Merge pull request #21 from theupriser/feature/iso-release-notes

Feature/iso release notes

.github/workflows/build.yml

@@ -1,141 +0,0 @@
-name: Desktop ISO
-on:
-  push:
-    branches:
-    - master
-  pull_request:
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    # CachyOS's plain ISO and its quicktest matrix: only in CachyOS's own repo, not in this fork
-    # (the Steamify ISO is steamify-iso.yml).
-    if: github.repository == 'CachyOS/CachyOS-Live-ISO'
-    runs-on: ubuntu-latest
-    container:
-      image: archlinux:base-devel
-      options: --privileged
-    name: Build
-    outputs:
-      builddate: ${{ steps.date.outputs.builddate }}
-    steps:
-      - name: Get build date
-        id: date
-        run: |
-          echo "builddate=$(date +'%y%m%d')" >> $GITHUB_OUTPUT
-
-      - name: Clone CachyOS-Live-ISO
-        id: clone
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Add CachyOS keyring
-        id: keyring
-        run: |
-          pacman-key --init
-          pacman-key --recv-keys F3B607488DB35A47 --keyserver keyserver.ubuntu.com
-          pacman-key --lsign-key F3B607488DB35A47
-
-          sed -i '/^\[core\]$/i[cachyos]\nServer = https://mirror.cachyos.org/repo/$arch/$repo\n' /etc/pacman.conf
-
-      - name: Install dependencies
-        id: dependencies
-        run: |
-          sudo pacman -Syu --noconfirm archiso cachyos-keyring mkinitcpio-archiso squashfs-tools grub
-
-      - name: Create build user
-        id: user-archiso
-        run: |
-          useradd builder -m
-          echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-          chmod -R a+rw .
-
-      - name: Build ISO (${{ steps.date.outputs.builddate }})
-        id: build
-        run: |
-          sudo -H -E -u builder ./buildiso.sh
-
-      - name: Upload ISO to artifacts
-        id: upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: cachyos-desktop-linux-${{ steps.date.outputs.builddate }}
-          path: out/desktop/*
-  quicktest:
-    name: Testing (${{ matrix.bootloader }} / ${{ matrix.filesystem }})
-    runs-on: ubuntu-latest
-    needs: build
-    container:
-      image: archlinux:base-devel
-      options: --privileged
-    strategy:
-      fail-fast: false
-      max-parallel: 4
-      matrix:
-        bootloader: [grub, systemd-boot, refind, limine]
-        filesystem: [btrfs, xfs, ext4, f2fs, zfs]
-    steps:
-      - name: Clone CachyOS-Live-ISO
-        id: clone
-        uses: actions/checkout@v6
-
-      - name: Install dependencies
-        id: dependencies
-        run: |
-          pacman -Syu --noconfirm git ffmpeg imagemagick tesseract-data-eng qemu-desktop
-
-      - name: Create build user
-        id: user
-        run: |
-          useradd builder -m
-          echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-          chmod -R a+rw .
-
-      - name: Build quickemu
-        id: quickemu
-        run: |
-          sudo -u builder git clone https://aur.archlinux.org/quickemu.git
-          cd quickemu
-          sudo -H -E -u builder makepkg --syncdeps --noconfirm
-          pacman -U --noconfirm quickemu*.pkg.tar.zst
-          cd ..
-
-      - name: Clone quicktest
-        id: clone-quicktest
-        uses: actions/checkout@v6
-        with:
-          repository: 'quickemu-project/quicktest'
-          path: 'quicktest'
-
-      - name: Download ISO
-        id: download
-        uses: actions/download-artifact@v4
-        with:
-          path: machines/cachyos-dailylive
-          merge-multiple: true
-
-      - name: Run quicktest
-        id: quicktest
-        run: |
-          ./quicktest/quicktest test_install_calamares cachyos dailylive
-        env:
-          QT_NOTIFY: "false"
-          QT_OPEN_RESULTS: "false"
-          QT_QUICKGET_SKIP: "true"
-          QT_TESTCASES_DIR: "./testcases"
-          QUICKEMU_DISPLAY: "none"
-          QUICKEMU_VM_DIR: "./machines"
-          TEST_BOOTLOADER: "${{ matrix.bootloader }}"
-          TEST_FILESYSTEM: "${{ matrix.filesystem }}"
-
-      - name: Upload results to artifacts
-        id: upload-results
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: cachyos-desktop-linux-results-${{needs.build.outputs.builddate}}-${{ matrix.bootloader }}-${{ matrix.filesystem }}
-          path: results/*

.github/workflows/git-upriser-sync.yml

@@ -0,0 +1,26 @@
+name: Sync git.upriser.nl mirror
+
+# Trigger the Gitea pull-mirror immediately instead of waiting for its interval,
+# so Gitea builds/tests right after any branch or tag lands on GitHub (the mirror has no sync interval of its own).
+on:
+  push:
+    branches: ['**']
+    tags: ['*']
+  workflow_dispatch:
+
+jobs:
+  sync:
+    # Gitea also reads .github/workflows on the mirror; only run on GitHub
+    if: github.server_url == 'https://github.com'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger mirror-sync
+        env:
+          GITEA_URL: ${{ secrets.GIT_UPRISER_URL }}
+          GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
+          # Gitea "owner/repo"; defaults to the same path as on GitHub
+          GITEA_REPO: ${{ vars.GITEA_REPO || github.repository }}
+        run: |
+          curl --fail-with-body -sS --retry 5 --retry-delay 10 --retry-all-errors -X POST \
+            -H "Authorization: token ${GIT_UPRISER_TOKEN}" \
+            "${GITEA_URL%/}/api/v1/repos/${GITEA_REPO}/mirror-sync"

.github/workflows/iso-1-github-tag.yml

@@ -0,0 +1,151 @@
+# The Steamify ISO's release, step 1 of 2 (GitHub): names it and creates its tag and a release with the notes.
+# The Gitea mirror (git.upriser.nl) gets the tag with its next sync (triggered here when GIT_UPRISER_TOKEN is set),
+# builds the ISO on that tag and attaches it to its own release for it (iso-2-gitea-build.yml). The ISO lives there:
+# GitHub releases take at most 2 GB per file, the ISO is bigger, and a release on the mirror only survives its
+# syncs when its tag comes from here.
+# Name: the Steamify version the ISO gets (its newest release) plus the time (UTC, GitHub's clock when the release starts):
+# kind release: v<steamify>-<YYMMDD>, a real release; kind dev: a pre-release v<steamify>-dev-<YYMMDD> (like CachyOS: the
+# day, no time). One ISO per day and kind: the newest build of a day replaces the earlier one. At most 10 dev and 10 real
+# releases are kept (the oldest go, here and, with the mirror's next sync, there).
+name: ISO 1/2 · Tag and release (GitHub)
+
+# Always run from master. Started by steamify-cachyos (its bundle.yml, secret ISO_DISPATCH_TOKEN), which says what to
+# build: a version published from main -> kind release, a version on a release branch -> kind dev. Or by hand (Run
+# workflow); `auto` is a release on master and a dev build on any other branch. Not started by pushes.
+on:
+  workflow_dispatch:
+    inputs:
+      kind:
+        description: "release (a real ISO), dev (a pre-release test build) or auto (release on master, dev elsewhere)"
+        type: choice
+        options: [auto, release, dev]
+        default: auto
+      steamify_ref:
+        description: "Steamify branch or tag to build the ISO with (empty: the newest published release). A release branch tests its own version."
+        type: string
+        default: ""
+
+permissions:
+  contents: write
+
+env:
+  GITEA_URL: ${{ secrets.GIT_UPRISER_URL }}
+  GITEA_REPO: theupriser/steamify-cachyos-live-iso
+
+jobs:
+  tag:
+    if: github.server_url == 'https://github.com'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Tag and release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
+        run: |
+          steamify="$(gh release view -R theupriser/steamify-cachyos --json tagName -q .tagName)"
+          steamify="${steamify#v}"
+          # A branch or tag of Steamify to build with (a release branch before its release), else the newest release.
+          sref="${{ inputs.steamify_ref }}"
+          if [ -n "$sref" ]; then
+            steamify="$(gh api "repos/theupriser/steamify-cachyos/contents/steamify.sh?ref=$sref" -q .content | base64 -d | sed -n 's/^VERSION=//p' | head -n 1)"
+            [ -n "$steamify" ] || { echo "::error::no VERSION in steamify.sh at $sref"; exit 1; }
+          fi
+          stamp="$(date -u +%y%m%d)" day="$(date -u +%Y.%m.%d)"
+          base="$(head -n 1 CHANGELOG.md | sed 's/^# *//')"   # the CachyOS version (first line of the changelog)
+          kind="${{ inputs.kind }}"
+          if [ -z "$kind" ] || [ "$kind" = auto ]; then
+            if [ "${{ github.ref }}" = refs/heads/master ]; then kind=release; else kind=dev; fi
+          fi
+          if [ "$kind" = release ]; then
+            tag="v$steamify-$stamp" pre="" name="CachyOS $base with Steamify $steamify ($day UTC)"
+          else
+            tag="v$steamify-dev-$stamp" pre="--prerelease" name="CachyOS $base with Steamify $steamify (test build $day UTC)"
+          fi
+          # The ISO's file on the mirror is named after the tag (iso-2-gitea-build.yml, profiledef.sh), so its
+          # download link is known now.
+          file="steamify-cachyos-${tag#v}-x86_64.iso" dl="$GITEA_URL/$GITEA_REPO/releases/download/$tag"
+          # The notes are generated, nothing is written by hand:
+          #  - the CachyOS base version (first line of CHANGELOG.md, the fork's upstream changelog),
+          #  - the Steamify version's own changelog section (steamify-cachyos CHANGELOG.md at the ref or tag it is built from),
+          #  - this repository's commits since the previous release of the same kind.
+          steamify_notes="$(gh api "repos/theupriser/steamify-cachyos/contents/CHANGELOG.md?ref=${sref:-v$steamify}" -q .content 2> /dev/null | base64 -d 2> /dev/null |
+              awk -v v="$steamify" 'index($0, "## " v " ") == 1 {f = 1; next} f && /^## / {exit} f')"
+          [ "$kind" = release ] && want_pre=false || want_pre=true
+          [ "$kind" = release ] && kind_name="real release" || kind_name="dev build"
+          prev="$(gh release list -L 50 --json tagName,isPrerelease,createdAt -q "[.[] | select(.isPrerelease == $want_pre and .tagName != \"$tag\")] | sort_by(.createdAt) | reverse | .[0].tagName // empty")"
+          # Commits that change the ISO itself: not the workflow ones (type or scope ci, e.g. ci: / fix(ci):) and not docs:.
+          if [ -n "$prev" ] && git rev-parse -q --verify "refs/tags/$prev" > /dev/null; then
+            range="$prev..HEAD"; limit=40; since="Since \`$prev\`:"
+          else
+            range="HEAD"; limit=12; since="The latest commits (there is no earlier $kind_name to compare with):"
+          fi
+          changes="$(git log --no-merges --format='%s' "$range" | grep -Ev '^(ci|docs)(\(.*\))?:|^[a-z]+\(ci\):' | sed 's/^/- /' | head -n "$limit" || true)"
+          [ -n "$changes" ] || changes="- No changes to the ISO itself."
+          notes="![ISO build](https://img.shields.io/badge/ISO_build-running-yellow)
+
+          **CachyOS $base with Steamify $steamify${sref:+ (branch $sref)} built in.** Install CachyOS and turn the PC into a Steam Machine in one go.
+
+          The ISO is built from \`$(git rev-parse --short HEAD)\` (${{ github.ref_name }}). It is about 3 GB, more than a GitHub release can hold (2 GB per file), so it is published on the mirror about 20 minutes after this release is created:
+
+          **Download: [$file]($dl/$file)** ([SHA-256]($dl/$file.sha256), [release page]($GITEA_URL/$GITEA_REPO/releases/tag/$tag))
+
+          ### Steamify $steamify
+          ${steamify_notes:-There is no changelog section for this version.}
+
+          ### Changes in this ISO
+          $since
+          $changes
+
+          ### Sources
+          [Steamify](https://github.com/theupriser/steamify-cachyos/tree/${sref:-v$steamify}), this repository at this tag, and the packages' sources at [CachyOS](https://github.com/CachyOS) and [Arch Linux](https://archlinux.org/packages/)."
+          # One ISO per day and kind: the newest build of a day replaces the earlier one (space), here and on the mirror.
+          if git ls-remote --exit-code --tags origin "refs/tags/$tag" > /dev/null 2>&1 || gh release view "$tag" > /dev/null 2>&1; then
+            echo "$tag exists: replacing it"
+            gh release delete "$tag" --cleanup-tag -y 2> /dev/null || true
+            git push origin ":refs/tags/$tag" 2> /dev/null || true
+          fi
+          # An annotated tag: its own date, so the mirror sorts releases on the same commit in order (a
+          # lightweight tag only has its commit's date).
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$tag" -m "$name" "$GITHUB_SHA" && git push origin "refs/tags/$tag"
+          gh release create "$tag" --verify-tag $pre --title "$name" --notes "$notes"
+          echo "Released $tag"
+          echo "ISO_TAG=$tag" >> "$GITHUB_ENV"
+          echo "STEAMIFY_REF=$sref" >> "$GITHUB_ENV"
+
+          # Retention (space): at most 10 dev and 10 real releases; the oldest go, release and tag. The mirror drops the
+          # tag with its release and ISO at its next sync (the step below).
+          keep=10
+          for pre_flag in true false; do
+            gh release list -L 200 --json tagName,isPrerelease,createdAt \
+                -q "[.[] | select(.isPrerelease == $pre_flag)] | sort_by(.createdAt) | reverse | .[$keep:][] | .tagName" |
+              while read -r old; do echo "Retention: removing $old"; gh release delete "$old" --cleanup-tag -y; done
+          done
+
+      # The mirror takes the tag (sync), then the build on the mirror is started explicitly (its dispatch API): a tag that
+      # is replaced (same name, a new tag object) starts no run there by itself. Needs a Gitea token with repository write
+      # access as the secret GIT_UPRISER_TOKEN; without it the mirror picks the tag up later and nothing is built.
+      - name: Sync the Gitea mirror and start its build
+        env:
+          GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
+        run: |
+          if [ -z "$GIT_UPRISER_TOKEN" ]; then echo "No GIT_UPRISER_TOKEN: the mirror is not synced and no build is started."; exit 0; fi
+          api="$GITEA_URL/api/v1/repos/$GITEA_REPO"
+          curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$api/mirror-sync"
+          echo "Mirror sync started"
+          want="$(git rev-parse "refs/tags/$ISO_TAG")"
+          for _ in $(seq 60); do
+            got="$(curl -s "$api/tags/$ISO_TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("id",""))' 2> /dev/null)"
+            [ "$got" = "$want" ] && break
+            sleep 5
+          done
+          [ "$got" = "$want" ] || { echo "::error::the mirror does not have $ISO_TAG ($want) after 5 minutes"; exit 1; }
+          # ref: the full name (refs/tags/...), as in Gitea's API documentation; --fail-with-body shows the server's reason.
+          curl -sS --fail-with-body --retry 3 -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" -H "Content-Type: application/json" \
+              -d "{\"ref\":\"refs/tags/$ISO_TAG\",\"inputs\":{\"steamify_ref\":\"$STEAMIFY_REF\"}}" "$api/actions/workflows/iso-2-gitea-build.yml/dispatches"
+          echo "Started the mirror's build for $ISO_TAG"

.github/workflows/iso-2-gitea-build.yml

@@ -0,0 +1,247 @@
+# The Steamify ISO's release, step 2 of 2 (the Gitea mirror, git.upriser.nl, on its own runner): builds the
+# ISO for a release tag that iso-1-github-tag.yml created on GitHub (it comes in with the mirror's sync, and a
+# release on the mirror only survives its syncs when its tag comes from GitHub), then attaches the ISO, its
+# checksums and package list to the mirror's release for that tag. The tag names the Steamify version and
+# the time: v<steamify>-<YYYY.MM.DD>-<HHMM> (master) or v<steamify>-dev.<...> (feat/steamify, a pre-release);
+# the ISO gets exactly that Steamify release, and its label the same moment. GitHub skips it.
+# Two jobs: build the ISO -> release it. The VM tests run on GitHub (steamify-cachyos vmtest.yml, the newest ISO release of
+# this mirror), where the runners are bigger.
+# The runner needs privileged containers (archiso mounts loop devices) and ~20 GB of disk; Gitea's
+# [repository.release] FILE_MAX_SIZE must allow the ISO (default 2 GB).
+name: ISO 2/2 · Build and publish (Gitea)
+
+# Started by iso-1-github-tag.yml through the mirror's dispatch API, with the tag as the ref (a replaced tag starts no
+# run by itself, so nothing is triggered by tag pushes).
+on:
+  workflow_dispatch:
+    inputs:
+      steamify_ref:
+        description: "Steamify branch or tag to build with (set by iso-1; empty: the release the tag names)"
+        type: string
+        default: ""
+
+# One run at a time for the whole workflow (not per tag): a new run stops the running one and takes over.
+concurrency:
+  group: steamify-iso
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build the ISO
+    if: github.server_url != 'https://github.com'
+    runs-on: ubuntu-latest
+    container:
+      image: docker.io/cachyos/cachyos:latest
+      options: --privileged
+    defaults:
+      run:
+        shell: bash
+    outputs:
+      steamify: ${{ steps.tag.outputs.steamify }}
+    steps:
+      # First only what the cache action needs (node, git), then the caches, then the rest from the restored cache.
+      - name: Node and git
+        id: node
+        run: |
+          pacman-key --init && pacman-key --populate
+          pacman -Syu --noconfirm --needed nodejs git
+          # The caches' keys: one entry per ISO week (an exact hit saves nothing, a new week restores the old one and saves once).
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+      - name: Cache - pacman packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/pacman/pkg
+          key: pacman-build-${{ steps.node.outputs.week }}
+          restore-keys: pacman-build-
+      - name: Tools
+        run: pacman -S --noconfirm --needed archiso mkinitcpio-archiso squashfs-tools grub sudo curl jq
+
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Version and time from the tag
+        id: tag
+        run: |
+          tag="${{ github.ref_name }}"
+          [[ "$tag" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-(dev-)?([0-9]{6})$ ]] ||
+              { echo "::error::$tag is not a Steamify ISO release tag (v<steamify>-[dev-]<YYMMDD>)"; exit 1; }
+          m=("${BASH_REMATCH[@]}")
+          {
+            echo "STEAMIFY_VERSION=${m[1]}"
+            # The day (YYMMDD, UTC) for the ISO's label (profiledef.sh) and the release's name: the tag's.
+            echo "STEAMIFY_BUILD_STAMP=${m[3]}"
+            echo "ISO_PRERELEASE=$([ -n "${m[2]}" ] && echo true || echo false)"
+            # The ISO's file name: the tag without its v (profiledef.sh).
+            echo "STEAMIFY_ISO_VERSION=${tag#v}"
+          } >> "$GITHUB_ENV"
+
+          echo "steamify=${m[1]}" >> "$GITHUB_OUTPUT"
+
+      - name: Steamify on the ISO (the version the tag names)
+        run: |
+          ref="${{ inputs.steamify_ref }}"
+          if [ -n "$ref" ]; then
+            # A branch (a release branch before its release): its checkout goes on the ISO.
+            git clone -q --depth 1 --branch "$ref" https://github.com/theupriser/steamify-cachyos.git /tmp/steamify-src
+            ./steamify-prepare.sh /tmp/steamify-src
+          else
+            ./steamify-prepare.sh
+          fi
+
+      - name: Build
+        run: |
+          ./build-live-modules.sh
+          ./build-calamares-modules.sh
+          ./buildiso.sh -p desktop -w || ./buildiso.sh -p desktop -c -w
+
+
+      - name: Keep the ISO for the tests and the release
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: iso
+          path: |
+            out/desktop/*.iso
+            out/desktop/*.iso.sha256
+            out/desktop/*.iso.sha1
+            out/desktop/*.pkgs.txt
+          retention-days: 3
+
+  release:
+    name: Release
+    needs: build
+    runs-on: ubuntu-latest
+    container:
+      image: docker.io/cachyos/cachyos:latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Tools
+        run: |
+          pacman-key --init && pacman-key --populate
+          # nodejs: the actions below run in this container
+          pacman -Syu --noconfirm --needed git nodejs curl jq
+
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Version and time from the tag
+        run: |
+          tag="${{ github.ref_name }}"
+          [[ "$tag" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-(dev-)?([0-9]{6})$ ]] ||
+              { echo "::error::$tag is not a Steamify ISO release tag (v<steamify>-[dev-]<YYMMDD>)"; exit 1; }
+          m=("${BASH_REMATCH[@]}")
+          {
+            echo "STEAMIFY_VERSION=${m[1]}"
+            # The day (YYMMDD, UTC) for the ISO's label (profiledef.sh) and the release's name: the tag's.
+            echo "STEAMIFY_BUILD_STAMP=${m[3]}"
+            echo "ISO_PRERELEASE=$([ -n "${m[2]}" ] && echo true || echo false)"
+            # The ISO's file name: the tag without its v (profiledef.sh).
+            echo "STEAMIFY_ISO_VERSION=${tag#v}"
+          } >> "$GITHUB_ENV"
+
+
+      - uses: christopherhx/gitea-download-artifact@v4
+        with:
+          name: iso
+          path: out/desktop
+
+      - name: Release name and notes
+        id: rel
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          iso="$(ls out/desktop/*.iso | head -n 1)"
+          [ -f "$iso" ] || { echo "::error::no ISO in out/desktop"; exit 1; }
+          tag="${{ github.ref_name }}" b="$STEAMIFY_BUILD_STAMP"
+          stamp="20${b:0:2}.${b:2:2}.${b:4:2}"
+          base="$(head -n 1 CHANGELOG.md | sed 's/^# *//')"   # the CachyOS version, as in the GitHub release's title
+          if [ "$ISO_PRERELEASE" = true ]; then
+            name="CachyOS $base with Steamify $STEAMIFY_VERSION (test build $stamp UTC)"
+          else
+            name="CachyOS $base with Steamify $STEAMIFY_VERSION ($stamp UTC)"
+          fi
+          # One ISO per day and kind: a release of this tag from an earlier build of the day is replaced.
+          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          if curl -fsS -H "Authorization: token $TOKEN" "$api/releases/tags/$tag" -o /tmp/rel.json; then
+            echo "Replacing the earlier release of $tag"
+            curl -fsS -X DELETE -H "Authorization: token $TOKEN" "$api/releases/$(jq -r .id /tmp/rel.json)" || true
+          fi
+          { echo "publish=true"; echo "name=$name"; } >> "$GITHUB_OUTPUT"
+          section="$(awk '/^## CachyOS with Steamify Live ISO/ {found = 1; next} found && /^#/ {exit} found' CHANGELOG.md)"
+          src="${{ inputs.steamify_ref }}"; src="${src:-v$STEAMIFY_VERSION}"
+          # The same notes as the GitHub release (one source: iso-1 generated them), without its badge line; the
+          # checksum line is added here. Fallback: a short text.
+          if curl -fsS "https://api.github.com/repos/theupriser/steamify-cachyos-live-iso/releases/tags/$tag" -o /tmp/ghrel.json; then
+            jq -r '.body // ""' /tmp/ghrel.json | sed '/ISO build\]/d' > release-notes.md
+          else
+            echo "Built from \`$(git rev-parse --short HEAD)\` ($tag) with Steamify $STEAMIFY_VERSION." > release-notes.md  # fallback when GitHub cannot be reached
+          fi
+          {
+            echo
+            echo "### Checksum"
+            echo "SHA-256 of the ISO: \`$(cut -d' ' -f1 "$iso.sha256")\` (label \`STEAMIFY_${STEAMIFY_VERSION//./_}_$b\`)."
+          } >> release-notes.md
+          cat release-notes.md
+
+      - name: Publish ${{ github.ref_name }}
+        if: steps.rel.outputs.publish == 'true'
+        uses: akkuman/gitea-release-action@v1.3.7
+        with:
+          token: ${{ github.token }}
+          tag_name: ${{ github.ref_name }}
+          name: ${{ steps.rel.outputs.name }}
+          body_path: release-notes.md
+          prerelease: ${{ env.ISO_PRERELEASE }}
+          files: |
+            out/desktop/*.iso
+            out/desktop/*.iso.sha256
+            out/desktop/*.iso.sha1
+            out/desktop/*.pkgs.txt
+
+  # The result goes back to GitHub: the badge at the top of the GitHub release (started as "running" by iso-1) becomes
+  # succeeded / failed / cancelled and links to this run. Needs a GitHub token as the secret GH_RELEASE_TOKEN here on the
+  # mirror (fine-grained, this repository only, Contents: read and write); without it the badge stays "running".
+  report:
+    name: Report the result to GitHub
+    needs: [build, release]
+    if: ${{ always() && github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    container:
+      image: docker.io/cachyos/cachyos:latest
+    steps:
+      - name: Badge in the GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+          BUILD: ${{ needs.build.result }}
+          RELEASE: ${{ needs.release.result }}
+        run: |
+          [ -n "$GH_TOKEN" ] || { echo "No GH_RELEASE_TOKEN: GitHub's release keeps its 'running' badge."; exit 0; }
+          pacman -Sy --noconfirm --needed curl python > /dev/null
+          tag="${{ github.ref_name }}"
+          if [ "$BUILD" = success ] && [ "$RELEASE" = success ]; then st=succeeded col=brightgreen
+          elif [ "$BUILD" = cancelled ] || [ "$RELEASE" = cancelled ]; then st=cancelled col=lightgrey
+          else st=failed col=red; fi
+          run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          api="https://api.github.com/repos/theupriser/steamify-cachyos-live-iso/releases"
+          curl -fsS -H "Authorization: Bearer $GH_TOKEN" "$api/tags/$tag" -o /tmp/rel.json || { echo "::warning::no GitHub release for $tag"; exit 0; }
+          ST="$st" COL="$col" RUN="$run" RUN_ID="${{ github.run_id }}" python3 - << 'PY'
+          import json, os, re
+          d = json.load(open("/tmp/rel.json"))
+          body = d.get("body") or ""
+          # This runner reports its internal address (http://server:3000) as the server URL: the public one is in the
+          # release page link that iso-1 wrote into the notes.
+          m = re.search(r"\]\((https?://[^)\s]+)/releases/tag/", body)
+          run = f"{m.group(1)}/actions/runs/{os.environ['RUN_ID']}" if m else os.environ["RUN"]
+          badge = f"[![ISO build](https://img.shields.io/badge/ISO_build-{os.environ['ST']}-{os.environ['COL']})]({run})"
+          pat = re.compile(r"\[?!\[ISO build\]\([^)]*\)(\]\([^)]*\))?")
+          body = pat.sub(lambda m: badge, body, count=1) if pat.search(body) else badge + "\n\n" + body
+          json.dump({"body": body}, open("/tmp/patch.json", "w"))
+          open("/tmp/rel.id", "w").write(str(d["id"]))
+          PY
+          curl -fsS -X PATCH -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/json" -d @/tmp/patch.json "$api/$(cat /tmp/rel.id)" > /dev/null
+          echo "GitHub release $tag: ISO build $st"

.github/workflows/steamify-iso.yml

@@ -1,102 +0,0 @@
-# The Steamify ISO, built and released on the Gitea mirror (git.upriser.nl) by its own runner: the same
-# build as by hand (the wsl-build-host skill in steamify-cachyos-dev), then a Gitea release with the ISO,
-# its checksums and package list, notes from CHANGELOG.md's Steamify section. The ISO's version is the
-# Steamify version on it plus the build date and time (UTC): master releases v<steamify>-<date>-<HHMM>,
-# feat/steamify a pre-release v<steamify>-dev.<date>-<HHMM>. Never overwritten. GitHub skips it (one file
-# for both servers; GitHub releases take at most 2 GB per file, the ISO is bigger).
-# The runner needs privileged containers (archiso mounts loop devices) and ~20 GB of disk; Gitea's
-# [attachment] MAX_SIZE must allow the ISO (default 2 GB).
-name: Steamify ISO (Gitea release)
-
-on:
-  push:
-    branches: [master, feat/steamify]
-  workflow_dispatch:
-
-concurrency:
-  group: steamify-iso
-  cancel-in-progress: true
-
-jobs:
-  iso:
-    if: github.server_url != 'https://github.com'
-    runs-on: ubuntu-latest
-    container:
-      image: docker.io/cachyos/cachyos:latest
-      options: --privileged
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Tools
-        run: |
-          pacman-key --init && pacman-key --populate
-          # nodejs: the actions below run in this container
-          pacman -Syu --noconfirm --needed archiso mkinitcpio-archiso git squashfs-tools grub sudo nodejs curl jq
-
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Steamify on the ISO (its newest release)
-        run: |
-          ./steamify-prepare.sh
-          # One moment for the ISO's label (profiledef.sh) and the release's name.
-          echo "STEAMIFY_BUILD_STAMP=$(date -u +%Y%m%d_%H%M)" >> "$GITHUB_ENV"
-
-      - name: Build
-        run: |
-          ./build-live-modules.sh
-          ./build-calamares-modules.sh
-          ./buildiso.sh -p desktop -w || ./buildiso.sh -p desktop -c -w
-
-      - name: Release name and notes
-        id: rel
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          iso="$(ls out/desktop/*.iso | head -n 1)"
-          [ -f "$iso" ] || { echo "::error::no ISO in out/desktop"; exit 1; }
-          steamify="$(sed -n 's/^VERSION=//p' archiso/airootfs/usr/local/share/steamify/steamify.sh | head -n 1)"
-          [ -n "$steamify" ] || { echo "::error::no Steamify version on the ISO"; exit 1; }
-          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
-          exists() { curl -fsS -o /dev/null -H "Authorization: token $TOKEN" "$api/releases/tags/$1"; }
-          b="$STEAMIFY_BUILD_STAMP"   # YYYYMMDD_HHMM (UTC), the same moment as the ISO's label
-          stamp="${b:0:4}.${b:4:2}.${b:6:2}-${b:9:4}"   # every build its own name
-          if [ "${{ github.ref }}" = refs/heads/master ]; then
-            tag="v$steamify-$stamp" prerelease=false name="CachyOS with Steamify Live ISO $steamify ($stamp UTC)"
-          else
-            tag="v$steamify-dev.$stamp" prerelease=true name="CachyOS with Steamify Live ISO $steamify (test build $stamp UTC)"
-          fi
-          # Never overwritten (a rerun in the same minute would find its tag taken).
-          if exists "$tag"; then
-            echo "::warning::$tag is already released and won't be overwritten."
-            echo "publish=false" >> "$GITHUB_OUTPUT"; exit 0
-          fi
-          { echo "publish=true"; echo "tag=$tag"; echo "prerelease=$prerelease"; echo "name=$name"; } >> "$GITHUB_OUTPUT"
-          # The Steamify section of CHANGELOG.md ("## CachyOS with Steamify Live ISO"), without its heading.
-          section="$(awk '/^## CachyOS with Steamify Live ISO/ {found = 1; next} found && /^#/ {exit} found' CHANGELOG.md)"
-          {
-            echo "Built $(date -u '+%F %H:%M UTC') from \`$(git rev-parse --short HEAD)\` (${{ github.ref_name }}), with Steamify $steamify."
-            echo
-            echo "SHA-256: \`$(cut -d' ' -f1 "$iso.sha256")\`, label \`STEAMIFY_${steamify//./_}_$b\`"
-            echo
-            echo "$section"
-          } > release-notes.md
-          cat release-notes.md
-
-      - name: Publish ${{ steps.rel.outputs.tag }}
-        if: steps.rel.outputs.publish == 'true'
-        uses: akkuman/gitea-release-action@v1.3.7
-        with:
-          token: ${{ github.token }}
-          tag_name: ${{ steps.rel.outputs.tag }}
-          target_commitish: ${{ github.sha }}
-          name: ${{ steps.rel.outputs.name }}
-          body_path: release-notes.md
-          prerelease: ${{ steps.rel.outputs.prerelease }}
-          files: |
-            out/desktop/*.iso
-            out/desktop/*.iso.sha256
-            out/desktop/*.iso.sha1
-            out/desktop/*.pkgs.txt

AGENTS.md

@@ -109,3 +109,40 @@ Large `scp` transfers (e.g. the ~3.2GB built ISO) over this same flaky link
 can report "Connection closed" while actually still having copied fully —
 check the destination file's size/timestamp before assuming a real
 failure, and retry the copy (it's idempotent) rather than the whole build.
+
+## Releases (GitHub tag, ISO built and attached on the Gitea mirror)
+
+Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev. What matters here:
+
+- `.github/workflows/iso-1-github-tag.yml` (GitHub, `workflow_dispatch` only: by hand, or started by a new Steamify
+  release, whose `bundle.yml` needs the secret `ISO_DISPATCH_TOKEN`) names the release like CachyOS does, by the day (GitHub's UTC
+  date, no time): `vX.Y.Z-YYMMDD` (real) or `vX.Y.Z-dev-YYMMDD` (dev), file `steamify-cachyos-X.Y.Z-[dev-]YYMMDD-x86_64.iso`, an **annotated** tag and a
+  release with notes and the direct download link. One ISO per day and kind: a second build the same day deletes
+  the earlier release and tag (GitHub) and tags again; the mirror takes the new tag object, iso-2 replaces the old mirror release. Retention: at most 10 dev and 10 real
+  releases are kept (space); the oldest are deleted with `gh release delete --cleanup-tag`, and the mirror drops their tags, releases and ISOs at its next sync. The workflow always runs from `master`; its input `steamify_ref` (a Steamify branch or tag, empty = the newest published release) builds the ISO with that checkout and names it after that branch's `VERSION` (a release branch tests its own version before it is released); its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
+- `.github/workflows/iso-2-gitea-build.yml` (Gitea, `workflow_dispatch` with the tag as the ref, started by iso-1's last step through the mirror's dispatch API after the mirror has the new tag object; a tag push starts nothing, because a replaced tag of the same name starts no run; skipped on GitHub) runs two jobs for that
+  tag: build the ISO, then attach it to the mirror's release. It is not tested there (the runner is small): the VM tests
+  run on GitHub, in steamify-cachyos `vmtest.yml`, on the newest ISO release of the mirror. The tag decides everything: Steamify version (`steamify-prepare.sh`
+  takes `STEAMIFY_VERSION`), file name (`STEAMIFY_ISO_VERSION` -> `iso_version` in `profiledef.sh`), label
+  (`STEAMIFY_BUILD_STAMP`, YYMMDD), boot menu and `/etc/steammachine-iso-build`. The build reads no clock; without a
+  tag everything says `local`.
+- `util-iso.sh` runs `sudo mkarchiso`: sudo drops the environment, so `--preserve-env=STEAMIFY_ISO_VERSION,
+  STEAMIFY_BUILD_STAMP` is required (without it the ISO comes out `-local-`).
+- Never create a release on the mirror by hand or from a Gitea-only tag: the pull mirror's next sync deletes tags
+  GitHub doesn't have, and the release with them. GitHub releases can't hold the ISO (2 GB per file).
+- Gitea needs `[repository.release] FILE_MAX_SIZE` above the ISO (413 otherwise) and the runner
+  `container: privileged: true` (archiso mounts `/proc`); the workflow's `--privileged` option is ignored.
+- Caches (`actions/cache`, the runner's cache server): pacman's package cache per job kind (build, test) and the VMs' packages (`VM_CACHE`, `~/vms/pkg-cache`), keys per ISO week. Each job first installs only node and git, restores the caches, then installs the rest.
+- CachyOS's own `Desktop ISO` workflow (`build.yml`) is removed here; the VM tests live in steamify-cachyos (GitHub).
+
+- **Build badge in the GitHub release:** iso-1 puts `![ISO build](...running-yellow)` at the top of the release notes;
+  iso-2's last job `report` (`if: always()`) replaces it with succeeded / failed / cancelled, linked to the Gitea run,
+  through the GitHub API with the Gitea secret `GH_RELEASE_TOKEN` (fine-grained, this repo, Contents read and write).
+  Without the secret the badge stays "running". Gitea's own badge can't show these runs (they run on a tag ref).
+- **Release notes are generated, not written by hand** (iso-1): the CachyOS base version (first line of CHANGELOG.md), the
+  Steamify version's own changelog section (steamify-cachyos CHANGELOG.md at the ref or tag it is built from) and this
+  repository's commits since the previous release of the same kind (newest 40). iso-2 takes the same text from the GitHub
+  release for the mirror's release (one source), without the badge line, and adds the checksum line. The old hand-written
+  "## CachyOS with Steamify Live ISO" section in CHANGELOG.md is no longer used.
+- **Release title:** `CachyOS <base> with Steamify <version> (<YYYY.MM.DD> UTC)` (dev: `(test build <date> UTC)`), the same on GitHub
+  and on the mirror; `<base>` is the first line of CHANGELOG.md (e.g. 26.08).

CHANGELOG.md

@@ -28,12 +28,13 @@
 
 ## CachyOS with Steamify Live ISO
 CachyOS 26.08 with Steamify built in: install CachyOS and turn the PC into a Steam Machine in one go.
-Its version is the Steamify version on it plus the build date and time (a release on `master` is `v<Steamify version>-<date>-<HHMM UTC>`, e.g. `v2.9.1-2026.09.29-1432`).
+Its version is the Steamify version on it plus the build date and time (UTC, when the release starts on GitHub; a release on `master` is `v<Steamify version>-<date>-<HHMM>`, e.g. `v2.9.3-2026.09.29-2015`). A new Steamify release starts one (a test build for now); by hand: Run workflow on "ISO 1/2 · Tag and release (GitHub)".
+Releases: GitHub creates the tag and a release with the notes; the ISO itself (over GitHub's 2 GB limit) is built on the Gitea mirror and attached to its release for that tag (git.upriser.nl).
 
 **Features:**
 
-* **ISO:** called `steamify-cachyos-<date>-x86_64.iso`, labelled after the Steamify version on it and the build time (`STEAMIFY_2_9_1_20260929_1432`, was CachyOS's `COS_<year><month>`); CachyOS Hello installs it like CachyOS's own
-  release (the build date is kept in `/etc/steammachine-iso-build`)
+* **ISO:** named after its release tag (`steamify-cachyos-2.9.3-2026.09.29-2030-x86_64.iso`; built by hand, without a tag: `local`), labelled after the Steamify version on it and the build time (`STEAMIFY_2_9_1_20260929_1432`, was CachyOS's `COS_<year><month>`); CachyOS Hello installs it like CachyOS's own
+  release (the ISO's own release, its tag without the v, is in `/etc/steammachine-iso-build` and the boot menu)
 * **Installer (CachyOS - Steamify Installer):**
   * A Steamify page after the packages page: which Steam Machine parts to set up (rows from
     `steamify.sh --defaults --list`, the newest Steamify fetched before Calamares starts) and where

README.md

@@ -18,8 +18,8 @@ You need about 20 GB of free space, and a Linux PC with
 build runs in CachyOS's own container, so the PC doesn't have to run CachyOS.
 
 ```bash
-git clone -b feat/steamify https://github.com/theupriser/steammachine-cachyos-live-iso
-cd steammachine-cachyos-live-iso
+git clone -b feat/steamify https://github.com/theupriser/steamify-cachyos-live-iso
+cd steamify-cachyos-live-iso
 
 # Put Steamify on the ISO: the newest release. To use your own checkout,
 # pass its path: ./steamify-prepare.sh ~/steamify-cachyos

archiso/profiledef.sh

@@ -2,17 +2,19 @@
 # shellcheck disable=SC2034
 
 iso_name="steamify-cachyos"
-# The label follows the release name: the Steamify version on the ISO (steamify-prepare.sh put it there)
-# plus the build date and time, e.g. STEAMIFY_2_9_1_20260929_1432 (ISO 9660: at most 32 characters,
-# A-Z 0-9 _). STEAMIFY_BUILD_STAMP (YYYYMMDD_HHMM, UTC) from the release workflow, so both name the same
-# moment; built by hand, the time now.
+# The label follows the release tag, which GitHub names (iso-1-github-tag.yml): the Steamify version on the ISO
+# (steamify-prepare.sh put it there) plus the tag's day, e.g. STEAMIFY_2_9_3_260929 (ISO 9660:
+# at most 32 characters, A-Z 0-9 _). STEAMIFY_BUILD_STAMP (YYMMDD, UTC) comes from the tag; the build
+# reads no clock of its own. Built by hand, without a tag: LOCAL.
 _steamify="$(sed -n 's/^VERSION=//p' "${BASH_SOURCE[0]%/*}/airootfs/usr/local/share/steamify/steamify.sh" 2>/dev/null | head -n 1)"
-_stamp="${STEAMIFY_BUILD_STAMP:-$(date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y%m%d_%H%M)}"
+_stamp="${STEAMIFY_BUILD_STAMP:-LOCAL}"
 iso_label="STEAMIFY_${_steamify:+${_steamify//./_}_}${_stamp}"
 iso_label="${iso_label:0:32}"
 iso_publisher="CachyOS <https://cachyos.org>"
 iso_application="Steamify CachyOS Live (based on CachyOS)"
-iso_version="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y.%m.%d)"
+# The file name (<iso_name>-<iso_version>-x86_64.iso) is the release tag without its v (STEAMIFY_ISO_VERSION
+# from the tag: steamify-cachyos-2.9.6-dev-260930-x86_64.iso). Built by hand, without a tag: local.
+iso_version="${STEAMIFY_ISO_VERSION:-local}"
 install_dir="arch"
 buildmodes=('iso')
 ## GRUB

patches/packagechooserq-steamify-summary.patch

@@ -21,7 +21,7 @@ diff -ruN a/packagechooserq/PackageChooserQmlViewStep.cpp b/packagechooserq/Pack
 -    //QString option = m_pkgc;
 -    //return tr( "Install option: %1" ).arg( option );
 -    return m_config->prettyStatus();
-+    // Steamify page (steammachine-cachyos-live-iso): its choice is Steamify's
++    // Steamify page (steamify-cachyos-live-iso): its choice is Steamify's
 +    // item ids ("boot" = start in the desktop, "none" = nothing on); show
 +    // their labels, from the rows calamares-online.sh writes next to the
 +    // page, instead of the raw ids. Any other use keeps the stock text.

steamify-prepare.sh

@@ -2,21 +2,25 @@
 # steamify-prepare.sh [steamify checkout]: puts the Steamify bundle on the
 # ISO (archiso/airootfs/usr/local/share/steamify/steamify.sh), used by the
 # installer's Steamify step, and what its Steamify page shows (qml/). Built from a checkout when given, else the
-# newest release. Run before buildiso.sh.
+# newest release, or exactly release $STEAMIFY_VERSION (e.g. 2.9.2: the ISO release workflow, whose tag names
+# the version). Run before buildiso.sh.
 set -euo pipefail
+rel="https://github.com/theupriser/steamify-cachyos/releases/${STEAMIFY_VERSION:+download/v$STEAMIFY_VERSION}"
+[[ -n "${STEAMIFY_VERSION:-}" ]] || rel+="latest/download"
+src_ref="${STEAMIFY_VERSION:+v$STEAMIFY_VERSION}"; src_ref="${src_ref:-main}"
 dest="$(cd "$(dirname "$0")" && pwd)/archiso/airootfs/usr/local/share/steamify/steamify.sh"
 mkdir -p "$(dirname "$dest")"
 if [[ -n "${1:-}" ]]; then
     (cd "$1" && .github/tools/bundle.sh "$dest")
 else
-    curl -fsSL https://github.com/theupriser/steamify-cachyos/releases/latest/download/steamify.sh -o "$dest"
+    curl -fsSL "$rel/steamify.sh" -o "$dest"
 fi
 # The power-off fix's source, for build-live-modules.sh (live session).
 poweroff="$(dirname "$dest")/steamify-fremont-poweroff.c"
 if [[ -n "${1:-}" ]]; then
     cp "$1/patches/steamify-fremont-poweroff.c" "$poweroff"
 else
-    curl -fsSL https://raw.githubusercontent.com/theupriser/steamify-cachyos/main/patches/steamify-fremont-poweroff.c -o "$poweroff"
+    curl -fsSL "https://raw.githubusercontent.com/theupriser/steamify-cachyos/$src_ref/patches/steamify-fremont-poweroff.c" -o "$poweroff"
 fi
 # The installer's Steamify page (/usr/local/share/steamify-installer/
 # SteamifyPage.qml) shows the app's explanations (Theme.qml, Texts.qml, from the
@@ -27,7 +31,7 @@ rm -rf "$qml"; mkdir -p "$qml"
 if [[ -n "${1:-}" ]]; then
     cp "$1"/ui/qml/{Theme,Texts}.qml "$qml/"
 else
-    curl -fsSL https://github.com/theupriser/steamify-cachyos/releases/latest/download/steamify-app.tar.gz |
+    curl -fsSL "$rel/steamify-app.tar.gz" |
         tar -xz -C "$qml" --strip-components=2 ui/qml/Theme.qml ui/qml/Texts.qml
 fi
 cp "$(cd "$(dirname "$0")" && pwd)/archiso/airootfs/usr/local/share/steamify-installer/Items.qml" "$qml/"

util-iso.sh

@@ -140,7 +140,10 @@ prepare_profile(){
 
     info "Profile: [%s]" "${profile}"
 
-    local _iso_version="$(date +%y%m%d)"
+    # The release tag without its v when the release workflow builds (STEAMIFY_ISO_VERSION): the boot menu
+    # and /etc/steammachine-iso-build name the same release as the file, label and tag (no clock of its own).
+    # By hand, without a tag: local.
+    local _iso_version="${STEAMIFY_ISO_VERSION:-local}"
     change_grub_version "${_iso_version}"
 
     # Fetch up-to-date version of CachyOS repo mirrorlist
@@ -198,7 +201,8 @@ run_build() {
 
     [ -d "$outFolder/$_profile" ] || mkdir -p "$outFolder/$_profile"
     cd ${work_dir}/archiso/
-    sudo mkarchiso -v -w ${work_dir} -o "$outFolder/$_profile" ${work_dir}/archiso/
+    # sudo drops the environment: the release tag's file name and label (profiledef.sh) must get through.
+    sudo --preserve-env=STEAMIFY_ISO_VERSION,STEAMIFY_BUILD_STAMP mkarchiso -v -w ${work_dir} -o "$outFolder/$_profile" ${work_dir}/archiso/
     # $USER is empty when this runs as root (e.g. in a container): an empty
     # chown failed and aborted the rest (the build was done, the exit code 1).
     sudo chown "${SUDO_USER:-${USER:-$(id -un)}}" "$outFolder"