Builds from GitHub Actions

The Pantahub builder action submits a build of the pushed commit from a workflow, streams its log into the job, and downloads the signed exports as workflow artifacts. The build itself runs on Pantacor's runners, not on the GitHub runner: the job only waits for it, so a free ubuntu-latest runner is enough even for a Yocto build.

From push to stage

The whole path, for a repository prepared for the builder:

1. Create a personal token in the Hub (Tokens → /tokens/new) with builds and objects.readonly (builds.write, builds.readonly and objects.readonly if the repository is public and you sign with the developer key). Copy it; it is shown once.
2. Store it in the repository as an Actions secret named PANTAHUB_TOKEN: GitHub → Settings → Secrets and variables → Actions → New repository secret, or

   gh secret set PANTAHUB_TOKEN --repo acme/hello-http

3. Private sources? Add a git secret in the Hub whose hosts cover the repository (and any private layer or SDK the recipe fetches).
4. Add the action to the repository: copy action.yml and build.py from integrations/github-action/ of the pantahub-builder project into .github/actions/pantahub-builder/ (it becomes pantacor/builder-action@v1 once published).
5. Add the workflow below as .github/workflows/pantahub-build.yml.
6. Push. Every push to main (and every v* tag) builds on stage. Watch it in the job log, in the job summary, or on the Hub's Builds page; download the exports from the run's artifacts.

Workflow

name: Pantahub build

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # Only the action is needed: the runner fetches the source itself.
      - uses: actions/checkout@v4
        with:
          sparse-checkout: .github/actions
      - uses: ./.github/actions/pantahub-builder
        id: build
        with:
          api-url: https://api.stage.pantahub.com
          api-username: your-hub-username
          api-key: ${{ secrets.PANTAHUB_TOKEN }}
          project: hello-http
          app: hello-http
          platform: linux/arm64,linux/amd64
          timeout-minutes: 120
          # secret: gh-acme             # a recipe fetches private layers/sources
          # signing-secret: release-key # sign with your key instead of the developer key
      - uses: actions/upload-artifact@v4
        with:
          name: hello-http-exports
          path: artifacts/

The build uses the commit that triggered the workflow; the source is never uploaded from the GitHub runner. A tag push builds the tag, so the export is versioned with the tag's name.

Inputs

Input	Default	Meaning
api-key	—	A personal token (with api-username) or an access token.
api-username	—	The Hub username a personal token belongs to.
api-url	https://api.pantahub.com	Use https://api.stage.pantahub.com for stage.
project	—	Groups the builds on the Builds page.
mode	git	git builds the repository; docker packages image.
git-url	this repository	Another HTTPS GitHub/GitLab repository.
git-ref	this commit (the tag on tag pushes)	Another branch, tag or commit.
context, dockerfile	., Dockerfile	Where pvpkg.json or the Dockerfile is.
app	repository name	The container's name in the export.
platform	linux/arm64	One architecture, or a comma-separated pipeline (linux/arm64, linux/amd64, linux/arm/v6).
timeout-minutes	60	Runner time per architecture: up to 240 for git builds.
wait-timeout-minutes	60	How long the job waits, queue included; past it the build is cancelled.
wait	true	false returns right after submitting.
secret	automatic	Git secret; a named one also reaches recipe fetches. Needs the builds grant.
signing-secret	developer key	pvs secret to sign with. Needs the builds grant.
image	—	Digest-pinned image, for mode: docker.
output-dir	./artifacts	Where the exports are downloaded.
idempotency-key	run, job and attempt	Re-running a job replays the same build; a new attempt starts a new one.

Outputs: execution-id, status, duration-seconds and artifacts-path — the export, or a directory with one subdirectory per architecture.

What the job shows

• The log, grouped by stage (fetch, build, package, sign, artifact), with each pipeline line prefixed by its architecture. Build output is printed with workflow commands stopped, so nothing in a build's log can set the job's outputs, environment or masks.
• The job summary: runner time, the Yocto Sstate summary cache hits, and for each export its sha256 and which key signed it.
• Cancelling the workflow cancels the build.

Secrets limited to refs

A branch push builds the commit (GITHUB_SHA), not the branch name, and a secret limited to refs never goes to a bare commit. To use one from branch builds, pass the branch:

          git-ref: ${{ github.ref_name }}

The Hub resolves it to the branch's head when the build is admitted.

Release builds with your key

on:
  push:
    tags: ["v*"]
# …
          signing-secret: release-key   # a pvs secret limited to refs tags/v*

Next: put the export on a device.