diff options
Diffstat
| -rw-r--r-- | .github/workflows/build.yml | 133 | +39 −94 |
| -rw-r--r-- | README.md | 10 | +5 −5 |
| -rw-r--r-- | mise.lock | 60 | +0 −60 |
| -rw-r--r-- | mise.toml | 5 | +1 −4 |
| -rw-r--r-- | nfpm.yaml | 2 | +2 −0 |
5 files changed, 47 insertions, 163 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 11a2409..f6c2256 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,6 @@ on: env: CARGO_TERM_COLOR: always - RELEASE_TAG: nightly jobs: lint: @@ -57,34 +56,33 @@ jobs: run: mise bootstrap --locked --yes --update - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0 - with: - passphrase: ${{ secrets.GPG_PASSPHRASE }} - gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} - - run: cargo clippy --all-targets --all-features --release -- -D warnings - run: cargo build --release - run: cargo test --all-features --release --locked - name: Build packages + if: github.event_name == 'push' run: | - export SIGNING_PRIVATE_KEY="/tmp/private.asc" - printf '%s' "$GPG_PRIVATE_KEY" > $SIGNING_PRIVATE_KEY - chmod 600 $SIGNING_PRIVATE_KEY - - PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "recluse") | .version') - export VERSION="${PKG_VERSION}~nightly.$(git log -1 --format=%ct)" - export ARCH=${{ matrix.arch }} - - mkdir -p dist/ - for pkg in deb rpm; do - nfpm package --packager $pkg --target dist/ - done + base=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "recluse") | .version') + case "$GITHUB_REF" in + refs/tags/v*) + version=${GITHUB_REF#refs/tags/v} + [ "$version" = "$base" ] + ;; + *) + version="$base-nightly.${{ github.run_number }}.g$(git rev-parse --short=12 HEAD)" + ;; + esac + mise run package -- \ + --version "$version" \ + --arch "${{ matrix.arch }}" \ + --output dist \ + deb rpm + printf 'VERSION=%s\n' "$version" > dist/build.env env: GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - name: Generate coverage (lcov) run: cargo llvm-cov --all-features --workspace --lcov --output-path coverage.lcov @@ -96,6 +94,7 @@ jobs: path: coverage.lcov - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + if: github.event_name == 'push' with: name: packages-${{ matrix.arch }} path: dist/* @@ -109,7 +108,7 @@ jobs: name: Smoke tests runs-on: ubuntu-24.04 needs: [build] - if: github.ref == 'refs/heads/main' + if: github.event_name == 'push' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 @@ -132,10 +131,10 @@ jobs: ./tests/smoke/run-local.sh publish: - name: Publish nightly build + name: Publish packages runs-on: ubuntu-latest needs: [build, smoke] - if: github.ref == 'refs/heads/main' + if: github.event_name == 'push' permissions: contents: write steps: @@ -155,79 +154,25 @@ jobs: path: dist merge-multiple: true - # Configure GPG keys - - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0 - with: - passphrase: ${{ secrets.GPG_PASSPHRASE }} - gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} - - name: Export GPG public key - run: printf '%s' "$GPG_PUBLIC_KEY" > dist/public.gpg - env: - GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }} - - # Update Github Release - - name: Update 'nightly' tag + - name: Publish run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - git tag -f ${{ env.RELEASE_TAG }} - git push origin --force tag ${{ env.RELEASE_TAG }} - - name: Delete old release assets - run: | - for asset in $(gh release view ${{ env.RELEASE_TAG }} --json assets --jq '.assets[].name' 2>/dev/null || true); do - gh release delete-asset ${{ env.RELEASE_TAG }} "$asset" --yes - done + . dist/build.env + mise run publish -- \ + --name recluse \ + --repository "${{ github.server_url }}/${{ github.repository }}" \ + --version "$VERSION" \ + --input dist \ + --s3-bucket "${{ vars.S3_BUCKET }}" \ + --s3-public-url "https://${{ vars.S3_BUCKET }}.${{ vars.S3_ENDPOINT }}" \ + --s3-provider Other \ + --s3-endpoint "${{ vars.S3_ENDPOINT }}" \ + --github-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 - with: - name: ${{ env.RELEASE_TAG }} - tag_name: ${{ env.RELEASE_TAG }} - files: dist/* - body: | - Last successful build from `main` branch. - - **Release checks**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Update APT/RPM repos on s3 - - name: Create APT repository - run: | - aptly repo create -distribution="${{ env.RELEASE_TAG }}" -component=main recluse - aptly repo add recluse dist/*.deb - aptly publish repo -architectures=amd64,arm64 -gpg-key="${{vars.GPG_KEY_ID}}" recluse - - name: Create RPM repository - run: | - mkdir -p rpm-repo - cp dist/*.rpm rpm-repo/ - - cat > rpm-repo/recluse-nightly.repo << EOF - [recluse-nightly] - name=Recluse Nightly - gpgkey=${{github.server_url}}/${{github.repository}}/releases/download/${{env.RELEASE_TAG}}/public.gpg - baseurl=https://${{vars.S3_BUCKET}}.${{vars.S3_ENDPOINT}}/rpm/ - enabled=1 - gpgcheck=1 - EOF - - createrepo_c rpm-repo/ - gpg --default-key="${{vars.GPG_KEY_ID}}" --detach-sign --armor rpm-repo/repodata/repomd.xml - - name: Upload RPM to S3 - run: | - mkdir -p ~/.config/rclone - cat > ~/.config/rclone/rclone.conf << EOF - [hetzner] - type = s3 - provider = Other - acl = public-read - endpoint = ${{vars.S3_ENDPOINT}} - access_key_id = ${{secrets.S3_ACCESS_KEY_ID}} - secret_access_key = ${{secrets.S3_SECRET_ACCESS_KEY}} - EOF - - rclone sync rpm-repo/ "hetzner:${{vars.S3_BUCKET}}/rpm/" --progress - rclone sync ~/.aptly/public/ "hetzner:${{vars.S3_BUCKET}}/apt/" --progress + GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} + S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} diff --git a/README.md b/README.md index 2fbc62c..41dbb9b 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ is **not** intended for production use. ```bash sudo apt install curl gnupg -curl -fsSL https://github.com/dimidiumlabs/recluse/releases/download/nightly/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/recluse.gpg +curl -fsSL https://dimidiumlabs.fsn1.your-objectstorage.com/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/recluse.gpg echo "deb [signed-by=/usr/share/keyrings/recluse.gpg] https://dimidiumlabs.fsn1.your-objectstorage.com/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/recluse.list sudo apt update && sudo apt install recluse @@ -24,10 +24,10 @@ sudo systemctl enable --now recluse ```bash # DNF5 (Fedora 41+, RHEL 10+) -sudo dnf config-manager addrepo --from-repofile=https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/recluse-nightly.repo +sudo dnf config-manager addrepo --from-repofile=https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/recluse-nightly.repo # DNF4 (Fedora 40 and older, RHEL 8/9) -sudo curl -o /etc/yum.repos.d/recluse-nightly.repo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/recluse-nightly.repo +sudo curl -o /etc/yum.repos.d/recluse-nightly.repo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/recluse-nightly.repo sudo dnf install recluse sudo systemctl enable --now recluse @@ -36,8 +36,8 @@ sudo systemctl enable --now recluse **openSUSE:** ```bash -sudo rpm --import https://github.com/dimidiumlabs/recluse/releases/download/nightly/public.gpg -sudo zypper addrepo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/ recluse-nightly +sudo rpm --import https://dimidiumlabs.fsn1.your-objectstorage.com/public.gpg +sudo zypper addrepo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/ recluse-nightly sudo zypper refresh sudo zypper install recluse diff --git a/mise.lock b/mise.lock index 7f8fde7..025fcd6 100644 --- a/mise.lock +++ b/mise.lock @@ -1,19 +1,5 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html -[[tools."aqua:aptly-dev/aptly"]] -version = "1.6.3" -backend = "aqua:aptly-dev/aptly" - -[tools."aqua:aptly-dev/aptly"."platforms.linux-arm64"] -checksum = "sha256:dd0988ebe8bfd547482e55de83f178c14e95d5d829d956ce683e0ca045cdb86c" -url = "https://github.com/aptly-dev/aptly/releases/download/v1.6.3/aptly_1.6.3_linux_arm64.zip" -url_api = "https://api.github.com/repos/aptly-dev/aptly/releases/assets/457534360" - -[tools."aqua:aptly-dev/aptly"."platforms.linux-x64"] -checksum = "sha256:535ed24eb706bc25a316b59d709a7e74e10165f2ffab8552097ba7e4816a3e7e" -url = "https://github.com/aptly-dev/aptly/releases/download/v1.6.3/aptly_1.6.3_linux_amd64.zip" -url_api = "https://api.github.com/repos/aptly-dev/aptly/releases/assets/457534365" - [[tools."aqua:taiki-e/cargo-llvm-cov"]] version = "0.8.7" backend = "aqua:taiki-e/cargo-llvm-cov" @@ -28,22 +14,6 @@ checksum = "sha256:967b5cc996c29d8baa52bbb4595ef1f53af35255af8e2036ddbc6468d7b52 url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-unknown-linux-musl.tar.gz" url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861752" -[[tools.gh]] -version = "2.96.0" -backend = "aqua:cli/cli" - -[tools.gh."platforms.linux-arm64"] -checksum = "sha256:06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909" -url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728549" -provenance = "github-attestations" - -[tools.gh."platforms.linux-x64"] -checksum = "sha256:83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60" -url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728543" -provenance = "github-attestations" - [[tools.jq]] version = "1.8.2" backend = "aqua:jqlang/jq" @@ -60,36 +30,6 @@ url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-amd64" url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012752" provenance = "github-attestations" -[[tools.nfpm]] -version = "2.47.0" -backend = "aqua:goreleaser/nfpm" - -[tools.nfpm."platforms.linux-arm64"] -checksum = "sha256:1c0f5f2999b9a974bfb04fdb0cc3306096de530ac5dbb25d739cc5f5219c919c" -url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316744" -provenance = "cosign" - -[tools.nfpm."platforms.linux-x64"] -checksum = "sha256:0660ca602b2d2d2ae4781a06c692b3eeb9d437ffea05b831d76e41f4a3188783" -url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_x86_64.tar.gz" -url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316748" -provenance = "cosign" - -[[tools.rclone]] -version = "1.74.4" -backend = "aqua:rclone/rclone" - -[tools.rclone."platforms.linux-arm64"] -checksum = "sha256:97685285c9ad6a0cf17d5844115d2a67245af6444db672187074bd9c358de419" -url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-arm64.zip" -url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470550100" - -[tools.rclone."platforms.linux-x64"] -checksum = "sha256:fe435e0c36228e7c2f116a8701f01127bb1f694005fc11d1f27186c8bca4115d" -url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-amd64.zip" -url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470549540" - [[tools.rust]] version = "1.97.1" backend = "core:rust" diff --git a/mise.toml b/mise.toml index 214e32f..d1d8759 100644 --- a/mise.toml +++ b/mise.toml @@ -7,12 +7,8 @@ min_version = "2026.7.5" experimental = true [tools] -"aqua:aptly-dev/aptly" = "1.6.3" "aqua:taiki-e/cargo-llvm-cov" = "0.8.7" -gh = "2.96.0" jq = "1.8.2" -nfpm = "2.47.0" -rclone = "1.74.4" rust = { version = "1.97.1", profile = "minimal", components = [ "clippy", "llvm-tools-preview", @@ -21,6 +17,7 @@ rust = { version = "1.97.1", profile = "minimal", components = [ [bootstrap.packages] # APT +"apt:apt-utils" = "latest" "apt:build-essential" = "latest" "apt:createrepo-c" = "latest" "apt:gnupg" = "latest" diff --git a/nfpm.yaml b/nfpm.yaml index c53abb5..0a9ab25 100644 --- a/nfpm.yaml +++ b/nfpm.yaml @@ -7,6 +7,8 @@ name: recluse arch: ${ARCH} version: ${VERSION} +release: ${RELEASE} +version_schema: none license: AGPL-3.0-or-later platform: linux maintainer: Nikolay Govorov <me@govorov.online> |