ublue-os
diff --git a/‎.github/workflows/build.yml‎
Lines changed: 65 additions & 45 deletions b/‎.github/workflows/build.yml‎
Lines changed: 65 additions & 45 deletions
@@ -44,8 +44,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        image_flavor: [main, nvidia, asus, asus-nvidia, framework, surface, surface-nvidia]
-        base_name: [bazzite, bazzite-deck]
+        base_image_flavor: [main, asus, framework, surface]
+        base_name: [bazzite, bazzite-deck, bazzite-nvidia]
         base_image_name: [kinoite, silverblue]
         major_version: [39]
         include:
@@ -54,58 +54,75 @@ jobs:
             is_stable_version: true
         exclude:
           - base_name: bazzite-deck
-            image_flavor: nvidia
+            base_image_flavor: nvidia
           - base_name: bazzite-deck
-            image_flavor: asus-nvidia
+            base_image_flavor: asus-nvidia
           - base_name: bazzite-deck
-            image_flavor: surface
+            base_image_flavor: surface
           - base_name: bazzite-deck
-            image_flavor: surface-nvidia
+            base_image_flavor: surface-nvidia
+          - base_name: bazzite-nvidia
+            base_image_flavor: framework
     steps:
+      - name: Verify base image
+        uses: EyeCantCU/cosign-action/verify@v0.2.0
+        with:
+          containers: ${{ matrix.base_image_name }}-${{ matrix.base_image_flavor }}
+          pubkey: https://raw.githubusercontent.com/ublue-os/${{ matrix.base_image_flavor }}/main/cosign.pub
+
       # Checkout push-to-registry action GitHub repository
       - name: Checkout Push to Registry action
         uses: actions/checkout@v4
 
-      - name: Verify base image
-        uses: EyeCantCU/cosign-action/verify@v0.2.2
-        with:
-          containers: ${{ matrix.base_image_name }}-${{ matrix.image_flavor }}:${{ matrix.major_version }}
+      - name: Check just syntax
+        uses: ublue-os/just-action@v1
 
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@v6
 
-      - name: Check just syntax
-        uses: ublue-os/just-action@v1
-
       - name: Matrix Variables
         run: |
+          echo "AKMODS_FLAVOR=fsync" >> $GITHUB_ENV
           echo "BASE_IMAGE_NAME=${{ matrix.base_image_name }}" >> $GITHUB_ENV
+
+          if [[ "${{ matrix.base_image_flavor }}" == "framework" ]]; then
+              echo "BASE_IMAGE_FLAVOR=framework" >> $GITHUB_ENV
+          else
+              echo "BASE_IMAGE_FLAVOR=main" >> $GITHUB_ENV
+          fi
+
+          if [[ "${{ matrix.base_name }}" == "bazzite-nvidia" ]]; then
+              if [[ "${{ matrix.base_image_flavor }}" == "main" ]]; then
+                  echo "IMAGE_FLAVOR=nvidia" >> $GITHUB_ENV
+              else
+                  echo "IMAGE_FLAVOR=${{ format('{0}-{1}', matrix.base_image_flavor, 'nvidia') }}" >> $GITHUB_ENV
+              fi
+          else
+              echo "IMAGE_FLAVOR=${{ matrix.base_image_flavor }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set image name
+        run: |
           DESKTOP=""
           if [[ "${{ matrix.base_image_name }}" == "silverblue" ]]; then
               DESKTOP="-gnome"
           fi
+
           if [[ "${{ matrix.base_name }}" == "bazzite-deck" ]]; then
-              if [[ "${{ matrix.image_flavor }}" == "asus" ]]; then
+              if [[ "${{ matrix.base_image_flavor }}" == "asus" ]]; then
                   echo "IMAGE_NAME=${{ format('{0}{1}', 'bazzite-ally', '${DESKTOP}') }}" >> $GITHUB_ENV
-              elif [[ "${{ matrix.image_flavor }}" == "framework" ]]; then
+              elif [[ "${{ matrix.base_image_flavor }}" == "framework" ]]; then
                   echo "IMAGE_NAME=${{ format('{0}{1}', 'bazzite-framegame', '${DESKTOP}') }}" >> $GITHUB_ENV
               else
                   echo "IMAGE_NAME=${{ format('{0}{1}', 'bazzite-deck', '${DESKTOP}') }}" >> $GITHUB_ENV
               fi
           else
-              if [[ "${{ matrix.image_flavor }}" == "main" ]]; then
-                  echo "IMAGE_NAME=${{ format('{0}{1}', matrix.base_name, '${DESKTOP}') }}" >> $GITHUB_ENV
+              if [[ "${{ env.IMAGE_FLAVOR }}" == "main" ]]; then
+                  echo "IMAGE_NAME=${{ format('{0}{1}', 'bazzite', '${DESKTOP}') }}" >> $GITHUB_ENV
               else
-                  echo "IMAGE_NAME=${{ format('{0}{1}-{2}', matrix.base_name, '${DESKTOP}', matrix.image_flavor) }}" >> $GITHUB_ENV
+                  echo "IMAGE_NAME=${{ format('{0}{1}-{2}', 'bazzite', '${DESKTOP}', env.IMAGE_FLAVOR) }}" >> $GITHUB_ENV
               fi
           fi
-          if [[ "${{ matrix.image_flavor }}" =~ "asus" ]]; then
-              echo "AKMODS_FLAVOR=asus" >> $GITHUB_ENV
-          elif [[ "${{ matrix.image_flavor }}" =~ "surface" ]]; then
-              echo "AKMODS_FLAVOR=surface" >> $GITHUB_ENV
-          else
-              echo "AKMODS_FLAVOR=main" >> $GITHUB_ENV
-          fi
 
       - name: Generate tags
         id: generate-tags
@@ -164,7 +181,13 @@ jobs:
       - name: Get Current Fedora Version
         id: labels
         run: |
-          ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ matrix.base_image_name }}-${{ matrix.image_flavor }}:${{ matrix.major_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
+          if [[ "${{ matrix.base_name }}" == "bazzite-nvidia" ]]; then
+              ver=$(skopeo inspect docker://ghcr.io/ublue-os/bazzite-${{ env.IMAGE_FLAVOR }}:${{ matrix.major_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
+          elif [[ "${{ env.IMAGE_FLAVOR}}" == "main" ]]; then
+              ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ matrix.base_image_name }}:${{ matrix.major_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
+          else
+              ver=$(skopeo inspect docker://ghcr.io/ublue-os/${{ matrix.base_image_name }}-${{ env.IMAGE_FLAVOR }}:${{ matrix.major_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
+          fi
           echo "VERSION=$ver" >> $GITHUB_OUTPUT
 
       # Build metadata
@@ -193,9 +216,10 @@ jobs:
             ${{ steps.generate-tags.outputs.alias_tags }}
           build-args: |
             IMAGE_NAME=${{ env.IMAGE_NAME }}
-            IMAGE_FLAVOR=${{ matrix.image_flavor }}
+            IMAGE_FLAVOR=${{ env.IMAGE_FLAVOR }}
             IMAGE_VENDOR=${{ github.repository_owner }}
             BASE_IMAGE_NAME=${{ matrix.base_image_name }}
+            BASE_IMAGE_FLAVOR=${{ env.BASE_IMAGE_FLAVOR }}
             FEDORA_MAJOR_VERSION=${{ matrix.major_version }}
             AKMODS_FLAVOR=${{ env.AKMODS_FLAVOR }}
             IMAGE_BRANCH=${{ github.ref_name }}
@@ -204,6 +228,14 @@ jobs:
           extra-args: |
             --target=${{ matrix.base_name }}
 
+      - name: Sign kernel
+        uses: EyeCantCU/kernel-signer@v0.1.2
+        with:
+          image: ${{ steps.build_image.outputs.image }}
+          privkey: ${{ secrets.AKMOD_PRIVKEY_20230518 }}
+          pubkey: /etc/pki/akmods/certs/akmods-ublue.der
+          tags: ${{ steps.build_image.outputs.tags }}
+
       # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
       # https://github.com/macbre/push-to-ghcr/issues/12
       - name: Lowercase Registry
@@ -229,26 +261,14 @@ jobs:
           extra-args: |
             --disable-content-trust
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Sign container
-      - uses: sigstore/cosign-installer@v3.3.0
-        if: github.event_name != 'pull_request'
-
       - name: Sign container image
+        uses: EyeCantCU/cosign-action/sign@v0.2.0
         if: github.event_name != 'pull_request'
-        run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
-        env:
-          TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: false
-          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+        with:
+          containers: ${{ env.IMAGE_NAME }}
+          registry-token: ${{ secrets.GITHUB_TOKEN }}
+          signing-secret: ${{ secrets.SIGNING_SECRET }}
+          tags: ${{ steps.push.outputs.digest }}
 
       - name: Echo outputs
         if: github.event_name != 'pull_request'