CI: build without flatpak-builder to avoid bwrap/privileged requirement

flatpak-builder sandboxes each build command in bubblewrap, which needs user namespaces / a privileged job container that Gitea act_runner does not grant by default (bwrap: Creating new namespace failed). Replace it with scripts/make-flatpak.sh, which uses flatpak build-init/build-finish/build-export plus plain-shell extraction and the get_python.sh bake. None of these use bwrap, so an unprivileged container works. The flatpak-builder manifest stays as a documented alternative. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 10:04:32 +02:00
parent ff03166642
commit 5ae57f3bbf
4 changed files with 90 additions and 27 deletions
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Build the O3DE Flatpak WITHOUT flatpak-builder.
+#
+# flatpak-builder runs every build command inside a bubblewrap sandbox, which
+# needs user namespaces / a privileged container - awkward in CI. We don't need
+# it: our "build" is just unpacking a .deb and running get_python.sh, both plain
+# shell. flatpak build-init/build-finish/build-export only touch files and the
+# OSTree repo (no bwrap), so this works in an unprivileged container.
+#
+# Expects ./o3de.deb to already be present. Produces ./repo (an OSTree repo).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+APP_ID=org.o3de.O3DE
+RUNTIME=org.freedesktop.Sdk
+RUNTIME_VER=24.08
+BRANCH=stable
+
+rm -rf build-dir data repo
+
+echo ">> build-init"
+flatpak build-init build-dir "$APP_ID" "$RUNTIME" "$RUNTIME" "$RUNTIME_VER"
+DEST=build-dir/files
+
+echo ">> extracting .deb payload"
+mkdir -p data
+ar x o3de.deb
+tar -C data -xf data.tar.*
+mkdir -p "$DEST/opt"
+cp -a data/opt/. "$DEST/opt/"
+
+echo ">> baking O3DE's Python runtime into the image"
+# O3DE fetches Python into its install tree on first use, but that tree is
+# read-only at runtime in a Flatpak, so populate it now while it is writable.
+ENGINE_DIR=$(find "$DEST/opt/O3DE" -mindepth 1 -maxdepth 1 -type d | head -n1)
+echo "   engine dir: $ENGINE_DIR"
+if [ -x "$ENGINE_DIR/python/get_python.sh" ]; then
+  ( cd "$ENGINE_DIR" && HOME="$PWD" ./python/get_python.sh )
+else
+  echo "   WARNING: get_python.sh not found; Python may fail at runtime" >&2
+fi
+
+echo ">> installing launcher + metadata"
+install -Dm755 o3de-wrapper.sh "$DEST/bin/o3de-wrapper.sh"
+install -Dm644 org.o3de.O3DE.desktop "$DEST/share/applications/$APP_ID.desktop"
+install -Dm644 org.o3de.O3DE.metainfo.xml "$DEST/share/metainfo/$APP_ID.metainfo.xml"
+
+echo ">> build-finish (command + sandbox permissions)"
+flatpak build-finish build-dir \
+  --command=o3de-wrapper.sh \
+  --share=ipc \
+  --share=network \
+  --socket=x11 \
+  --socket=fallback-x11 \
+  --socket=wayland \
+  --socket=pulseaudio \
+  --device=dri \
+  --device=all \
+  --filesystem=home \
+  --talk-name=org.freedesktop.Notifications \
+  --env=QT_QPA_PLATFORM=xcb
+
+echo ">> export to OSTree repo"
+flatpak build-export repo build-dir "$BRANCH"
+flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1
+
+echo ">> done: ./repo"