unraid-podman/.github/workflows/build-packages.yml

name: Build Packages

# Builds the seven Slackware .txz packages defined under packages/
# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
# inside a Slackware container, verifies + consolidates their checksums, and
# uploads the result as a workflow artifact.
#
# Intentionally does NOT commit any built binary back to the repository —
# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
# only ever leave this workflow via the "Upload build artifacts" step below
# (retained by GitHub Actions, not the repo) or, for tagged releases, via
# release.yml attaching them to a GitHub Release.
#
# See docs/ARCHITECTURE.md section 5 (Paketmanagement).

on:
  push:
    branches: [main]
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  pull_request:
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  workflow_dispatch:
    inputs:
      packages:
        description: >
          Space-separated package names to build (default: all seven).
          Example: "podman conmon"
        required: false
        default: ""
  workflow_call:
    outputs:
      artifact-name:
        description: "Name of the uploaded dist/ artifact"
        value: ${{ jobs.build.outputs.artifact-name }}

# Pin the Slackware build image by tag here. vbatts/slackware is a
# long-standing, widely used Slackware Docker image; swap this (and ideally
# pin by digest) if the project standardizes on a different/self-hosted
# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
# build dependencies are bootstrapped on top of whatever this image ships.
#
# vbatts/slackware:15.0 ships tar but NOT git (needed by actions/checkout),
# nor any of the shared libraries git's HTTPS transport needs. The
# "Install git" step below uses slackpkg (already present and pre-
# configured with a mirror in this image) rather than hand-picking package
# files: git's HTTPS support pulls in nghttp2/brotli/cyrus-sasl, and
# hand-pinning those separately from the base 15.0 release directory (as
# an earlier version of this step did) silently drifted out of sync with
# the newer, patched curl that scripts/ci/setup-slackware-buildenv.sh
# installs later in the same container — same library, two different
# builds, resulting in a symbol lookup error at runtime. Letting slackpkg
# resolve everything from the same prioritized repo set (patches over
# main, see /etc/slackpkg/slackpkg.conf's PRIORITY) keeps every package on
# this image on a mutually consistent version set.
env:
  SLACKWARE_IMAGE: "vbatts/slackware:15.0"

jobs:
  build:
    name: Build .txz packages
    runs-on: ubuntu-latest
    container:
      image: ${{ env.SLACKWARE_IMAGE }}
    outputs:
      artifact-name: ${{ steps.artifact-name.outputs.value }}
    steps:
      - name: Install git (needed before actions/checkout can run)
        run: |
          set -eu
          command -v tar > /dev/null || (echo "!! base image is missing tar — see SLACKWARE_IMAGE in this workflow" && exit 1)

          # CHECKGPG is turned off: slackpkg's default GPG-key bootstrap
          # fetches Slackware's signing key from www.slackware.com, which
          # is not reachable from every CI network (observed to hang on
          # this project's self-hosted Gitea Actions runner). CHECKMD5
          # (on by default) still verifies every package against the
          # mirror's own CHECKSUMS.md5 as a transit-integrity check.
          sed -i 's/^CHECKGPG=on/CHECKGPG=off/' /etc/slackpkg/slackpkg.conf
          slackpkg -batch=on -default_answer=y update
          # git and curl's HTTPS transport need nghttp2/brotli/cyrus-sasl at
          # runtime, but slackpkg does not resolve shared-library
          # dependencies (Slackware packages carry no such metadata) — list
          # them explicitly so they come from the same slackpkg pass (and
          # therefore the same mutually-consistent build) as git itself.
          slackpkg -batch=on -default_answer=y install \
            git ca-certificates nghttp2 brotli cyrus-sasl

          # ca-certificates ships individual certs under
          # /usr/share/ca-certificates/ — this builds the combined bundle
          # git (and later, curl) need to actually trust HTTPS remotes.
          update-ca-certificates
          echo "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"
          echo "CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"

          git --version

      - uses: actions/checkout@v4

      - name: Set up Slackware build environment
        run: scripts/ci/setup-slackware-buildenv.sh

      - name: Build packages
        run: scripts/build-packages.sh ${{ github.event.inputs.packages }}

      - name: Verify and consolidate checksums
        run: scripts/checksums.sh

      - name: Compute artifact name
        id: artifact-name
        run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact-name.outputs.value }}
          path: |
            dist/*.txz
            dist/*.sha256
            dist/*.md5
            dist/CHECKSUMS.sha256
            dist/CHECKSUMS.md5
          if-no-files-found: error
          retention-days: 14