WIP: preserve package and publish prototype - tesor - Unnamed repository; edit this file 'description' to name the repository.

diff options


context:
space:
mode:

author	Nikolay Govorov <me@govorov.online>	2026-08-19 21:52:21 +0000
committer	Nikolay Govorov <me@govorov.online>	2026-08-19 21:52:21 +0000
commit	a9aa67bfadd5ec81226344db2e84b51dfa11e570 (patch)
tree	7ca24d4235b70c85d1153687963e6170ce42288a
parent	863dc78a84d3ed9c4f039bec6f8d01154b6db188 (diff)
download	tar tar.gz tar.bz2 tar.lz tar.xz tar.zst zip

WIP: preserve package and publish prototype (wip/package-publish-prototype)

Diffstat

-rw-r--r--	.github/workflows/build.yml	133	+39 −94
-rw-r--r--	README.md	10	+5 −5
-rw-r--r--	mise.lock	60	+0 −60
-rw-r--r--	mise.toml	5	+1 −4
-rw-r--r--	nfpm.yaml	2	+2 −0

5 files changed, 47 insertions, 163 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 11a2409..f6c2256 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml

@@ -12,7 +12,6 @@ on:

env:

CARGO_TERM_COLOR: always

- RELEASE_TAG: nightly

jobs:

lint:

@@ -57,34 +56,33 @@ jobs:

run: mise bootstrap --locked --yes --update

- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

- - name: Import GPG key

- uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0

- with:

- passphrase: ${{ secrets.GPG_PASSPHRASE }}

- gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}

- run: cargo clippy --all-targets --all-features --release -- -D warnings

- run: cargo build --release

- run: cargo test --all-features --release --locked

- name: Build packages

+ if: github.event_name == 'push'

run: |

- export SIGNING_PRIVATE_KEY="/tmp/private.asc"

- printf '%s' "$GPG_PRIVATE_KEY" > $SIGNING_PRIVATE_KEY

- chmod 600 $SIGNING_PRIVATE_KEY

- PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "recluse") | .version')

- export VERSION="${PKG_VERSION}~nightly.$(git log -1 --format=%ct)"

- export ARCH=${{ matrix.arch }}

- mkdir -p dist/

- for pkg in deb rpm; do

- nfpm package --packager $pkg --target dist/

- done

+ base=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "recluse") | .version')

+ case "$GITHUB_REF" in

+ refs/tags/v*)

+ version=${GITHUB_REF#refs/tags/v}

+ [ "$version" = "$base" ]

+ ;;

+ *)

+ version="$base-nightly.${{ github.run_number }}.g$(git rev-parse --short=12 HEAD)"

+ ;;

+ esac

+ mise run package -- \

+ --version "$version" \

+ --arch "${{ matrix.arch }}" \

+ --output dist \

+ deb rpm

+ printf 'VERSION=%s\n' "$version" > dist/build.env

env:

GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

- NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

+ GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

- name: Generate coverage (lcov)

run: cargo llvm-cov --all-features --workspace --lcov --output-path coverage.lcov

@@ -96,6 +94,7 @@ jobs:

path: coverage.lcov

- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

+ if: github.event_name == 'push'

with:

path: dist/*

@@ -109,7 +108,7 @@ jobs:

runs-on: ubuntu-24.04

needs: [build]

- if: github.ref == 'refs/heads/main'

+ if: github.event_name == 'push'

steps:

- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

@@ -132,10 +131,10 @@ jobs:

./tests/smoke/run-local.sh

publish:

- name: Publish nightly build

+ name: Publish packages

runs-on: ubuntu-latest

needs: [build, smoke]

- if: github.ref == 'refs/heads/main'

+ if: github.event_name == 'push'

permissions:

contents: write

steps:

@@ -155,79 +154,25 @@ jobs:

path: dist

merge-multiple: true

- # Configure GPG keys

- - name: Import GPG key

- uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0

- with:

- passphrase: ${{ secrets.GPG_PASSPHRASE }}

- gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}

- - name: Export GPG public key

- run: printf '%s' "$GPG_PUBLIC_KEY" > dist/public.gpg

- env:

- GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}

- # Update Github Release

- - name: Update 'nightly' tag

+ - name: Publish

run: |

git config user.name "github-actions[bot]"

git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

- git tag -f ${{ env.RELEASE_TAG }}

- git push origin --force tag ${{ env.RELEASE_TAG }}

- - name: Delete old release assets

- run: |

- for asset in $(gh release view ${{ env.RELEASE_TAG }} --json assets --jq '.assets[].name' 2>/dev/null || true); do

- gh release delete-asset ${{ env.RELEASE_TAG }} "$asset" --yes

- done

+ . dist/build.env

+ mise run publish -- \

+ --name recluse \

+ --repository "${{ github.server_url }}/${{ github.repository }}" \

+ --version "$VERSION" \

+ --input dist \

+ --s3-bucket "${{ vars.S3_BUCKET }}" \

+ --s3-public-url "https://${{ vars.S3_BUCKET }}.${{ vars.S3_ENDPOINT }}" \

+ --s3-provider Other \

+ --s3-endpoint "${{ vars.S3_ENDPOINT }}" \

+ --github-release

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- - name: Create GitHub Release

- uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0

- with:

- name: ${{ env.RELEASE_TAG }}

- tag_name: ${{ env.RELEASE_TAG }}

- files: dist/*

- body: |

- Last successful build from `main` branch.

- **Release checks**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

- env:

- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- # Update APT/RPM repos on s3

- - name: Create APT repository

- run: |

- aptly repo create -distribution="${{ env.RELEASE_TAG }}" -component=main recluse

- aptly repo add recluse dist/*.deb

- aptly publish repo -architectures=amd64,arm64 -gpg-key="${{vars.GPG_KEY_ID}}" recluse

- - name: Create RPM repository

- run: |

- mkdir -p rpm-repo

- cp dist/*.rpm rpm-repo/

- cat > rpm-repo/recluse-nightly.repo << EOF

- [recluse-nightly]

- name=Recluse Nightly

- gpgkey=${{github.server_url}}/${{github.repository}}/releases/download/${{env.RELEASE_TAG}}/public.gpg

- baseurl=https://${{vars.S3_BUCKET}}.${{vars.S3_ENDPOINT}}/rpm/

- enabled=1

- gpgcheck=1

- EOF

- createrepo_c rpm-repo/

- gpg --default-key="${{vars.GPG_KEY_ID}}" --detach-sign --armor rpm-repo/repodata/repomd.xml

- - name: Upload RPM to S3

- run: |

- mkdir -p ~/.config/rclone

- cat > ~/.config/rclone/rclone.conf << EOF

- [hetzner]

- type = s3

- provider = Other

- acl = public-read

- endpoint = ${{vars.S3_ENDPOINT}}

- access_key_id = ${{secrets.S3_ACCESS_KEY_ID}}

- secret_access_key = ${{secrets.S3_SECRET_ACCESS_KEY}}

- EOF

- rclone sync rpm-repo/ "hetzner:${{vars.S3_BUCKET}}/rpm/" --progress

- rclone sync ~/.aptly/public/ "hetzner:${{vars.S3_BUCKET}}/apt/" --progress

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

+ GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

+ GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

+ S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}

+ S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

diff --git a/README.md b/README.md
index 2fbc62c..41dbb9b 100644
--- a/README.md
+++ b/README.md

@@ -13,7 +13,7 @@ is **not** intended for production use.

```bash

sudo apt install curl gnupg

-curl -fsSL https://github.com/dimidiumlabs/recluse/releases/download/nightly/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/recluse.gpg

+curl -fsSL https://dimidiumlabs.fsn1.your-objectstorage.com/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/recluse.gpg

echo "deb [signed-by=/usr/share/keyrings/recluse.gpg] https://dimidiumlabs.fsn1.your-objectstorage.com/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/recluse.list

sudo apt update && sudo apt install recluse

@@ -24,10 +24,10 @@ sudo systemctl enable --now recluse

```bash

# DNF5 (Fedora 41+, RHEL 10+)

-sudo dnf config-manager addrepo --from-repofile=https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/recluse-nightly.repo

+sudo dnf config-manager addrepo --from-repofile=https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/recluse-nightly.repo

# DNF4 (Fedora 40 and older, RHEL 8/9)

-sudo curl -o /etc/yum.repos.d/recluse-nightly.repo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/recluse-nightly.repo

+sudo curl -o /etc/yum.repos.d/recluse-nightly.repo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/recluse-nightly.repo

sudo dnf install recluse

sudo systemctl enable --now recluse

@@ -36,8 +36,8 @@ sudo systemctl enable --now recluse

**openSUSE:**

```bash

-sudo rpm --import https://github.com/dimidiumlabs/recluse/releases/download/nightly/public.gpg

-sudo zypper addrepo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/ recluse-nightly

+sudo rpm --import https://dimidiumlabs.fsn1.your-objectstorage.com/public.gpg

+sudo zypper addrepo https://dimidiumlabs.fsn1.your-objectstorage.com/rpm/nightly/ recluse-nightly

sudo zypper refresh

sudo zypper install recluse

diff --git a/mise.lock b/mise.lock
index 7f8fde7..025fcd6 100644
--- a/mise.lock
+++ b/mise.lock

@@ -1,19 +1,5 @@

# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html

-[[tools."aqua:aptly-dev/aptly"]]

-version = "1.6.3"

-backend = "aqua:aptly-dev/aptly"

-[tools."aqua:aptly-dev/aptly"."platforms.linux-arm64"]

-checksum = "sha256:dd0988ebe8bfd547482e55de83f178c14e95d5d829d956ce683e0ca045cdb86c"

-url = "https://github.com/aptly-dev/aptly/releases/download/v1.6.3/aptly_1.6.3_linux_arm64.zip"

-url_api = "https://api.github.com/repos/aptly-dev/aptly/releases/assets/457534360"

-[tools."aqua:aptly-dev/aptly"."platforms.linux-x64"]

-checksum = "sha256:535ed24eb706bc25a316b59d709a7e74e10165f2ffab8552097ba7e4816a3e7e"

-url = "https://github.com/aptly-dev/aptly/releases/download/v1.6.3/aptly_1.6.3_linux_amd64.zip"

-url_api = "https://api.github.com/repos/aptly-dev/aptly/releases/assets/457534365"

[[tools."aqua:taiki-e/cargo-llvm-cov"]]

version = "0.8.7"

backend = "aqua:taiki-e/cargo-llvm-cov"

@@ -28,22 +14,6 @@ checksum = "sha256:967b5cc996c29d8baa52bbb4595ef1f53af35255af8e2036ddbc6468d7b52

url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-unknown-linux-musl.tar.gz"

url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861752"

-[[tools.gh]]

-version = "2.96.0"

-backend = "aqua:cli/cli"

-[tools.gh."platforms.linux-arm64"]

-checksum = "sha256:06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_arm64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728549"

-provenance = "github-attestations"

-[tools.gh."platforms.linux-x64"]

-checksum = "sha256:83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_amd64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728543"

-provenance = "github-attestations"

[[tools.jq]]

version = "1.8.2"

backend = "aqua:jqlang/jq"

@@ -60,36 +30,6 @@ url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-amd64"

url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012752"

provenance = "github-attestations"

-[[tools.nfpm]]

-version = "2.47.0"

-backend = "aqua:goreleaser/nfpm"

-[tools.nfpm."platforms.linux-arm64"]

-checksum = "sha256:1c0f5f2999b9a974bfb04fdb0cc3306096de530ac5dbb25d739cc5f5219c919c"

-url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_arm64.tar.gz"

-url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316744"

-provenance = "cosign"

-[tools.nfpm."platforms.linux-x64"]

-checksum = "sha256:0660ca602b2d2d2ae4781a06c692b3eeb9d437ffea05b831d76e41f4a3188783"

-url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_x86_64.tar.gz"

-url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316748"

-provenance = "cosign"

-[[tools.rclone]]

-version = "1.74.4"

-backend = "aqua:rclone/rclone"

-[tools.rclone."platforms.linux-arm64"]

-checksum = "sha256:97685285c9ad6a0cf17d5844115d2a67245af6444db672187074bd9c358de419"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-arm64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470550100"

-[tools.rclone."platforms.linux-x64"]

-checksum = "sha256:fe435e0c36228e7c2f116a8701f01127bb1f694005fc11d1f27186c8bca4115d"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-amd64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470549540"

[[tools.rust]]

version = "1.97.1"

backend = "core:rust"

diff --git a/mise.toml b/mise.toml
index 214e32f..d1d8759 100644
--- a/mise.toml
+++ b/mise.toml

@@ -7,12 +7,8 @@ min_version = "2026.7.5"

experimental = true

[tools]

-"aqua:aptly-dev/aptly" = "1.6.3"

"aqua:taiki-e/cargo-llvm-cov" = "0.8.7"

-gh = "2.96.0"

jq = "1.8.2"

-nfpm = "2.47.0"

-rclone = "1.74.4"

rust = { version = "1.97.1", profile = "minimal", components = [

"clippy",

"llvm-tools-preview",

@@ -21,6 +17,7 @@ rust = { version = "1.97.1", profile = "minimal", components = [

[bootstrap.packages]

# APT

+"apt:apt-utils" = "latest"

"apt:build-essential" = "latest"

"apt:createrepo-c" = "latest"

"apt:gnupg" = "latest"

diff --git a/nfpm.yaml b/nfpm.yaml
index c53abb5..0a9ab25 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml

@@ -7,6 +7,8 @@

arch: ${ARCH}

version: ${VERSION}

+release: ${RELEASE}

+version_schema: none

license: AGPL-3.0-or-later

platform: linux

maintainer: Nikolay Govorov <me@govorov.online>