osbuild: component-composed blueprints, Rocky 10 NVIDIA variants, installer kickstart and first-login splash by b08x · Pull Request #3 · b08x/ansible-workstation

b08x · 2026-10-03T20:36:09Z

Summary

development is 24 commits ahead of main; this PR merges all of it. The newest work (last 5 feature/docs commits):

Component-composed blueprints (8b17e73): new osbuild_blueprint_components. Component files (packages, services, kernel args, repo URLs, optional TOML fragment) merge with a static frame into one blueprint, and each component's repo_urls feed --extra-repo. Takes precedence over the static and Jinja template paths. Rocky 10 ships 11 components split from the static NVIDIA workstation blueprint.
Target-keyed package taxonomy (8b17e73): osbuild_target_distribution (from osbuild_distro) selects vars/packages/<Name>.yml instead of using the build host's distribution.
Playbooks (d91342a): osbuild-rocky-iso-nvidia-generate.yml (pins generate-only), osbuild-rocky-iso-nvidia-components.yml; the five cross-distro Rocky playbooks now run on the builder group (gir and tinybot). The three tinybot-only playbooks are unchanged because they assert an EL host.
Docs (ea1af84, d54f74f, dca993e): README section on components; rbenv and first-login splash notes; zread wiki snapshots with pages 9, 13, 14 and 25 hand-edited.

Earlier commits on the branch (installer kickstart and disk layout, first-login yadm splash, Flathub remote, Rocky 9/10 support, CUDA container playbook, skill, remediation formatting) are not described here; see git log origin/main..development.

Verification

image-builder manifest depsolves the same 1715 RPMs for the static NVIDIA blueprint and the components blueprint; parsed TOML customizations match section by section (232 packages).
Dropping nvidia from the component list drops the CUDA and Container Toolkit repos from --extra-repo.
ansible-lint on playbooks and roles/osbuild: 0 failures, 0 warnings. shellcheck clean on the generated build script.
validate_kickstart_injection.yml and validate_build_modes.yml exit 0; kickstart.bats 18/18.

Not verified

No ISO built from the components blueprint and no VM install test.
Only Rocky 10 has components; AlmaLinux needs its own set.
The component split is by name rules; equivalence is by RPM set, not a per-package review.
Existing issue, not fixed: vars/packages/{Rocky,AlmaLinux}.yml contain names that do not resolve on Rocky 10.2 (e.g. NetworkManager-config-connectivity-fedora, @development-tools), so the Jinja template path is not usable for EL 10 yet.
roles/osbuild/.zread/ is generated output (about 800 KB); say if it should be ignored instead of tracked.

🤖 Generated with Claude Code

Reformat staged remediation action/callback_utils files with black (line-length=100) and isort import ordering; adjust unit tests to match. 💘 Generated with Crush Assisted-by: Z.ai: GLM 5.3 Flash via Crush <crush@charm.land>

Add Rocky Linux 9 and 10 as first-class supported distributions across the Ansible monorepo, mirroring existing AlmaLinux support with cited upstream configurations. osbuild role: - Add Rocky 9 and 10 to build-host and target asserts, defaults, and meta - Add roles/osbuild/vars/Rocky.yml with dl.rockylinux.org mirrors and cited keys - Add source TOML trees for Rocky 9 and 10 (baseos, appstream, crb, epel, rpmfusion, cuda, nvidia-container-toolkit, docker-ce, vscode, chrome) - Add workstation blueprints: rocky-9-8-workstation (+ NVIDIA) and rocky-10-2-workstation (+ NVIDIA) pinned to live image-builder distros - Replace stale almalinux-10-3-workstation*.toml blueprints with almalinux-10-2-workstation*.toml per live image-builder list confirmation on tinybot (binary defines almalinux-10.2; 10.3 does not exist) - Fix image installer type to image-installer for EL distributions and retain minimal-installer for Fedora - Add repo-config JSON templates for rocky-9 and rocky-10 - Import blueprint preparation in generate_only mode and support standard library tomllib with tomli fallback for TOML syntax checks - Wire osbuild_sources_dir to major version base role: - Refactor tasks/distro/AlmaLinux.yml into shared tasks/distro/EL.yml - Add per-major vars/Rocky-9.yml and vars/Rocky-10.yml - Parameterize epel.repo mirror path with $releasever - Add Rocky 9 and 10 containers to Molecule default scenario parity sweep: - Add vars/Rocky.yml for containerd, desktop, libvirt, nas, and user roles - Update cpupower service template and Yaru theme build conditionals for Rocky - Update meta/main.yml platform declarations across roles - Extend scripts/csv_to_packages.py to model Rocky and generate vars/packages/Rocky.yml

…OS and container images

Replace the 10 duplicated, distro-specific custom-first-boot scripts with one plain bash script in files/firstboot/, injected into every prepared blueprint (static or templated) by tasks/blueprint.yml via blockinfile. At first graphical login the launcher opens a terminal that shows a splash, prompts for the dotfiles URL (default b08x/dots), clones it with yadm as the logged-in user, and runs yadm bootstrap. A per-user marker in ~/.local/state/syncopated/ stops the splash after success or "Never ask again". The script reads NAME/VERSION_ID from /etc/os-release at runtime and no longer sets DNF repo priorities or installs flatpaks. - osbuild_firstboot_enabled (default true) toggles injection - bats suite with stubbed git/yadm/curl/gum/sudo/systemctl (36 tests) - validate_firstboot_injection.yml checks all blueprints, run twice - old snippets/custom-first-boot*.j2 removed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Prototype produced with the Syncopated Appliance Builder skill. Builds the static rocky-10-2-workstation-nvidia blueprint as an image-installer ISO on gir (Fedora 43 host), passing every EL 10 extra repo explicitly and suppressing the host-derived Fedora source list. Verified 2026-10-01: build finished failed=0; the resulting ISO installed in a libvirt VM and the first-login yadm splash completed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Each ISO build playbook now names its output <blueprint>-<short-hash>.iso, using `git describe --always --abbrev=7 --dirty`, so an image can be traced to the commit that built it. A "-dirty" suffix marks builds from a working tree with uncommitted changes. The hash is resolved once in pre_tasks via set_fact so every role task sees the same filename. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…figurable disk layout - Generate-only is the role default: the play writes <blueprint>.toml and build-<blueprint>.sh (image-builder command, copy, podman load/tag for container types); -e osbuild_only_generate=false builds in the play. - Every prepared blueprint embeds files/kickstart/syncopated.ks as [customizations.installer.kickstart] plus a wheel NOPASSWD sudoers drop-in; user/group/unattended/sudo-nopasswd removed from the static blueprints and rejected by an assert. - osbuild_kickstart_partitioning: interactive embeds syncopated-interactive.ks (no storage commands; Anaconda Installation Destination). - %pre disk layout is configurable (osbuild_kickstart_*): / 10 % (min 16 GiB), 10 % of vg00 left unassigned, /usr 80 % of the rest up to 256 GiB, /var the remainder up to 128 GiB, /home only when >= 100 GiB is left above the caps. - Remove 14 defaults nothing reads; declare osbuild_extra_repo_urls and osbuild_container_tag. - README: role variables regrouped by purpose, layout table, and a runbook for a full volume. - Tests: bats for %pre (18, incl. defaults drift check), kickstart injection playbook with checker. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ning ISO - osbuild-rocky-cuda-container.yml + static blueprint: image-builder "container" type with cuda-toolkit (no driver; host supplies it via CDI), output .tar loaded into podman as osbuild_container_tag. - osbuild-rocky-iso-nvidia-interactive.yml: the NVIDIA workstation ISO with osbuild_kickstart_partitioning: interactive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Clarify questions, playbooks to start from, hard rules from verified failures, role switches (incl. disk layout variables), verification steps, and the expected image-builder --verbose scriptlet noise. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- files/flatpak/flathub.flatpakrepo is appended to each prepared blueprint as /etc/flatpak/remotes.d/flathub.flatpakrepo; flatpak imports it as the system remote "flathub", with no network needed at install. Toggle with osbuild_flathub_enabled (default true; the CUDA container sets false). - No [[packages]] in the fragment: static blueprints define packages as an inline array, which TOML cannot extend. flatpak comes in via gnome-software. - Fix: the TOML syntax check's rescue treated any failure as a missing parser, so invalid blueprints passed. It now skips only when no parser is installed and fails on parse errors. - check_kickstart.py requires exactly one Flathub file per blueprint, identical to the source. - README "Flathub Remote" section; skill rules updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add both packages to system_packages.Development.languages for Fedora, Rocky and AlmaLinux so every build with the default development component ships rbenv with the ruby-build plugin. Fedora resolves them from its base repo; Rocky and AlmaLinux resolve them from EPEL 9/10, which their builds already include. Prettier also normalizes the empty audio list in Rocky and AlmaLinux. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Replace the figlet logo and typewriter intro with a full-screen splash: the brand ASCII art centered and revealed row by row, colored violet (mark) and ember (wordmark) with dim tones for light glyphs, held on a pulsing "press enter to begin" prompt. Uses 24-bit color when COLORTERM reports it, else 256-color indices; a terminal narrower than the art shows the mark only. Theme gum prompts, borders and status messages with the same palette; GUM_* values already set by the user take precedence. Update the non-terminal bats case to match the new art and assert the prompt is not shown without a TTY. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Replace the npm virtual provide with nodejs-npm in the Fedora development language list and the legacy development_packages list. Fedora resolved npm to nodejs-npm already; the blueprint now names the real package. Rocky and AlmaLinux keep npm: their package files serve both EL 9 and EL 10, and EL 9 AppStream ships the package as npm with no nodejs-npm, while EL 10 resolves npm to nodejs-npm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…eady installed - zsh.yml: stat the user and system oh-my-zsh; install as the user with KEEP_ZSHRC=yes CHSH=no RUNZSH=no via a tempfile; skip zoxide when it is on PATH - cargo.yml: skip rustup when ~/.cargo/bin/rustup exists; install only crates missing from `cargo install --list` - defaults: drop exa from user_cargo_packages Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Add osbuild_blueprint_components: component files (packages, services, kernel args, repo URLs, optional TOML fragment) merged with a static frame into one blueprint. Each component's repo_urls feed --extra-repo, so dropping a component drops its repos. Takes precedence over the static and Jinja template paths. Seed Rocky 10 components by splitting the static NVIDIA workstation blueprint; image-builder depsolves the same 1715 RPMs for both. Load the package taxonomy by build target (osbuild_target_distribution, from osbuild_distro) instead of the build host's distribution. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…ariants Add osbuild-rocky-iso-nvidia-generate.yml (pins osbuild_only_generate) and osbuild-rocky-iso-nvidia-components.yml (blueprint composed from components). Run the Rocky NVIDIA and CUDA container playbooks on the builder group (gir and tinybot) instead of gir only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Describe osbuild_blueprint_components, the component file format and the frame, osbuild_target_distribution, and how component repo_urls feed --extra-repo. Blueprint section now lists three sources. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Generated wiki versions; pages 9, 13, 14 and 25 in the current snapshot are hand-edited to cover component-composed blueprints. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-10-03T20:36:15Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

ecc-tools · 2026-10-03T20:36:15Z

ECC Tools / Security Evidence

Commit: dca993ebd8af51338c0fcf78bb7ad73067097c97

Security scanner evidence required (action_required)

Detected 1 security-sensitive predictive risk signal(s) without scanner evidence.

Mode: enforce

Findings:

Security-sensitive changes may ship without scanner evidence: The PR touches billing, secrets, auth, webhooks, agent, or CI-sensitive surfaces without adding obvious security scanner, code scanning, or security-focused validation evidence. (182 security-sensitive paths changed; 0 security scanner or security-focused validation artifacts changed)

Touched security-sensitive paths:

roles/base/files/etc/yum.repos.d/epel.repo
roles/base/meta/main.yml

Expected evidence:

Security scanner, code scanning, secret scanning, dependency/security review, or focused security regression output.
SARIF/code-scanning upload or equivalent pass/fail gate for the changed surface.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-10-03T20:36:16Z

ECC Tools / PR Risk Taxonomy

Commit: dca993ebd8af51338c0fcf78bb7ad73067097c97

PR taxonomy review recommended (neutral)

Detected 5 PR taxonomy bucket(s): Security Evidence, Harness Drift, CI/CD Recommendation, Reference Set Validation, Agent Config Review.

Scanned 218 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

Auth or permission changes may ship without security regression coverage
Security-sensitive changes may ship without scanner evidence
0 security-sensitive path(s) changed

Paths:

.claude/skills/syncopated/SKILL.md
.gitignore
Gemfile.lock

Harness Drift

Harness-facing changes can drift across Claude Code, Codex, OpenCode, and shared adapter surfaces.

Signals:

Harness config changes may ship without compatibility evidence
1 harness-facing path(s) changed

Paths:

.claude/skills/syncopated/SKILL.md

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

Data-layer changes may ship without integration coverage
User-facing UI changes may ship without browser coverage
0 CI or workflow path(s) changed

Paths:

playbooks/osbuild-almalinux-iso-nvidia.yml
playbooks/osbuild-almalinux-iso.yml
playbooks/osbuild-rocky-cuda-container.yml
playbooks/osbuild-rocky-iso-nvidia-components.yml
playbooks/osbuild-rocky-iso-nvidia-generate.yml
playbooks/osbuild-rocky-iso-nvidia-interactive.yml
playbooks/osbuild-rocky-iso-nvidia.yml
playbooks/osbuild-rocky-iso.yml

Reference Set Validation

AI, analyzer, skill, agent, command, and harness guidance changes should be compared against a maintained eval, golden trace, benchmark, or reference set.

Signals:

AI or harness analysis changes may ship without reference-set validation
1 reference-sensitive path(s) changed

Paths:

.claude/skills/syncopated/SKILL.md

Agent Config Review

Agent, command, skill, MCP, and local instruction changes should be reviewed as executable agent configuration.

Signals:

1 agent-config path(s) changed

Paths:

.claude/skills/syncopated/SKILL.md

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-10-03T20:36:17Z

ECC Tools / Reference Set Readiness

Commit: dca993ebd8af51338c0fcf78bb7ad73067097c97

Reference set readiness gaps detected (neutral)

Reference evidence present for 1/7 areas (14%) across 218 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Present	`.claude/skills/syncopated/SKILL.md`
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-10-03T20:36:19Z

ECC Tools / Hosted Promotion Readiness

Commit: dca993ebd8af51338c0fcf78bb7ad73067097c97

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 218 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

b08x and others added 24 commits October 1, 2026 01:02

💚 ci(base): force IPv4 resolution in Molecule test images

3d58197

📝 docs: rewrite README around image builds and current inventory

4970aa1

✨ feat: add Rocky Linux 10.2 workstation ISO build playbook

0ef9eed

🔧 chore: track Gemfile.lock for reproducible tool installs

95fd805

✨ feat: add Syncopated Appliance Builder skill for generating custom …

390d397

…OS and container images

🔧 chore(osbuild): start kitty fullscreen in the first-login launcher

19d62c7

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

📝 docs(osbuild): document rbenv packages and the first-login splash

d54f74f

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

📝 docs(osbuild): add zread wiki snapshots with component docs

dca993e

Generated wiki versions; pages 9, 13, 14 and 25 in the current snapshot are hand-edited to cover component-composed blueprints. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

b08x merged commit ffa499a into main Oct 3, 2026
2 checks passed

Navigation Menu

Repository navigation

osbuild: component-composed blueprints, Rocky 10 NVIDIA variants, installer kickstart and first-login splash - #3

osbuild: component-composed blueprints, Rocky 10 NVIDIA variants, installer kickstart and first-login splash#3
b08x merged 24 commits into
mainfrom
development

b08x commented Oct 3, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 3, 2026

Uh oh!

ecc-tools Bot commented Oct 3, 2026

Uh oh!

ecc-tools Bot commented Oct 3, 2026

Uh oh!

ecc-tools Bot commented Oct 3, 2026

Uh oh!

ecc-tools Bot commented Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

b08x commented Oct 3, 2026

Summary

Verification

Not verified

Uh oh!

chatgpt-codex-connector Bot commented Oct 3, 2026

Uh oh!

ecc-tools Bot commented Oct 3, 2026

ECC Tools / Security Evidence

Uh oh!

ecc-tools Bot commented Oct 3, 2026

ECC Tools / PR Risk Taxonomy

Security Evidence

Harness Drift

CI/CD Recommendation

Reference Set Validation

Agent Config Review

Uh oh!

ecc-tools Bot commented Oct 3, 2026

ECC Tools / Reference Set Readiness

Uh oh!

ecc-tools Bot commented Oct 3, 2026

ECC Tools / Hosted Promotion Readiness

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant