build-image.yml

name: Build VyOS Image

on: workflow_dispatch

permissions:
  contents: write

env:
  BUILD_BY: connect@to.yeahnet.dev
  DEBIAN_MIRROR: http://deb.debian.org/debian/
  DEBIAN_SECURITY_MIRROR: http://deb.debian.org/debian-security
  VYOS_MIRROR: https://packages.vyos.net/repositories/current/

jobs:
  base-build:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    container:
      image: vyos/vyos-build:current
      options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
    outputs:
      BUILD_BY: ${{ steps.set_env_variables.outputs.BUILD_BY }}
      build_version: ${{ steps.set_env_variables.outputs.build_version }}
      TIMESTAMP: ${{ steps.set_env_variables.outputs.TIMESTAMP }}
      PREVIOUS_SUCCESS_BUILD_TIMESTAMP: ${{ steps.set_env_variables.outputs.PREVIOUS_SUCCESS_BUILD_TIMESTAMP }}
      generic_image_iso: ${{ steps.build_generic_iso.outputs.generic_image_iso }}
      generic_image_name: ${{ steps.build_generic_iso.outputs.generic_image_name }}

    steps:
      ### Initialization ###
      - uses: actions/checkout@v4
      - name: "Initialization: set env variables"
        id: set_env_variables
        run: |
          set -x
          if [ -n "${{ github.event.inputs.BUILD_BY }}" ]; then
            echo "BUILD_BY=${{ github.event.inputs.BUILD_BY }}" >> $GITHUB_ENV
          fi
          if [ -z "${{ github.event.inputs.build_version }}" ]; then
            echo "build_version=rolling-$(date -u +%Y%m%d%H%M)" >> $GITHUB_OUTPUT
          else
            echo "build_version=${{ github.event.inputs.build_version }}" >> $GITHUB_OUTPUT
          fi
          echo "TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT
          echo "PREVIOUS_SUCCESS_BUILD_TIMESTAMP=$(cat version.json | jq -r '.[0].timestamp')" >> $GITHUB_OUTPUT
          echo "BUILD_BY=$BUILD_BY" >> $GITHUB_OUTPUT
      - name: Checkout vyos-build repo
        uses: actions/checkout@v4
        with:
          # Clone to sub-path required for minisign binary shipped in this repo
          # This might change with future Debian versions when they ship minisign
          repository: vyos/vyos-build
          path: vyos-build

      - name: Build generic ISO image
        id: build_generic_iso
        run: |
          cd vyos-build
          sudo --preserve-env ./build-vyos-image \
            --architecture amd64 \
            --build-by $BUILD_BY \
            --build-type release \
            --custom-package vyos-1x-smoketest \
            --debian-mirror $DEBIAN_MIRROR \
            --debian-security-mirror $DEBIAN_SECURITY_MIRROR \
            --version ${{ steps.set_env_variables.outputs.build_version }} \
            --vyos-mirror $VYOS_MIRROR \
            generic
          cd build
          GENERIC_IMAGE_NAME=$(jq --raw-output .artifacts[0] manifest.json | sed -e 's/.iso//')
          GENERIC_IMAGE_ISO=$(jq --raw-output .artifacts[0] manifest.json)
          echo "generic_image_name=${GENERIC_IMAGE_NAME}" >> $GITHUB_OUTPUT
          echo "generic_image_iso=${GENERIC_IMAGE_ISO}" >> $GITHUB_OUTPUT
          # Sign build artifact
          echo "${{ secrets.minisign_public_key }}" > /tmp/minisign.pub
          echo "${{ secrets.minisign_private_key }}" > /tmp/minisign.key
          echo "${{ secrets.minisign_password }}" | $GITHUB_WORKSPACE/bin/minisign -s /tmp/minisign.key -Sm ${GENERIC_IMAGE_ISO}
          $GITHUB_WORKSPACE/bin/minisign -Vm ${GENERIC_IMAGE_ISO} -x ${GENERIC_IMAGE_ISO}.minisig -p /tmp/minisign.pub
          rm -f /tmp/minisign.key /tmp/minisign.pub
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.build_generic_iso.outputs.generic_image_name }}
          path: |
            **/manifest.json
            **/${{ steps.build_generic_iso.outputs.generic_image_iso }}
            **/${{ steps.build_generic_iso.outputs.generic_image_iso }}.minisig
          retention-days: 15
          if-no-files-found: error

  modular-build:
    needs: base-build
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python 3.10
        uses: actions/setup-python@v3
        with:
          python-version: "3.10"
      - name: Install Deps
        run: |
          pip install vyos-modular
      - name: Init VyOS Modular
        run: |
          mkdir resources
          mkdir resources/isos
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          path: resources/
      - name: Logging
        run: |
          find . -maxdepth 20 -name '*'
      - name: Move ISO
        run: |
          cp resources/vyos-1.5-rolling*/vyos-build/build/*.iso resources/isos/base.iso
      - name: Build Modular ISO
        run: |
          vyos-modular build -c config.yaml
      - name: Logging
        run: |
          find . -maxdepth 20 -name '*'