repository.fork || github.event_name == 'workflow_dispatch')
    strategy:
      fail-fast: false
      matrix:
        target: [ "pi0", "pi2", "pi02w", "pi4" ]
    steps:
      - name: checkout seedsigner-os
        uses: actions/checkout@v4
        with:
          repository: "seedsigner/seedsigner-os"
          # use the os-ref input parameter in case of workflow_dispatch or default to main in case of cron triggers
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.os-ref || 'main' }}
          submodules: true
          path: "seedsigner-os"
          # get full history + tags for "git describe"
          fetch-depth: 0

      - name: checkout source
        uses: actions/checkout@v4
        with:
          # ref defaults to repo default-branch=dev (cron) or SHA of event (workflow_dispatch)
          path: "seedsigner-os/opt/rootfs-overlay/opt"
          # get full history + tags for "git describe"
          fetch-depth: 0

      - name: Get and set meta data
        run: |
          # The builder_hash (seedsigner-os hash) for the cache action step key
          echo "builder_hash=$(git -C seedsigner-os rev-parse --short HEAD)"| tee -a $GITHUB_ENV

          # Derive tag based versions, like 0.7.0-40-g0424967 (=$tag-$number-of-commits-since-tag-$short-sha1),
          # or just e.g. 0.7.0, if we are exactly on a 0.7.0 tagged commit.
          # --always to fall back to commit sha, if no tag present like in partial forks of the repo
          os_version="$(git -C seedsigner-os describe --tags --always)"
          source_version="$(git -C seedsigner-os/opt/rootfs-overlay/opt describe --tags --always)"

          # Combine seedsigner and seedsigner-os version into one version string and squash the versions, if
          # they are identical: So os_version=0.7.0 + source_version=0.7.0 combine to just only "0.7.0",
          # whereas os_version=0.6.0-61-g9fafebe + source_version=0.7.0-40-g0424967 combine to "os0.6.0-61-g9fafebe_sw0.7.0-40-g0424967"
          if [ "${os_version}" = "${source_version}" ]; then
            # seedsigner + seedsigner_os have the same tag
            echo "img_version=${source_version}"| tee -a $GITHUB_ENV
          else
            echo "img_version=os${os_version}_sw${source_version}"| tee -a $GITHUB_ENV
          fi

      # NOTE: trimming the overlay down to src/ is deliberately left to seedsigner-os
      # build.sh (delete_unnecessary_files). It needs the .git/ and tools/ we would
      # otherwise delete here in order to write version.json first.

      - name: restore build cache
        uses: actions/cache@v4
        # Caching reduces the build time to ~50% (currently: ~30 mins instead of ~1 hour,
        # while consuming ~850 MB storage space).
        with:
          path: |
            ~/.buildroot-ccache/
            seedsigner-os/buildroot_dl
          key: build-cache-${{ matrix.target }}-${{ env.builder_hash }}
          restore-keys: |
            build-cache-${{ matrix.target }}-

      - name: Create build container
        run: |
          cd seedsigner-os
          docker build -t seedsigner-os-build .

      - name: build
        run: |
          mkdir -p \
            ~/.buildroot-ccache \
            seedsigner-os/buildroot_dl
          docker run \
            --rm \
            -v "$(pwd)/seedsigner-os/opt:/opt" \
            -v "$(pwd)/seedsigner-os/images:/images" \
            -v "$(pwd)/seedsigner-os/buildroot_dl:/buildroot_dl" \
            -v "${HOME}/.buildroot-ccache:/root/.buildroot-ccache" \
            seedsigner-os-build \
            --${{ matrix.target }} --skip-repo --no-clean
          sudo chown -R $USER:$USER seedsigner-os/images seedsigner-os/buildroot_dl ~/.buildroot-ccache/

      # version.json is written by seedsigner-os build.sh. If it is missing or has a
      # null field the app raises at the splash screen, which looks like an
      # unrecoverable boot hang, so fail the build rather than publish the image.
      - name: verify version.json
        working-directory: seedsigner-os/opt/rootfs-overlay/opt
        run: |
          cat src/seedsigner/version.json
          jq -e '.name and .fork and .short_commit_hash and .timestamp' src/seedsigner/version.json

      - name: list image (before rename)
        run: |
          ls -la seedsigner-os/images

      - name: rename image
        run: |
          cd seedsigner-os/images
          mv seedsigner_os*.img seedsigner_os.${{ env.img_version }}.${{ matrix.target }}.img

      - name: print sha256sum
        run: |
          cd seedsigner-os/images
          sha256sum *.img

      - name: list image (after rename)
        run: |
          ls -la seedsigner-os/images

      - name: upload images
        uses: actions/upload-artifact@v4
        with:
          name: seedsigner_os_images-${{ matrix.target }}
          path: "seedsigner-os/images/*.img"
          if-no-files-found: error
          # maximum 90 days retention
          retention-days: 90

  sha256sum:
    name: calculate sha256sum
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: download images
        uses: actions/download-artifact@v4
        with:
          path: images

      - name: list images
        run: |
          ls -lRa images

      - name: get seedsigner latest commit hash
        run: echo "source_hash=${GITHUB_SHA::7}" >> $GITHUB_ENV

      - name: write sha256sum
        run: |
          cd images
          # each downloaded image is in its own subfolder
          find . -name "*.img" -exec mv {} . \;
          sha256sum *.img > seedsigner_os.${{ env.source_hash }}.sha256

      - name: upload checksums
        uses: actions/upload-artifact@v4
        with:
          name: seedsigner_os_images_sha256
          path: "images/*.sha256"
          if-no-files-found: error
          # maximum 90 days retention
          retention-days: 90