From 970e6e4b00f33dff43f4a3a627a5701c256333e7 Mon Sep 17 00:00:00 2001
From: phantomcortex <137958098+phantomcortex@users.noreply.github.com>
Date: Thu, 11 Jun 2026 17:42:02 -0600
Subject: [PATCH 1/2] Restore package changelog after native chunker migration

PR #51 replaced the hhd-dev/rechunk action with the native chunker
(rpm-ostree compose build-chunked-oci), which does not emit the
dev.hhd.rechunk.info OCI label. changelog.py reads package data solely
from that label, so the "Major Packages" and "Package Changes" tables
went empty while commits (sourced from a different label) kept working.

Rebuild the label from the raw image's RPM database in the existing
"Apply OCI labels" step, matching the format the old action emitted.
changelog.py is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e66cffa..c91c93e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -246,6 +246,15 @@ jobs:
             [ -z "$line" ] && continue
             sudo buildah config --label "$line" --annotation "$line" "$container"
           done <<< "${LABELS}"
+
+          # The native chunker doesn't emit dev.hhd.rechunk.info the way the
+          # old hhd-dev/rechunk action did, so changelog.py loses its package
+          # list. Rebuild that label from the image's RPM database here.
+          pkgs_json=$(sudo buildah run "$container" -- \
+            rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n' \
+            | python3 -c 'import sys, json; print(json.dumps({"packages": dict(l.split("\t", 1) for l in sys.stdin.read().splitlines() if "\t" in l)}))')
+          sudo buildah config --label "dev.hhd.rechunk.info=${pkgs_json}" "$container"
+
           sudo buildah commit --identity-label=false --rm "$container" "$SRC"
 
       # Native chunker: invokes `rpm-ostree compose build-chunked-oci`

From b0616e10211b9146c8e63bf1f6184b2c13699176 Mon Sep 17 00:00:00 2001
From: phantomcortex <137958098+phantomcortex@users.noreply.github.com>
Date: Thu, 11 Jun 2026 17:50:38 -0600
Subject: [PATCH 2/2] Add dry_run validation flag to manual builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

workflow_dispatch now exposes a dry_run choice (off/build/chunk) so a
manual run can verify the image builds — and optionally rechunks —
cleanly without publishing. 'build' stops after Build image (rootful),
'chunk' stops after Run native rechunker; both skip push, signing, and
the release job. Automated push/schedule builds are unaffected because
the inputs context is empty for those events.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c91c93e..88d1f89 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,6 +25,11 @@ on:
         description: 'Optional handwritten changelog message for this release'
         type: string
         default: ''
+      dry_run:
+        description: 'Validation run — build only, no push (off=normal, build=stop after build, chunk=stop after rechunk)'
+        type: choice
+        options: ['off', 'build', 'chunk']
+        default: 'off'
 env:
   IMAGE_DESC: "My Customized Bazzite Image"
   IMAGE_KEYWORDS: "bootc,ublue,universal-blue"
@@ -264,7 +269,7 @@ jobs:
       # hhd-dev/rechunk action emits. See docs/bazzite-pipeline-investigation.md.
       - name: Run native rechunker
         id: rechunk
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && inputs.dry_run != 'build'
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
           DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
@@ -312,7 +317,7 @@ jobs:
           string: ${{ env.IMAGE_REGISTRY }}
 
       - name: Inspect layer sizes
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && inputs.dry_run != 'build'
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
           DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
@@ -335,7 +340,7 @@ jobs:
       # multi-hundred-MB layered images. Matches Bazzite's pattern.
       # Note: sudo skopeo — the chunked image lives in rootful storage.
       - name: Push To GHCR
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && (inputs.dry_run == '' || inputs.dry_run == 'off')
         id: push
         uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         env:
@@ -376,7 +381,7 @@ jobs:
 
       - name: Sign container image
         id: sign_container_image
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && (inputs.dry_run == '' || inputs.dry_run == 'off')
         run: |
           echo "${STEPS_PUSH_OUTPUTS_REGISTRY_PATHS}"
           IMAGE_FULL="${STEPS_REGISTRY_CASE_OUTPUTS_LOWERCASE}/${IMAGE_NAME}"
@@ -393,7 +398,7 @@ jobs:
     needs: build_push
     # main → full release (changelog.py, make_latest)
     # testing → pre-release with minimal body (auto-cleaned by clean-prereleases.yml)
-    if: github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testing')
+    if: github.event_name != 'pull_request' && (inputs.dry_run == '' || inputs.dry_run == 'off') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testing')
     runs-on: ubuntu-24.04
     permissions:
       contents: write