33652064f9
- tests/: offline tree validation plus rootfs smoke tests that assert the hardening guarantees (kptr_restrict, default-deny firewall, key-only ssh, no snapd/telemetry, btrfs tooling). - ci/: GitLab pipeline - validate, build matrix (server/workstation/ cloud), smoke tests, publish on tags.
100 lines
3.4 KiB
YAML
100 lines
3.4 KiB
YAML
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — GitLab CI pipeline
|
|
#
|
|
# Mirrors the local build flow (scripts/ + Makefile) in CI:
|
|
# validate → build (matrix over editions) → test → publish
|
|
#
|
|
# The build image is Debian bookworm with the host deps installed, matching
|
|
# what scripts/check-host-deps.sh expects locally.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
stages:
|
|
- validate
|
|
- build
|
|
- test
|
|
- publish
|
|
|
|
variables:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
VERSION: "0.1.0"
|
|
|
|
# ── validate ────────────────────────────────────────────────────────────────
|
|
validate:
|
|
stage: validate
|
|
image: debian:bookworm
|
|
script:
|
|
- apt-get update -qq && apt-get install -y -qq make bash
|
|
- make check
|
|
|
|
# ── build (one job per edition) ─────────────────────────────────────────────
|
|
.build:
|
|
stage: build
|
|
image: debian:bookworm
|
|
before_script:
|
|
- apt-get update -qq
|
|
- apt-get install -y -qq debootstrap squashfs-tools grub2-common xorriso cpio curl git make bash
|
|
script:
|
|
- make iso-${EDITION}
|
|
artifacts:
|
|
name: "arcline-${EDITION}-${VERSION}"
|
|
paths:
|
|
- build/artifacts/
|
|
expire_in: 2 weeks
|
|
rules:
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
|
when: never
|
|
- when: always
|
|
|
|
build-server:
|
|
extends: .build
|
|
variables:
|
|
EDITION: server
|
|
|
|
build-workstation:
|
|
extends: .build
|
|
variables:
|
|
EDITION: workstation
|
|
|
|
build-cloud:
|
|
extends: .build
|
|
variables:
|
|
EDITION: cloud
|
|
|
|
# ── test ────────────────────────────────────────────────────────────────────
|
|
test:
|
|
stage: test
|
|
image: debian:bookworm
|
|
needs: [build-server, build-workstation, build-cloud]
|
|
before_script:
|
|
- apt-get update -qq && apt-get install -y -qq bash make xz-utils
|
|
script:
|
|
# extract the rootfs artifacts so the smoke tests can inspect them
|
|
- for f in build/artifacts/arcline-*.tar.xz; do
|
|
[ -e "$f" ] || continue;
|
|
e=$(basename "$f" | sed -E 's/arcline-([a-z]+)-.*/\1/');
|
|
mkdir -p "build/rootfs/$e";
|
|
tar -xJf "$f" -C "build/rootfs/$e";
|
|
done
|
|
- make test
|
|
artifacts:
|
|
reports:
|
|
junit: build/logs/*.xml
|
|
when: always
|
|
|
|
# ── publish (tagged releases only) ──────────────────────────────────────────
|
|
publish:
|
|
stage: publish
|
|
image: alpine:latest
|
|
needs: [test]
|
|
before_script:
|
|
- apk add --no-cache curl jq
|
|
script:
|
|
- echo "Publishing release $VERSION (edit this step to push to your release server / GitLab Packages)"
|
|
- ls -la build/artifacts/ || true
|
|
artifacts:
|
|
name: "arcline-${VERSION}"
|
|
paths:
|
|
- build/artifacts/
|
|
expire_in: 1 year
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG'
|