diff options
Diffstat (limited to '.github/workflows/build.yml')
| -rw-r--r-- | .github/workflows/build.yml | 312 | +0 −312 |
1 files changed, 0 insertions, 312 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,312 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Nikolay Govorov -# SPDX-License-Identifier: AGPL-3.0-or-later - -name: Build - -on: - push: - branches: [main] - tags: ["v*"] - pull_request: - branches: [main] - -permissions: - contents: read - -concurrency: - group: tesor-build-${{ github.ref }} - cancel-in-progress: true - -env: - CARGO_TERM_COLOR: always - RELEASE_TAG: nightly - -jobs: - lint: - name: Static checks - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update - - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - - - name: formatting - run: cargo fmt --all --check - - - name: shellcheck - run: shellcheck pkg/scripts/*.sh tests/smoke/*.sh - - - name: clippy - run: cargo clippy --workspace --all-targets --all-features --release --locked -- -D warnings - - build: - name: Build (${{ matrix.arch }}) - runs-on: ${{ matrix.runner }} - needs: [lint] - strategy: - fail-fast: false - matrix: - include: - - runner: ubuntu-24.04 - arch: amd64 - - runner: ubuntu-24.04-arm - arch: arm64 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update - - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - - - run: cargo clippy --workspace --locked --all-targets --all-features --release -- -D warnings - - run: cargo test --all-features --release --locked - - run: cargo build --package tesor --bin tesor --release --locked - - - name: Build packages - run: | - PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "tesor") | .version') - if [[ "$GITHUB_REF" == refs/tags/v* ]]; then - VERSION="${GITHUB_REF_NAME#v}" - if [[ "$VERSION" != "$PKG_VERSION" ]]; then - echo "Tag version $VERSION does not match Cargo.toml version $PKG_VERSION" >&2 - exit 1 - fi - else - VERSION="$PKG_VERSION~nightly.$(git log -1 --format=%ct)" - fi - - mise run package -- \ - --version "$VERSION" \ - --arch "${{ matrix.arch }}" \ - --output dist \ - deb rpm - env: - GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - - - name: Generate coverage (lcov) - run: cargo llvm-cov --all-features --workspace --lcov --output-path coverage.lcov - - - name: Upload coverage artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: coverage-lcov-${{ matrix.arch }} - path: coverage.lcov - - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: packages-${{ matrix.arch }} - path: dist/* - - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: binary-${{ matrix.arch }} - path: target/release/tesor - - smoke: - name: Smoke tests - runs-on: ubuntu-24.04 - needs: [build] - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: binary-amd64 - path: target/release/ - - - name: Run smoke tests against local instance - run: | - chmod +x target/release/tesor - ./tests/smoke/run-local.sh - - publish: - name: Publish nightly build - runs-on: ubuntu-latest - needs: [build, smoke] - concurrency: - group: package-publish-tesor-nightly - cancel-in-progress: false - if: github.ref == 'refs/heads/main' - permissions: - contents: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - pattern: packages-* - path: dist - merge-multiple: true - - # Update Github Release - - name: Update 'nightly' tag - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - git tag -f ${{ env.RELEASE_TAG }} - git push origin --force tag ${{ env.RELEASE_TAG }} - - name: Delete old release assets - run: | - for asset in $(gh release view ${{ env.RELEASE_TAG }} --json assets --jq '.assets[].name' 2>/dev/null || true); do - gh release delete-asset ${{ env.RELEASE_TAG }} "$asset" --yes - done - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 - with: - name: ${{ env.RELEASE_TAG }} - tag_name: ${{ env.RELEASE_TAG }} - files: dist/* - body: | - Last successful build from `main` branch. - - **Release checks**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Publish package repositories - run: | - mise run publish -- \ - --service tesor \ - --channel nightly \ - --input dist \ - deb rpm - env: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} - PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }} - S3_BUCKET: ${{ vars.S3_BUCKET }} - S3_ENDPOINT: ${{ vars.S3_ENDPOINT }} - S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }} - S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} - S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - - oci: - name: OCI artifacts - needs: [smoke] - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - pattern: binary-* - path: .container - - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - - - name: Determine artifact version - id: artifact - shell: bash - run: | - base_version=$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["workspace"]["package"]["version"])') - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - version="$base_version-nightly.$(git log -1 --format=%ct)" - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - version="${GITHUB_REF_NAME#v}" - if [[ "$version" != "$base_version" ]]; then - echo "Tag version $version does not match Cargo.toml version $base_version" >&2 - exit 1 - fi - else - version="$base_version-pr.$GITHUB_RUN_NUMBER" - fi - echo "version=$version" >> "$GITHUB_OUTPUT" - - - name: Log in to GHCR - if: github.event_name != 'pull_request' - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Log Helm in to GHCR - if: github.event_name != 'pull_request' - env: - GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - printf '%s' "$GHCR_TOKEN" | mise x helm@4.1.1 -- \ - helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin - - - name: Build and publish OCI artifacts - shell: bash - run: | - version="${{ steps.artifact.outputs.version }}" - image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/tesor" - tags=( - --tag "$image:sha-$GITHUB_SHA" - --tag "$image:$version" - ) - labels=( - --label "org.opencontainers.image.revision=$GITHUB_SHA" - --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" - --label "org.opencontainers.image.version=$version" - ) - image_output=() - chart_output=() - - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - tags+=(--tag "$image:nightly") - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - tags+=(--tag "$image:latest") - fi - if [[ "${{ github.event_name }}" != pull_request ]]; then - image_output+=(--push) - chart_output+=(--push "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts") - fi - - mise run container -- \ - --context . \ - --file Dockerfile \ - --platform linux/amd64,linux/arm64 \ - --cache-scope tesor \ - "${tags[@]}" "${labels[@]}" "${image_output[@]}" - - mise run chart -- \ - --chart charts/tesor \ - --version "$version" \ - --app-version "$version" \ - "${chart_output[@]}" |