diff options
Diffstat (limited to '.github/workflows/build.yml')
| -rw-r--r-- | .github/workflows/build.yml | 164 | +20 −144 |
1 files changed, 20 insertions, 144 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7e1bd0e..305b0ad 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# Copyright (c) 2026 Nikolay Govorov # SPDX-License-Identifier: AGPL-3.0-or-later # NOTE: Don't extend it; keep the logic in the Taskfile. @@ -18,11 +18,6 @@ jobs: build: name: Build and publish Nightly runs-on: ubuntu-latest - concurrency: - group: >- - package-publish-mirum-${{ github.ref == 'refs/heads/main' && 'nightly' - || startsWith(github.ref, 'refs/tags/v') && 'stable' || github.ref }} - cancel-in-progress: false permissions: contents: write steps: @@ -30,39 +25,26 @@ jobs: with: fetch-depth: 0 - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 + - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: - version: 2026.7.5 - experimental: true - install: false + go-version-file: go.mod - - name: Install dependencies - run: mise bootstrap --locked --yes --update + - name: Install tools + run: | + echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list + sudo apt update && sudo apt install nfpm apt-utils rclone createrepo-c + sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin + curl -sSL "https://github.com/bufbuild/buf/releases/download/v1.67.0/buf-$(uname -s)-$(uname -m)" -o /usr/local/bin/buf && chmod +x /usr/local/bin/buf + pipx install reuse - name: Build and package run: task package GIT_REF=${{ github.ref }} GPG_KEY_ID=${{ vars.GPG_KEY_ID }} env: GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }} - PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }} - - - name: Lint - run: task lint - - name: Tests - run: task test - - - name: Upload container binaries - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: container-binaries - path: | - build/mirum-server-linux-amd64 - build/mirum-server-linux-arm64 - build/mirum-worker-linux-amd64 - build/mirum-worker-linux-arm64 - if-no-files-found: error + - name: CI checks + run: task ci - name: Publish if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') @@ -71,123 +53,17 @@ jobs: git config user.email "41898282+github-actions[bot]@users.noreply.github.com" . build/dist/build.env task publish:release CHANNEL=$CHANNEL VERSION=$VERSION - mise run publish -- \ - --service mirum \ - --channel "$CHANNEL" \ - --input build/dist \ - deb rpm apk + task publish:repos \ + CHANNEL=$CHANNEL \ + S3_BUCKET=${{ vars.S3_BUCKET }} \ + S3_PUBLIC_URL=${{ vars.S3_PUBLIC_URL }} \ + S3_PROVIDER="${{ vars.S3_PROVIDER || 'Other' }}" \ + S3_REGION=${{ vars.S3_REGION }} \ + S3_ENDPOINT=${{ vars.S3_ENDPOINT }} \ + GPG_KEY_ID=${{ vars.GPG_KEY_ID }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} - APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }} - PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }} - S3_BUCKET: ${{ vars.S3_BUCKET }} - S3_ENDPOINT: ${{ vars.S3_ENDPOINT }} - S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }} S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - - oci: - name: OCI artifacts - needs: [build] - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: container-binaries - path: .container - - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - - - name: Determine artifact version - id: artifact - shell: bash - run: | - base_version=$(cat VERSION) - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - version="$base_version-nightly.$(git log -1 --format=%ct)" - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - version="${GITHUB_REF_NAME#v}" - if [[ "$version" != "$base_version" ]]; then - echo "Tag version $version does not match VERSION $base_version" >&2 - exit 1 - fi - else - version="$base_version-pr.$GITHUB_RUN_NUMBER" - fi - echo "version=$version" >> "$GITHUB_OUTPUT" - - - name: Log in to GHCR - if: github.event_name != 'pull_request' - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Log Helm in to GHCR - if: github.event_name != 'pull_request' - env: - GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - printf '%s' "$GHCR_TOKEN" | mise x helm@4.1.1 -- \ - helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin - - - name: Build and publish OCI artifacts - shell: bash - run: | - version="${{ steps.artifact.outputs.version }}" - image_output=() - chart_output=() - - if [[ "${{ github.event_name }}" != pull_request ]]; then - image_output+=(--push) - chart_output+=(--push "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts") - fi - - for service in server worker; do - image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/mirum-$service" - tags=( - --tag "$image:sha-$GITHUB_SHA" - --tag "$image:$version" - ) - labels=( - --label "org.opencontainers.image.revision=$GITHUB_SHA" - --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" - --label "org.opencontainers.image.version=$version" - ) - - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - tags+=(--tag "$image:nightly") - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - tags+=(--tag "$image:latest") - fi - - mise run container -- \ - --context . \ - --file "cmd/mirum-$service/Dockerfile" \ - --platform linux/amd64,linux/arm64 \ - --cache-scope "mirum-$service" \ - "${tags[@]}" "${labels[@]}" "${image_output[@]}" - done - - mise run chart -- \ - --chart charts/mirum \ - --version "$version" \ - --app-version "$version" \ - "${chart_output[@]}" |