Repository navigation
Use matching prebuilt images for package builds and publishing - #552
Conversation
Moves the pin from f7ea7ecc to the head of quattro-upstream, which adds omacom#552's reset-prepare, reset-verify, reset-commit and reset-rollback entrypoints, omacom#553's luks-slots entrypoint and recovery key handling, omacom#556's encrypt unit output to kmsg at notice, and omacom#560's snapshot restore check with its limine-snapper-sync pre and post hooks. The pin's UTC date is still 20260925, so pkgrel goes to 4. omacom#544 is not in it, so the Plymouth fragment still ships and no HOOKS baseline dependency applies.
…ntrypoints need omarchy-lifecycle-dispatch requires reset-* (omacom#552) and luks-slots (omacom#553) on Apple Silicon, so a runtime carrying them before this package blocks factory reset, owner setup and omarchy-drive-password on Macs.
|
Hi Ryan, I think this PR never made it into master. It was based on #551's branch, So the daily images are built and published but never used: every package build still builds its own image from
|
2 participants
Fresh DO package jobs currently rebuild the Arch environment even when a tested image exists. Enable matching prebuilt images for PR package builds, missing-artifact builds during publishing, and the publishing tools themselves.
Depends on #551; this PR is based on its branch so the integration can be reviewed separately. Merge the producer first, complete its initial public GHCR publication, then retarget this PR to master and merge.
Image selection uses this checkout's build context, architecture, and mirror. Verify the image's compatibility label and platform, then use its immutable registry digest for every container in that build invocation. Missing, private, unavailable, or mismatched images fall back to the existing local build and pin that image's ID. A failed fallback remains a job failure.
The workflow/script checkout behavior is unchanged. Local builds remain opt-in; explicit prepared-image mode retains precedence. Each package still gets a fresh container and a full Arch update before dependency installation. Publishing prepares its image before the step receives signing credentials.
Validation: 46 local regression tests pass, including matching images, incompatible metadata, registry failures, failed fallback builds, immutable references in actual bin/build invocations, and the publishing preparation step. Shell syntax checks and actionlint pass. A real local-registry integration check pulled the matching production builder by digest and compiled and packaged a C program through bin/build. All PR checks pass, including full candidate image builds and isolation tests on native x86_64 and ARM runners.
No control-box update is needed. Reverting this integration restores local image construction while leaving the daily producer available.