feat(ci): publish hub linux/arm64 OCI bundle to GHCR by keskad · Pull Request #46 · dcc-bigfred/bigfred

keskad · 2026-08-02T19:55:13Z

Summary

Publish ghcr.io/dcc-bigfred/bigfred-hub-linux-arm64 (ORAS) with loco-server-linux-arm64 + bigfred-remote-icmp-linux-arm64 on every master push (:master, :sha-<7>).
On v* releases, retag from :master to :<tag> and :latest-release (ELF version inject + minisign, fail-closed).
Build linux loco-server-* with -tags prod so hub/release binaries embed the SPA.

Test plan

CI on this PR: build job succeeds with prod-tagged linux binaries
After merge to master: oras pull ghcr.io/dcc-bigfred/bigfred-hub-linux-arm64:master yields both binaries
On next v* tag: release job pushes :<tag> and :latest-release with .minisig layers

Made with Cursor

Ship loco-server + remote-icmp as one ORAS artifact (ghcr.io/dcc-bigfred/bigfred-hub-linux-arm64) on master (:master, :sha-*) and on v* releases (:tag, :latest-release). Embed the hub SPA in linux loco-server builds via -tags prod. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions

This Pull Request introduces a new OCI bundle for bigfred-hub-linux-arm64, which is a significant enhancement to the project's distribution capabilities. The changes are well-implemented, covering build, publish, and release workflows, along with clear documentation. The attention to detail, including binary optimization, version injection, and robust security practices like fail-closed signing, is commendable.

github-actions · 2026-08-02T19:55:36Z


-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/loco-server-linux-amd64 ./pkgs/bigfred/server
+          # Hub / desktop SPA embedded via -tags prod (built above).
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags prod -ldflags="-s -w ${LDFLAGS}" \


✨ [POSITIVE] Adding -tags prod ensures that the Single Page Application (SPA) is correctly embedded into the loco-server binaries for the hub and desktop builds. The inclusion of -s -w in ldflags is a great practice for production builds, significantly reducing binary size by stripping symbol tables and debugging information. This improves artifact efficiency.

github-actions · 2026-08-02T19:55:36Z


  publish-oci:
-    name: Publish loco-server to GHCR (ORAS)
+    name: Publish OCI artifacts to GHCR (ORAS)


✨ [POSITIVE] The updated job name Publish OCI artifacts to GHCR (ORAS) accurately reflects the expanded scope of this workflow, as it now publishes the bigfred-hub-linux-arm64 bundle in addition to other artifacts. This improves clarity and maintainability of the CI/CD pipeline.

github-actions · 2026-08-02T19:55:36Z

 after the release version ELF section is injected. The public key lives in
 [`minisign.pub`](./minisign.pub).

+OCI artifacts (ORAS / GHCR)


✨ [POSITIVE] The addition of a dedicated section for OCI artifacts in the README.md is a significant improvement. It clearly documents the available images, their floating and release tags, and the contents of the hub bundle. This greatly enhances the discoverability and usability of the published artifacts for consumers.

github-actions · 2026-08-02T19:55:36Z

+fi
+
+BRANCH="${GITHUB_REF_NAME:?GITHUB_REF_NAME required}"
+if [[ "${BRANCH}" != "master" ]]; then


✨ [POSITIVE] This new script is well-structured and robust. The explicit check for the master branch (if [[ "${BRANCH}" != "master" ]]) is a crucial safety mechanism, preventing accidental publication of hub bundles from incorrect branches. The use of specific media types and OCI annotations also contributes to a well-defined and traceable artifact.

github-actions · 2026-08-02T19:55:36Z

+
+"${SCRIPT_DIR}/inject-elf-version.sh" "${SERVER_BIN}" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"
+
+if [[ -z "${MINISIGN_SECRET_KEY:-}" ]]; then


✨ [POSITIVE] This release script demonstrates strong security and reliability practices. The integration of inject-elf-version.sh ensures proper versioning, and the 'fail-closed' mechanism for minisign signing (checking for MINISIGN_SECRET_KEY and minisign command) is excellent. This ensures that unsigned or improperly signed release artifacts are not published, maintaining integrity.

Inject ELF version into remote-icmp as well, resolve layer names with a basename fallback, and remove the redundant step-level if on Android publish (already gated by the job). Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions

This Pull Request introduces a new CI/CD pipeline for publishing and managing bigfred-hub-linux-arm64 OCI bundles, along with significant improvements to the build process for loco-server binaries. The changes are well-implemented, robust, and enhance the project's release capabilities and binary quality.

github-actions · 2026-08-02T20:17:08Z


-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/loco-server-linux-amd64 ./pkgs/bigfred/server
+          # Hub / desktop SPA embedded via -tags prod (built above).
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags prod -ldflags="-s -w ${LDFLAGS}" \


✨ [POSITIVE] POSITIVE: The addition of -tags prod correctly embeds the SPA into the loco-server binaries, which is essential for the hub. Including -s -w in ldflags is also a good practice for production builds, significantly reducing binary size by stripping debug information and symbol tables.

github-actions · 2026-08-02T20:17:08Z


  publish-oci:
-    name: Publish loco-server to GHCR (ORAS)
+    name: Publish OCI artifacts to GHCR (ORAS)


✨ [POSITIVE] POSITIVE: Renaming the job to 'Publish OCI artifacts to GHCR (ORAS)' is a good change that accurately reflects the expanded scope of artifacts being published, improving clarity in the CI workflow.

github-actions · 2026-08-02T20:17:08Z

      - name: Publish loco-server-android-arm64
        run: ./scripts/publish-oci-loco-android.sh dist/loco-server-android-arm64
+
+      - name: Publish bigfred-hub-linux-arm64


✨ [POSITIVE] POSITIVE: This new step correctly integrates the publishing of the bigfred-hub-linux-arm64 OCI bundle into the CI pipeline, which is a core part of this feature and well-implemented.

github-actions · 2026-08-02T20:17:08Z

          MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }}
        run: ./scripts/retag-oci-loco-android.sh "${GITHUB_REF_NAME}"
+
+      - name: Retag hub linux/arm64 OCI artifact from master


✨ [POSITIVE] POSITIVE: The addition of this step for retagging and signing the bigfred-hub-linux-arm64 OCI artifact is crucial for the release process, ensuring proper versioning and integrity with minisign.

github-actions · 2026-08-02T20:17:08Z

 after the release version ELF section is injected. The public key lives in
 [`minisign.pub`](./minisign.pub).

+OCI artifacts (ORAS / GHCR)


✨ [POSITIVE] POSITIVE: The new 'OCI artifacts (ORAS / GHCR)' section is a significant improvement to the documentation, providing clear and concise information about the new OCI images and their tagging conventions.

github-actions · 2026-08-02T20:17:08Z

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash


✨ [POSITIVE] POSITIVE: This new script is well-engineered. The use of temporary files to ensure consistent layer names, the inclusion of OCI annotations for traceability, and the explicit check for the master branch are all robust practices for OCI artifact publishing.

github-actions · 2026-08-02T20:17:08Z

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash


✨ [POSITIVE] POSITIVE: This script implements a robust and secure release process for the hub OCI bundle. The find_layer function enhances resilience, while the ELF version injection and fail-closed minisign integration are critical for ensuring release integrity and traceability.

github-actions Bot reviewed Aug 2, 2026

View reviewed changes

keskad mentioned this pull request Aug 2, 2026

feat(os): fetch BigFred from GHCR OCI and autostart via S60 dcc-bigfred/bigfred-os#10

Merged

4 tasks

fix(ci): harden hub OCI retag and drop redundant Android if

4c47dac

Inject ELF version into remote-icmp as well, resolve layer names with a basename fallback, and remove the redundant step-level if on Android publish (already gated by the job). Co-authored-by: Cursor <cursoragent@cursor.com>

keskad merged commit 5beff07 into master Aug 2, 2026
2 checks passed

github-actions Bot reviewed Aug 2, 2026

View reviewed changes

keskad deleted the feat/oci-bigfred-hub-linux-arm64 branch August 2, 2026 20:17


		"${SCRIPT_DIR}/inject-elf-version.sh" "${SERVER_BIN}" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"

		if [[ -z "${MINISIGN_SECRET_KEY:-}" ]]; then

Uh oh!

Conversation

keskad commented Aug 2, 2026

Summary

Test plan

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant