kamos/.forgejo/workflows/build.yml

name: Build KAMOS images

on:
  push:
    branches: [main]
    paths-ignore:
      - "README.md"
  schedule:
    # Weekly rebuild so KAMOS picks up upstream Bazzite stable updates
    - cron: "0 6 * * 2"
  workflow_dispatch:

env:
  REGISTRY_HOST: fcs.tgsad.ae

jobs:
  build:
    name: Build ${{ matrix.image_name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - image_name: kamos
            base_image: ghcr.io/ublue-os/bazzite
          - image_name: kamos-nvidia
            base_image: ghcr.io/ublue-os/bazzite-nvidia

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set image ref
        run: |
          echo "IMAGE=${REGISTRY_HOST}/${GITHUB_REPOSITORY_OWNER,,}/${{ matrix.image_name }}" >> "$GITHUB_ENV"
          echo "DATE_TAG=$(date +%Y%m%d)" >> "$GITHUB_ENV"

      # Docker's builder cannot handle Bazzite's OSTree base image (millions of
      # hardlinks break the containerd snapshotter), so the build runs inside a
      # buildah container instead — the same tool Bazzite itself is built with.
      - name: Build and push with buildah
        run: |
          docker volume create kamos-buildah-cache >/dev/null 2>&1 || true
          tar -cf - . | docker run --rm -i --privileged \
            -v kamos-buildah-cache:/var/lib/containers \
            -e IMAGE="${IMAGE}" \
            -e DATE_TAG="${DATE_TAG}" \
            -e BASE_IMAGE="${{ matrix.base_image }}" \
            -e RUSER="${{ secrets.REGISTRY_USER }}" \
            -e RTOKEN="${{ secrets.REGISTRY_TOKEN }}" \
            quay.io/buildah/stable:latest \
            bash -c '
              set -euo pipefail
              mkdir -p /src && tar -xf - -C /src && cd /src
              buildah build -f Containerfile \
                --build-arg BASE_IMAGE="$BASE_IMAGE" \
                --build-arg BASE_TAG=stable \
                -t "$IMAGE:stable" .
              buildah tag "$IMAGE:stable" "$IMAGE:latest" "$IMAGE:$DATE_TAG"
              for tag in stable latest "$DATE_TAG"; do
                buildah push --creds "$RUSER:$RTOKEN" "$IMAGE:$tag" "docker://$IMAGE:$tag"
              done
            '

      - name: Clean up (keep server disk healthy)
        if: always()
        run: |
          # The failed docker-builder attempts left ~40 GB of unusable Bazzite
          # layers in Docker's store — reclaim them; buildah has its own cache.
          docker rmi ghcr.io/ublue-os/bazzite:stable ghcr.io/ublue-os/bazzite-nvidia:stable 2>/dev/null || true
          docker image prune -f
          docker builder prune -af || true