diff options
Diffstat (limited to '.github/workflows/build.yml')
| -rw-r--r-- | .github/workflows/build.yml | 278 | +87 −191 |
1 files changed, 87 insertions, 191 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4078821..e21f530 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online> # SPDX-License-Identifier: AGPL-3.0-or-later name: Build @@ -10,16 +10,9 @@ on: pull_request: branches: [main] -permissions: - contents: read - -concurrency: - group: tesor-build-${{ github.ref }} - cancel-in-progress: true - env: CARGO_TERM_COLOR: always - RELEASE_TAG: nightly + RELEASE_TAG: dev jobs: lint: @@ -28,23 +21,20 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update + - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - - name: formatting - run: cargo fmt --all --check + - name: Check licenses + uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0 + + - name: Check dependencies + uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # 0.19.0 - - name: shellcheck - run: shellcheck pkg/scripts/*.sh tests/smoke/*.sh + - name: Check formatting + run: cargo fmt --all --check - - name: clippy - run: cargo clippy --workspace --all-targets --all-features --release --locked -- -D warnings + - name: Run clippy + run: cargo clippy --all-targets --all-features -- -D warnings build: name: Build (${{ matrix.arch }}) @@ -61,41 +51,46 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 + - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update + components: llvm-tools-preview - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - - run: cargo clippy --workspace --locked --all-targets --all-features --release -- -D warnings + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0 + with: + passphrase: ${{ secrets.GPG_PASSPHRASE }} + gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} + + - run: cargo build --release - run: cargo test --all-features --release --locked - - run: cargo build --package tesor --bin tesor --release --locked + + - name: Install nfpm + run: | + echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list + sudo apt update && sudo apt install nfpm - name: Build packages run: | - PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "tesor") | .version') - if [[ "$GITHUB_REF" == refs/tags/v* ]]; then - VERSION="${GITHUB_REF_NAME#v}" - if [[ "$VERSION" != "$PKG_VERSION" ]]; then - echo "Tag version $VERSION does not match Cargo.toml version $PKG_VERSION" >&2 - exit 1 - fi - else - VERSION="$PKG_VERSION~nightly.$(git log -1 --format=%ct)" - fi - - mise run package -- \ - --version "$VERSION" \ - --arch "${{ matrix.arch }}" \ - --output dist \ - deb rpm + export SIGNING_PRIVATE_KEY="/tmp/private.asc" + printf '%s' "$GPG_PRIVATE_KEY" > $SIGNING_PRIVATE_KEY + chmod 600 $SIGNING_PRIVATE_KEY + + PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "recluse") | .version') + export VERSION="${PKG_VERSION}~dev.$(git log -1 --format=%ct)" + export ARCH=${{ matrix.arch }} + + mkdir -p dist/ + for pkg in deb rpm; do + nfpm package --packager $pkg --target dist/ + done env: GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + + - name: Install tools + run: make setup - name: Generate coverage (lcov) run: cargo llvm-cov --all-features --workspace --lcov --output-path coverage.lcov @@ -111,56 +106,33 @@ jobs: name: packages-${{ matrix.arch }} path: dist/* - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: binary-${{ matrix.arch }} - path: target/release/tesor - smoke: name: Smoke tests runs-on: ubuntu-24.04 needs: [build] + if: github.ref == 'refs/heads/main' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: binary-amd64 - path: target/release/ + - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 - name: Run smoke tests against local instance - run: | - chmod +x target/release/tesor - ./tests/smoke/run-local.sh + run: ./tests/smoke/run-local.sh publish: - name: Publish nightly build + name: Publish dev build runs-on: ubuntu-latest needs: [build, smoke] - concurrency: - group: package-publish-tesor-nightly - cancel-in-progress: false if: github.ref == 'refs/heads/main' permissions: contents: write steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - name: Install dependencies - run: mise bootstrap --locked --yes --update + - name: Install tools + run: | + sudo apt-get update + sudo apt-get install -y aptly rclone createrepo-c - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: @@ -168,8 +140,19 @@ jobs: path: dist merge-multiple: true + # Configure GPG keys + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0 + with: + passphrase: ${{ secrets.GPG_PASSPHRASE }} + gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} + - name: Export GPG public key + run: printf '%s' "$GPG_PUBLIC_KEY" > dist/public.gpg + env: + GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }} + # Update Github Release - - name: Update 'nightly' tag + - name: Update 'dev' tag run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" @@ -196,117 +179,30 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Publish package repositories - run: | - mise run publish -- \ - --service tesor \ - --channel nightly \ - --input dist \ - deb rpm - env: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} - PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }} - S3_BUCKET: ${{ vars.S3_BUCKET }} - S3_ENDPOINT: ${{ vars.S3_ENDPOINT }} - S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }} - S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} - S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - - oci: - name: OCI artifacts - needs: [smoke] - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - with: - version: 2026.7.5 - experimental: true - install: false - - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - pattern: binary-* - path: .container - - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - - - name: Determine artifact version - id: artifact - shell: bash + # Update APT/RPM repos on s3 + - name: Create APT repository run: | - base_version=$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["workspace"]["package"]["version"])') - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - version="$base_version-nightly.$(git log -1 --format=%ct)" - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - version="${GITHUB_REF_NAME#v}" - if [[ "$version" != "$base_version" ]]; then - echo "Tag version $version does not match Cargo.toml version $base_version" >&2 - exit 1 - fi - else - version="$base_version-pr.$GITHUB_RUN_NUMBER" - fi - echo "version=$version" >> "$GITHUB_OUTPUT" - - - name: Log in to GHCR - if: github.event_name != 'pull_request' - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Log Helm in to GHCR - if: github.event_name != 'pull_request' - env: - GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + aptly repo create -distribution=dev -component=main recluse + aptly repo add recluse dist/*.deb + aptly publish repo -architectures=amd64,arm64 -gpg-key="${{vars.GPG_KEY_ID}}" recluse + - name: Create RPM repository run: | - printf '%s' "$GHCR_TOKEN" | mise x helm@4.1.1 -- \ - helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin - - - name: Build and publish OCI artifacts - shell: bash + mkdir -p rpm-repo + cp dist/*.rpm rpm-repo/ + createrepo_c rpm-repo/ + gpg --default-key="${{vars.GPG_KEY_ID}}" --detach-sign --armor rpm-repo/repodata/repomd.xml + - name: Upload RPM to S3 run: | - version="${{ steps.artifact.outputs.version }}" - image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/tesor" - tags=( - --tag "$image:sha-$GITHUB_SHA" - --tag "$image:$version" - ) - labels=( - --label "org.opencontainers.image.revision=$GITHUB_SHA" - --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" - --label "org.opencontainers.image.version=$version" - ) - image_output=() - chart_output=() - - if [[ "$GITHUB_REF" == refs/heads/main ]]; then - tags+=(--tag "$image:nightly") - elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then - tags+=(--tag "$image:latest") - fi - if [[ "${{ github.event_name }}" != pull_request ]]; then - image_output+=(--push) - chart_output+=(--push "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts") - fi - - mise run container -- \ - --context . \ - --file Dockerfile \ - --platform linux/amd64,linux/arm64 \ - --cache-scope tesor \ - "${tags[@]}" "${labels[@]}" "${image_output[@]}" - - mise run chart -- \ - --chart charts/tesor \ - --version "$version" \ - --app-version "$version" \ - "${chart_output[@]}" + mkdir -p ~/.config/rclone + cat > ~/.config/rclone/rclone.conf << EOF + [hetzner] + type = s3 + provider = Other + acl = public-read + endpoint = ${{vars.S3_ENDPOINT}} + access_key_id = ${{secrets.S3_ACCESS_KEY_ID}} + secret_access_key = ${{secrets.S3_SECRET_ACCESS_KEY}} + EOF + + rclone sync rpm-repo/ "hetzner:${{vars.S3_BUCKET}}/rpm/" --progress + rclone sync ~/.aptly/public/ "hetzner:${{vars.S3_BUCKET}}/apt/" --progress |