unraid-podman/.github/workflows/build-packages.yml

name: Build Packages

# Builds the seven Slackware .txz packages defined under packages/
# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
# inside a Slackware container, verifies + consolidates their checksums, and
# uploads the result as a workflow artifact.
#
# Intentionally does NOT commit any built binary back to the repository —
# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
# only ever leave this workflow via the "Upload build artifacts" step below
# (retained by GitHub Actions, not the repo) or, for tagged releases, via
# release.yml attaching them to a GitHub Release.
#
# See docs/ARCHITECTURE.md section 5 (Paketmanagement).

on:
  push:
    branches: [main]
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  pull_request:
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  workflow_dispatch:
    inputs:
      packages:
        description: >
          Space-separated package names to build (default: all seven).
          Example: "podman conmon"
        required: false
        default: ""
  workflow_call:
    outputs:
      artifact-name:
        description: "Name of the uploaded dist/ artifact"
        value: ${{ jobs.build.outputs.artifact-name }}

# Pin the Slackware build image by tag here. vbatts/slackware is a
# long-standing, widely used Slackware Docker image; swap this (and ideally
# pin by digest) if the project standardizes on a different/self-hosted
# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
# build dependencies are bootstrapped on top of whatever this image ships.
#
# vbatts/slackware:15.0 ships tar but NOT git (needed by actions/checkout),
# nor any of the shared libraries git's HTTPS transport needs. The
# "Install git" step below uses slackpkg (already present and pre-
# configured with a mirror in this image) rather than hand-picking package
# files: git's HTTPS support pulls in nghttp2/brotli/cyrus-sasl, and
# hand-pinning those separately from the base 15.0 release directory (as
# an earlier version of this step did) silently drifted out of sync with
# the newer, patched curl that scripts/ci/setup-slackware-buildenv.sh
# installs later in the same container — same library, two different
# builds, resulting in a symbol lookup error at runtime. Letting slackpkg
# resolve everything from the same prioritized repo set (patches over
# main, see /etc/slackpkg/slackpkg.conf's PRIORITY) keeps every package on
# this image on a mutually consistent version set.
#
# actions/checkout and actions/upload-artifact are both Node-based actions
# — Gitea Actions execs their JS bundle with the "node" binary found
# inside the job's own container, it does not inject a runtime of its
# own. Slackware has no nodejs package at all (checked: not in any of the
# main/extra/pasture/testing repos), so the "Install git" step also
# installs a pinned, checksum-verified Node.js release directly from
# nodejs.org — the same style already used for Go/Rust in
# scripts/ci/setup-slackware-buildenv.sh.
env:
  SLACKWARE_IMAGE: "vbatts/slackware:15.0"
  NODE_VERSION: "20.20.2"
  NODE_SHA256: "df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d"

jobs:
  build:
    name: Build .txz packages
    runs-on: ubuntu-latest
    container:
      image: ${{ env.SLACKWARE_IMAGE }}
    outputs:
      artifact-name: ${{ steps.artifact-name.outputs.value }}
    steps:
      - name: Install git and Node.js (needed before actions/checkout can run)
        run: |
          set -eu
          command -v tar > /dev/null || (echo "!! base image is missing tar — see SLACKWARE_IMAGE in this workflow" && exit 1)

          # CHECKGPG is turned off: slackpkg's default GPG-key bootstrap
          # fetches Slackware's signing key from www.slackware.com, which
          # is not reachable from every CI network (observed to hang on
          # this project's self-hosted Gitea Actions runner). CHECKMD5
          # (on by default) still verifies every package against the
          # mirror's own CHECKSUMS.md5 as a transit-integrity check.
          sed -i 's/^CHECKGPG=on/CHECKGPG=off/' /etc/slackpkg/slackpkg.conf
          slackpkg -batch=on -default_answer=y update
          # git and curl's HTTPS transport need nghttp2/brotli/cyrus-sasl at
          # runtime, but slackpkg does not resolve shared-library
          # dependencies (Slackware packages carry no such metadata) — list
          # them explicitly so they come from the same slackpkg pass (and
          # therefore the same mutually-consistent build) as git itself.
          slackpkg -batch=on -default_answer=y install \
            git ca-certificates nghttp2 brotli cyrus-sasl

          # ca-certificates ships individual certs under
          # /usr/share/ca-certificates/ — this builds the combined bundle
          # git (and later, curl) need to actually trust HTTPS remotes.
          update-ca-certificates
          echo "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"
          echo "CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"

          git --version

          # curl isn't installed until scripts/ci/setup-slackware-buildenv.sh
          # runs, later — use wget (present in the base image) here instead.
          # wget does not consult the system CA bundle on its own (unlike
          # curl/git, which respect CURL_CA_BUNDLE/GIT_SSL_CAINFO), so pass
          # it explicitly via --ca-certificate.
          node_tarball="node-v${NODE_VERSION}-linux-x64.tar.xz"
          wget -q --tries=3 --ca-certificate=/etc/ssl/certs/ca-certificates.crt \
            -O "/tmp/$node_tarball" "https://nodejs.org/dist/v${NODE_VERSION}/$node_tarball"
          echo "${NODE_SHA256}  /tmp/$node_tarball" | sha256sum -c -
          mkdir -p /usr/local/lib/nodejs
          tar -xf "/tmp/$node_tarball" -C /usr/local/lib/nodejs
          echo "/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin" >> "$GITHUB_PATH"
          "/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin/node" --version

      - uses: actions/checkout@v4

      - name: Set up Slackware build environment
        run: scripts/ci/setup-slackware-buildenv.sh

      - name: Build packages
        run: scripts/build-packages.sh ${{ github.event.inputs.packages }}

      - name: Verify and consolidate checksums
        run: scripts/checksums.sh

      - name: Compute artifact name
        id: artifact-name
        run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact-name.outputs.value }}
          path: |
            dist/*.txz
            dist/*.sha256
            dist/*.md5
            dist/CHECKSUMS.sha256
            dist/CHECKSUMS.md5
          if-no-files-found: error
          retention-days: 14