Files
cozystack/packages/core/talos/Makefile
T
Myasnikov DaniilandClaude Opus 4.8 65cd5f629c fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)
Belt-and-suspenders for the B2-class trap lexfrei flagged as latent in
image-tags. PUBLISH_* are 0 on fork PRs, so today the export path never emits a
versioned/floating tag — but if it ever did:

- image-tags: multiple --tag under `--output type=oci` write >1 manifest into
  the archive's index.json, and `skopeo copy oci-archive:<f>` then refuses it
  ("more than one image in oci"). Suppress the versioned/floating tags when
  OCI_EXPORT_DIR is set (macro-level $(if …), so `make -n` prints only the
  taken branch).
- packages/core/talos: gate its versioned/floating `skopeo copy docker://…`
  release copies on an empty OCI_EXPORT_DIR too.

The release (non-export) path is unchanged — versioned + :latest still emitted.
Covered by a new common-envs_test.bats case that forces PUBLISH_*=1 under
export.

Reported by gemini-code-assist on #3262.

Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
2026-07-29 17:47:28 +05:00

59 lines
2.4 KiB
Makefile

NAME=talos
NAMESPACE=cozy-system
TALOS_VERSION=$(shell awk '/^version:/ {print $$2}' images/talos/profiles/installer.yaml)
include ../../../hack/common-envs.mk
update:
hack/gen-profiles.sh
image: image-matchbox image-talos
image-talos:
test -f ../../../_out/assets/installer-amd64.tar || make talos-installer
set -e; \
SRC=docker-archive:../../../_out/assets/installer-amd64.tar; \
$(if $(strip $(OCI_EXPORT_DIR)),mkdir -p "$(OCI_EXPORT_DIR)"; skopeo copy "$$SRC" "oci-archive:$(OCI_EXPORT_DIR)/talos.oci.tar:$(IMAGE_TAG)",skopeo copy "$$SRC" docker://$(REGISTRY)/talos:$(IMAGE_TAG)); \
if [ -z "$(OCI_EXPORT_DIR)" ] && [ "$(PUBLISH_VERSIONED)" = "1" ]; then skopeo copy "$$SRC" docker://$(REGISTRY)/talos:$(TALOS_VERSION); fi; \
if [ -z "$(OCI_EXPORT_DIR)" ] && [ "$(PUBLISH_FLOATING)" = "1" ]; then skopeo copy "$$SRC" docker://$(REGISTRY)/talos:latest; fi
image-matchbox:
test -f ../../../_out/assets/kernel-amd64 || make talos-kernel
test -f ../../../_out/assets/initramfs-metal-amd64.xz || make talos-initramfs
docker buildx build -f images/matchbox/Dockerfile ../../.. \
$(call image-tags,matchbox,$(TALOS_VERSION)) \
$(call cache-args,matchbox) \
--metadata-file images/matchbox.json \
$(BUILDX_ARGS)
echo "$(REGISTRY)/matchbox:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/matchbox.json -o json -r)" \
> ../../extra/bootbox/images/matchbox.tag
rm -f images/matchbox.json
assets: talos-iso talos-nocloud talos-metal talos-kernel talos-initramfs
talos-initramfs:
test -f ../../../_out/assets/initramfs-metal-amd64.xz || $(MAKE) build-talos-initramfs
talos-kernel:
test -f ../../../_out/assets/kernel-amd64 || $(MAKE) build-talos-kernel
talos-installer:
test -f ../../../_out/assets/installer-amd64.tar || $(MAKE) build-talos-installer
talos-iso:
test -f ../../../_out/assets/metal-amd64.iso || $(MAKE) build-talos-iso
talos-nocloud:
test -f ../../../_out/assets/nocloud-amd64.raw.xz || $(MAKE) build-talos-nocloud
talos-metal:
test -f ../../../_out/assets/metal-amd64.raw.xz || $(MAKE) build-talos-metal
build-talos-initramfs build-talos-kernel build-talos-installer build-talos-iso build-talos-nocloud build-talos-metal:
mkdir -p ../../../_out/assets
cat images/talos/profiles/$(subst build-talos-,,$@).yaml | \
docker run --rm -i -v /dev:/dev --privileged "ghcr.io/siderolabs/imager:$(TALOS_VERSION)" --tar-to-stdout - | \
tar -C ../../../_out/assets -xzf-