Skip to content

Add step to build a "production" fedora build on pull requests #15090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mab879 wants to merge 1 commit into
base: master
Choose a base branch
from
+110 −0
Open

Add step to build a "production" fedora build on pull requests #15090

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .packit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,25 +5,39 @@

actions:
get-current-version:
- bash utils/version.sh

Check failure on line 8 in .packit.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

8:3 [indentation] wrong indentation: expected 4 but found 2

srpm_build_deps:
- bash

jobs:
- &build

Check failure on line 14 in .packit.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

14:1 [indentation] wrong indentation: expected 2 but found 0
job: copr_build
trigger: pull_request
identifier: main
targets:
- fedora-all-x86_64

Check failure on line 19 in .packit.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

19:3 [indentation] wrong indentation: expected 4 but found 2
- centos-stream-8-x86_64
- centos-stream-9-x86_64
- centos-stream-10-x86_64


- <<: *build
trigger: commit
branch: "gh-readonly-queue/.*"

- job: copr_build

Check failure on line 29 in .packit.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

29:3 [hyphens] too many spaces after hyphen
trigger: pull_request
identifier: mock
targets:
- fedora-all-x86_64

Check failure on line 33 in .packit.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

33:4 [indentation] wrong indentation: expected 5 but found 3
actions:
post-upstream-clone:
- bash -c "cp tests/scap-security-guide_fedora.spec.in scap-security-guide.spec"
# There can only be one spec file or copr gets mad. So we do quick change out to
# a production-like spec file for the mock build.


- &contest-oscap
job: tests
trigger: pull_request
Expand Down
96 changes: 96 additions & 0 deletions tests/scap-security-guide_fedora.spec.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
# SSG build system and tests count with build directory name `build`.
# For more details see:
# https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds
%global _vpath_builddir build

Name: scap-security-guide
Version: 0.1.82
Release: 1%{?dist}
Comment on lines +7 to +8

@jan-cerny jan-cerny Sep 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it will build the version 0.1.82 forever.

In the other spec file, we have this:

# Version placeholder. Copr build version is determined by utils/version.sh. See .packit.yaml config
Version:	0.0.1
Release:	0%{?dist}

Try to have this thing also in this spec file.

Summary: Security guidance and baselines in SCAP formats
License: BSD-3-Clause
URL: https://github.com/ComplianceAsCode/content/
Source0: https://github.com/ComplianceAsCode/content/releases/download/v%{version}/scap-security-guide-%{version}.tar.bz2
BuildArch: noarch

BuildRequires: libxslt
BuildRequires: openscap-scanner >= 1.2.5
BuildRequires: cmake >= 2.8
BuildRequires: python%{python3_pkgversion}
BuildRequires: python%{python3_pkgversion}-jinja2
BuildRequires: python%{python3_pkgversion}-PyYAML
BuildRequires: python%{python3_pkgversion}-setuptools
Requires: xml-common, openscap-scanner >= 1.2.5

%description
The scap-security-guide project provides a guide for configuration of the
system from the final system's security point of view. The guidance is specified
in the Security Content Automation Protocol (SCAP) format and constitutes
a catalog of practical hardening advice, linked to government requirements
where applicable. The project bridges the gap between generalized policy
requirements and specific implementation guidelines. The system
administrator can use the oscap CLI tool from openscap-scanner package, or the
scap-workbench GUI tool from scap-workbench package to verify that the system
conforms to provided guideline. Refer to scap-security-guide(8) manual page for
further information.

%package doc
Summary: HTML formatted security guides generated from XCCDF benchmarks
Requires: %{name} = %{version}-%{release}

%description doc
The %{name}-doc package contains HTML formatted documents containing
hardening guidances that have been generated from XCCDF benchmarks
present in %{name} package.

%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) )
%package rule-playbooks
Summary: Ansible playbooks per each rule.
Group: System Environment/Base
Requires: %{name} = %{version}-%{release}

%description rule-playbooks
The %{name}-rule-playbooks package contains individual ansible playbooks per rule.
%endif

%prep
%autosetup -p1

%define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF
%define cmake_defines_specific %{nil}
%if 0%{?rhel} && ! %{defined eln}
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON

@ggbecker ggbecker Sep 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to be yielding -DSSG_PRODUCT_RHEL46:BOOL=ON

%{rhel} is being set to 46 here according to: https://artifacts.dev.testing-farm.io/9c3be016-7b69-4e04-a739-6e5026e36de3/work-cixgdpip_f/plans/ci/execute/data/guest/default-0/static-checks/rpmbuild-ctest-1/output.txt

We probably need to hardcode the RHEL version here, or build all the products instead

Suggested change
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON

option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be built; otherwise only explicitly enabled products will be" TRUE)

@ggbecker ggbecker Sep 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No products seem to have been built

%endif
%if 0%{?centos}
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON
%endif

mkdir -p build
%build
%cmake %{cmake_defines_common} %{cmake_defines_specific}
%cmake_build

%install
%cmake_install
rm %{buildroot}/%{_docdir}/%{name}/README.md
rm %{buildroot}/%{_docdir}/%{name}/Contributors.md

%files
%{_datadir}/xml/scap/ssg/content
%{_datadir}/%{name}/kickstart
%{_datadir}/%{name}/ansible/*.yml
%{_datadir}/%{name}/tailoring
%lang(en) %{_mandir}/man8/scap-security-guide.8.*
%doc %{_docdir}/%{name}/LICENSE
%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) )
%exclude %{_datadir}/%{name}/ansible/rule_playbooks
%endif

%files doc
%doc %{_docdir}/%{name}/guides/*.html
%doc %{_docdir}/%{name}/tables/*.html

%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) )
%files rule-playbooks
%defattr(-,root,root,-)
%{_datadir}/%{name}/ansible/rule_playbooks
%endif
Loading