blue-build/BlueBuild

Build a custom OS image

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 6, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad # v1.12.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
recipe	The [recipe](https://blue-build.org/reference/recipe/) file to build the image from, relative to the `config/` or `recipes/` directory.	yes	recipe.yml
cosign_private_key	The Sigstore/cosign secret used to sign the image. Example: `${{ secrets.SIGNING_SECRET }}`	yes	—
push	Whether to push the image to a container registry.	no	true
registry_token	The token used to sign into the container registry. Example: `${{ github.token }}`	no	""
registry_username	The username used to sign into the container registry.	no	${{ github.repository_owner }}
pr_event_number	The event number used to tag images pushed from pull requests. Example: `${{ github.event.number }}`	yes	—
maximize_build_space	Whether to run the unwanted software remover to maximize build space in the GitHub builder. Disable this with 'false' if your image doesn't take up a lot of space and you'd rather have shorter build times.	no	true
use_unstable_cli	If true, this action pulls the `main` branch of blue-build/cli instead of the stable version the current action version is configured to use by default. This feature is useful for testing new features, but should not be used in production. Input must match the string 'true' for the unstable version to be used.	no	false
cli_version	Set this with a tag, sha, or branch name for the blue-build/cli repo to use that particular version of the CLI tool. This will override the `use_unstable_cli` input for the action.	no	—
registry	The container registry to push the built image to.	no	ghcr.io
registry_namespace	The namespace on the registry to push to. Example: `ublue-os`	no	${{ github.repository_owner }}
chunkah	Uses Chunkah to rechunk the image, allowing for smaller images and smaller updates. This will increase the build-time and take up more space during build-time.	no	false
build_chunked_oci	Uses `rpm-ostree compose build-chunked-oci` to rechunk the image, allowing for smaller images and smaller updates. This will increase the build-time and take up more space during build-time.	no	false
max_layers	Maximum number of layers to use when rechunking with `build-chunked-oci`.	no	128
rechunk	Rechunk the ostree-based result images with [github.com/hhd-dev/rechunk](https://github.com/hhd-dev/rechunk) for more efficient diffs and updates. (lower image size, better download speed, better update resuming) Will make your builds considerably slower. This is an experimental option, as it can cause issues with file permissions in some scenarios, so enable on your own risk. Warning: This option will be deprecated in the future.	no	false
rechunk_clear_plan	Disregard previous build's layer plan when rechunking.	no	false
use_cache	Make use of layer cache by pushing the layers to the registry. Input must match the string 'true' for the step to be enabled.	no	false
retry_push_count	The number of times to retry pushing the image.	no	0
squash	Uses buildah to squash the build's layers into a single layer. Use of this option disables cache. Conflicts with adding `--build-driver` or `--squash` to the build opts.	no	false
build_opts	Provide options to the call to the BlueBuild CLI build command. If you use this with the squash input set to true and provide either of the `--build-driver` or `--squash` flags an error will occur and the action will not run.	no	""
working_directory	Changes working directory for whole build. For example, setting this to `./abc/` would cause for the recipe to be read from `./abc/recipes/recipe.yml`.	no	./
skip_checkout	Set to true to skip doing the actions/checkout step. This allows you to checkout manually before calling bluebuild/github-action and to modify files (such as supplying build information to other scripts) before building.	no	false
verify_install	Set to true verify the cosign signature for the Blue-Build cli	no	false

Outputs

no outputs