stage0/.github/workflows/build.yml at main · lockboot/stage0 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: build

on:
  push:
    branches: [main]
    # stage0 is the db-signed root of trust; tag stage0-v* to cut a release.
    tags: ['stage0-v*']
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: CI (fmt-check + clippy + test)
        run: make ci

  build:
    name: build-${{ matrix.arch }}
    needs: ci
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [x86_64, aarch64]

    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      # Build the db-signed boot disk (ephemeral snakeoil keys) for the arch. No
      # QEMU boot here: GitHub runners lack nested KVM. Boot tests run locally via
      # `make boot-<arch>`.
      - name: Build stage0 boot disk for ${{ matrix.arch }}
        run: make build-${{ matrix.arch }}

      - name: Upload stage0 artifacts for ${{ matrix.arch }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: stage0-${{ matrix.arch }}
          path: |
            build/${{ matrix.arch }}/boot.disk
            build/${{ matrix.arch }}/BOOT*.EFI
            build/${{ matrix.arch }}/efi-vars.*
            build/${{ matrix.arch }}/os-release
            build/${{ matrix.arch }}/*.cer
            build/${{ matrix.arch }}/*.guid
          if-no-files-found: error

  # ---- Release track (tag: stage0-v*) --------------------------------------
  release-stage0:
    runs-on: ubuntu-latest
    needs: build
    if: startsWith(github.ref, 'refs/tags/stage0-v')
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Download stage0 artifact zips
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ARTIFACTS=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts)
          for arch in x86_64 aarch64; do
            ARTIFACT_ID=$(echo "$ARTIFACTS" | jq -r ".artifacts[] | select(.name==\"stage0-$arch\") | .id")
            gh api repos/${{ github.repository }}/actions/artifacts/${ARTIFACT_ID}/zip > stage0-${arch}.zip
          done

      - name: Attest stage0 zips
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
        with:
          subject-path: |
            stage0-x86_64.zip
            stage0-aarch64.zip

      - name: Create stage0 release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          tag_name: ${{ github.ref_name }}
          # Ship the droppable test harness alongside the boot disks so downstreams
          # can test their payloads under this stage0 release.
          files: |
            stage0-x86_64.zip
            stage0-aarch64.zip
            tools/qemu-test.sh
          draft: false
          prerelease: true
          generate_release_notes: true
          make_latest: true