128 lines
4.4 KiB
YAML
128 lines
4.4 KiB
YAML
# Fenris release workflow — dormant (no runner registered yet).
|
|
# When a runner is provisioned, this replicates `make release` automatically.
|
|
# Spec: §5, issue #52
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
|
|
# Built-in Gitea token needs write access for release assets and package registry.
|
|
permissions:
|
|
contents: read
|
|
releases: write
|
|
packages: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: [self-hosted]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install build dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y rpm python3-venv
|
|
python3 -m venv /tmp/fenris-ci
|
|
/tmp/fenris-ci/bin/pip install --quiet build
|
|
echo "/tmp/fenris-ci/bin" >> "$GITHUB_PATH"
|
|
NFPM_VERSION=2.47.0
|
|
curl --fail --silent --show-error --location \
|
|
"https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz" \
|
|
-o /tmp/nfpm.tar.gz
|
|
sudo tar -xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm
|
|
nfpm --version
|
|
|
|
- name: Build packages
|
|
run: make package
|
|
|
|
- name: Sign RPM payload
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
run: |
|
|
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
make sign-rpm
|
|
|
|
- name: Generate and clearsign SHA256SUMS
|
|
run: make clearsign
|
|
|
|
- name: Determine version
|
|
id: version
|
|
run: echo "version=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Upload deb packages to registry
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
VERSION=${{ steps.version.outputs.version }}
|
|
DEB="fenris_${VERSION}_amd64.deb"
|
|
for CODENAME in bookworm jammy noble; do
|
|
curl --fail -X PUT \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
-T "dist/${DEB}" \
|
|
"https://git.bongbetic.com/api/packages/xavierk/debian/pool/${CODENAME}/main/upload"
|
|
done
|
|
|
|
- name: Upload RPM to registry
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
VERSION=${{ steps.version.outputs.version }}
|
|
RPM="fenris-${VERSION}-1.x86_64.rpm"
|
|
curl --fail -X PUT \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
-T "dist/${RPM}" \
|
|
"https://git.bongbetic.com/api/packages/xavierk/rpm/fenris/upload"
|
|
|
|
- name: Create Gitea release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
VERSION=${{ steps.version.outputs.version }}
|
|
# Check if release already exists (idempotent re-runs)
|
|
EXISTING=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
"https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}")
|
|
if [ "$EXISTING" = "200" ]; then
|
|
echo "Release v${VERSION} already exists, skipping creation"
|
|
else
|
|
curl --fail -X POST \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"v${VERSION}\",\"name\":\"v${VERSION}\"}" \
|
|
"https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases"
|
|
fi
|
|
|
|
- name: Attach artifacts to release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
VERSION=${{ steps.version.outputs.version }}
|
|
# Get release ID for this tag
|
|
RELEASE_ID=$(curl -s \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
"https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}" \
|
|
| python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
|
|
# Attach deb, rpm, and clearsigned checksums
|
|
for FILE in "dist/fenris_${VERSION}_amd64.deb" \
|
|
"dist/fenris-${VERSION}-1.x86_64.rpm" \
|
|
"dist/SHA256SUMS.asc"; do
|
|
curl --fail -X POST \
|
|
-u "xavierk:${GITEA_TOKEN}" \
|
|
-F "attachment=@${FILE}" \
|
|
"https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets"
|
|
done
|
|
|
|
- name: Upload build artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: fenris-packages
|
|
path: dist/
|