build-armbian-sdk.yml

name: "Build Armbian SDK"
on:
  workflow_dispatch:
    # manual trigger
  schedule:
    # runs every day at 3am UTC
    - cron: '0 3 * * *' 

jobs:

  Keep:
    name: "Keep alive"
    runs-on: ubuntu-latest
    permissions:
      actions: write
    steps:
      # checkout this repository
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      # prevent GitHub from suspending cronjob
      - uses: liskin/gh-workflow-keepalive@f72ff1a1336129f29bf0166c0fd0ca6cf1bcb38c # v1.2.1

  Matrix:
    needs: Keep
    strategy:
      fail-fast: false
      matrix:
        board: ["uefi-x86","uefi-arm64"]
        os: ["noble","resolute","trixie"]
        extension: [",image-output-qcow2",""]
        include:
        - board: uefi-x86
          runner: ubuntu-24.04
        - board: uefi-arm64
          runner: ubuntu-22.04-arm
    runs-on: ${{ matrix.runner }}
    name: "${{ matrix.os }},${{ matrix.board }}${{ matrix.extension }}"
    steps:

      - uses: armbian/build@761d04edac790c552380061d5c2ff0b780ff18d4 # main
        with:
          # mandatory
          armbian_token:              "${{ secrets.GITHUB_TOKEN }}"          # GitHub installation access token
          armbian_target:             "armbian-sdk"                          # build configuration from userpatches
          armbian_release:            "${{ matrix.os }}"                     # userspace: jammy, bookworm, trixie, etc.
          armbian_board:              "${{ matrix.board }}"                  # board build target
          # optional
          armbian_branch:             "main"
          armbian_kernel_branch:      "cloud"                                # cloud kernel: smaller, no SBC drivers
          armbian_ui:                 "minimal"
          armbian_extensions:         "sdk${{ matrix.extension }}"           # enable extensions
          armbian_release_title:      "Armbian SDK"                          # release title
          armbian_release_tag:        "${{ github.run_id }}"
          armbian_release_prerelease: "true"                                    # promoted to a full release by the Aggregate job
          armbian_release_body:       |                                       # release body
            Armbian SDK — daily virtual images preloaded with the Armbian development environment.

            ### Targets

            x86 (`uefi-x86`) and arm64 (`uefi-arm64`), built on Ubuntu (`noble`, `resolute`) and Debian (`trixie`), using the `cloud` kernel.

            ### Formats

            Raw `.img.xz` and `.img.qcow2`.

            ### Inside the image

            - **Curated Armbian source tree** pre-cloned into the code-server workspace at `/armbian/code-server/config/workspace/` (`build`, `configng`, `documentation`, `website`, `imager`).

            - **Build dependencies pre-installed.** `./compile.sh requirements` has already run inside the rootfs, so the first build skips the apt phase.

            - **code-server** (browser VS Code) installed on first boot, with the Python extension and the Claude Code CLI pre-provisioned.

            - **SSH ready out of the box.** Maintainer's GitHub public keys baked into both `root` and the `armbian` user via Armbian's `PRESET_*_KEY` firstboot mechanism.

            ### Defaults

            Credentials `armbian` / `armbian`. code-server on port `8443`.

            ### Manifest

            `armbian-images.json` (aggregated across the matrix) and `<image>.assets.json` (per-image) are published alongside the assets for programmatic consumption.
          armbian_pgp_key:            "${{ secrets.GPG_KEY1 }}"              # key for signing
          armbian_pgp_password:       "${{ secrets.GPG_PASSPHRASE1 }}"       # password for key
          # SDK images publish to this repo's GitHub release, not dl.armbian.com.
          # Empty `armbian_download_repository` selects the flat URL shape
          # `<base>/<filename>` and clears the redi_url* fields (no friendly-
          # redirect convention exists for GitHub releases).
          armbian_download_base_url:  "https://github.com/${{ github.repository }}/releases/download/${{ github.run_id }}"
          armbian_download_repository: ""

  Aggregate:
    name: "Aggregate per-cell asset manifests"
    needs: Matrix
    if: ${{ always() && !cancelled() }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:

      - name: Download per-image manifests from the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          mkdir -p manifests
          # The build action writes one `<image_filename>.assets.json` per
          # image artefact (raw + .img.qcow2 + .img.vhdx all coexist when
          # an image-output-* extension is enabled). Pull all of them.
          gh release download "${{ github.run_id }}" \
            --pattern '*.assets.json' \
            --dir manifests \
            --repo "${{ github.repository }}"
          ls -la manifests/

      - name: Merge into a single armbian-images.json
        run: |
          set -euo pipefail
          jq -s 'map(.assets) | flatten | {assets: .}' manifests/*.json > armbian-images.json
          echo "Merged assets: $(jq '.assets | length' armbian-images.json)"
          jq '.assets[] | "\(.board_slug) \(.distro)/\(.branch) \(.variant) \(.file_extension)"' armbian-images.json | head -20

      - name: Upload merged manifest to the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.run_id }}" armbian-images.json \
            --clobber \
            --repo "${{ github.repository }}"

      # Matrix builds publish to GitHub as a pre-release so partial /
      # in-flight runs aren't surfaced as `latest`. Once the matrix is
      # green and the aggregated manifest is in place, flip the release
      # to a normal release. If any matrix cell failed, leave it as a
      # pre-release so the broken state is visible.
      - name: Promote release (matrix succeeded)
        if: ${{ needs.Matrix.result == 'success' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release edit "${{ github.run_id }}" \
            --prerelease=false \
            --latest \
            --repo "${{ github.repository }}"