arch-turnkey/docs/CI.md

Automated ISO builds (Gitea Actions)

.gitea/workflows/build-iso.yml builds the ISO and publishes it as a Gitea release so a current ISO is always a download away — no local build needed.

• When: the 2nd of each month (after Arch's monthly snapshot), on manual dispatch, and whenever the installer scripts change.
• Where: attached to a release tagged iso-YYYY.MM.DD under this repo's Releases. Keeps the last 6, prunes older.

One-time setup (required — the workflow needs a runner)

Building an ISO needs mkarchiso, which needs root + loop devices, so a privileged runner is required.

1. Enable Actions for this repo: Settings → Actions → enable. (Site-wide it must be on: [actions] ENABLED = true in Gitea's app.ini.)

2. Register a runner (act_runner) that can run privileged containers, with a label matching runs-on: archlinux in the workflow. On a Docker host:

   act_runner register --instance https://your-forge.example \
     --token <from Gitea: Settings > Actions > Runners> \
     --labels archlinux:docker://archlinux:latest --name iso-builder
   act_runner daemon
   

   The runner's Docker must allow --privileged (the workflow sets it per-job). A good home for it: a dedicated LXC/VM or the Docker host you already run.

3. Release token (optional but recommended): add a repo secret RELEASE_TOKEN (Settings → Actions → Secrets) = a Gitea PAT with write:repository. Without it the workflow falls back to the auto-injected token, which works if Actions token permissions allow release writes.

Trigger a build now

Repo → Actions → build-iso → Run workflow (uses workflow_dispatch).

Notes

• ISO assets are ~1 GB; make sure the repo's attachment size limit allows it ([repository.release] ALLOWED_TYPES / attachment max size in app.ini).
• The ISO stays thin — it pulls the current bootstrap.sh at boot — so even a months-old ISO installs your latest config. The monthly rebuild mainly refreshes the kernel/base packages on the ISO itself.