9441bccf58
The dispatched build of v0.1.1 kept failing at publish with 'scripts/publish-release.sh: No such file or directory' — the workflow is read from the dispatch ref (main) but the workspace was the v0.1.1 tag, whose tree predates scripts/ and .forgejo/. - second checkout of the workflow's own ref into .ci-tools; publish runs .ci-tools/scripts/publish-release.sh (and .ci-tools/scripts/release-body.md) - exclude ./.ci-tools from the build context tar - target_commitish is now opt-in in publish-release.sh and only set for a push event, so a re-publish can never move an existing tag Verified locally end-to-end against a throwaway tag: create, idempotent re-run (stale assets deleted + replaced), public download, sha256sum -c, --version. Test release and tag deleted afterwards.
108 lines
4.4 KiB
YAML
108 lines
4.4 KiB
YAML
name: release
|
|
|
|
# Native aarch64 build on the Pi runner, published to the Forgejo release.
|
|
# x86_64 is NOT built here: there is no x86_64 runner on this instance — build
|
|
# it on an x86_64 host with scripts/build-release-local.sh (same release, same
|
|
# asset naming), or the release will carry aarch64 only.
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Existing tag to (re)build and publish
|
|
required: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: never
|
|
TARGET: aarch64-unknown-linux-gnu
|
|
# Job steps run inside node:20-bullseye (the runner's docker label image) with
|
|
# the host docker socket mounted, so builds happen in a sibling rust container.
|
|
RUST_IMAGE: rust:1.91-bookworm
|
|
CARGO_REGISTRY_VOLUME: onionwire-cargo-registry
|
|
CARGO_TARGET_VOLUME: onionwire-target-aarch64
|
|
BUILD_CONTAINER: onionwire-release-build
|
|
|
|
jobs:
|
|
aarch64:
|
|
runs-on: docker
|
|
timeout-minutes: 120
|
|
steps:
|
|
- name: Checkout the source tag
|
|
uses: https://code.forgejo.org/actions/checkout@v4
|
|
with:
|
|
# A tag push builds that tag; a manual dispatch builds the tag the
|
|
# caller named (otherwise the binary version would not match the
|
|
# release it is attached to).
|
|
ref: ${{ github.event.inputs.tag || github.ref_name }}
|
|
|
|
- name: Checkout the CI tooling
|
|
uses: https://code.forgejo.org/actions/checkout@v4
|
|
with:
|
|
# scripts/ and .forgejo/ only exist on the branch (older tags predate
|
|
# them), and the workflow itself is read from the dispatched ref — so
|
|
# fetch the same ref into .ci-tools and run the scripts from there.
|
|
ref: ${{ github.ref_name }}
|
|
path: .ci-tools
|
|
|
|
- name: Build ${{ env.TARGET }} in a rust container
|
|
run: |
|
|
set -euo pipefail
|
|
cd "${GITHUB_WORKSPACE}"
|
|
echo "workspace: $GITHUB_WORKSPACE"
|
|
docker volume create "$CARGO_REGISTRY_VOLUME" > /dev/null
|
|
docker volume create "$CARGO_TARGET_VOLUME" > /dev/null
|
|
docker rm -f "$BUILD_CONTAINER" > /dev/null 2>&1 || true
|
|
# The workspace lives in a per-task volume the host daemon cannot
|
|
# resolve, so pipe the source tree in over stdin (tar) and pull the
|
|
# binary back out with docker cp.
|
|
docker create --name "$BUILD_CONTAINER" -i \
|
|
-e CARGO_TARGET_DIR=/target \
|
|
-e CARGO_BUILD_JOBS=2 \
|
|
-e CARGO_TERM_COLOR=never \
|
|
-v "$CARGO_REGISTRY_VOLUME":/usr/local/cargo/registry \
|
|
-v "$CARGO_TARGET_VOLUME":/target \
|
|
-w /src \
|
|
"$RUST_IMAGE" \
|
|
sh -euxc 'mkdir -p /src && tar xzf - -C /src && cd /src \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends pkg-config libssl-dev \
|
|
&& cargo build --release --locked \
|
|
&& strip /target/release/onionwire \
|
|
&& ls -l /target/release/onionwire'
|
|
tar czf - --exclude=./target --exclude=./.git --exclude=./.worktrees \
|
|
--exclude=./.ci-tools . \
|
|
| docker start -a -i "$BUILD_CONTAINER"
|
|
mkdir -p dist
|
|
docker cp "$BUILD_CONTAINER:/target/release/onionwire" "dist/onionwire-$TARGET"
|
|
docker rm -f "$BUILD_CONTAINER" > /dev/null
|
|
|
|
- name: Pack and checksum
|
|
run: |
|
|
set -euo pipefail
|
|
cd "${GITHUB_WORKSPACE}/dist"
|
|
file "onionwire-$TARGET"
|
|
sha256sum "onionwire-$TARGET" > "onionwire-$TARGET.sha256"
|
|
sha256sum -c "onionwire-$TARGET.sha256"
|
|
ls -l
|
|
|
|
- name: Publish to the Forgejo release
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
REPO_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
EVENT_SHA: ${{ github.sha }}
|
|
REF: ${{ github.ref_name }}
|
|
INPUT_TAG: ${{ github.event.inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
cd "${GITHUB_WORKSPACE}"
|
|
tag="${INPUT_TAG:-$REF}"
|
|
# Only a tag push may create the tag; a re-publish must not move it.
|
|
if [ "$EVENT_NAME" = "push" ]; then export TARGET_COMMITISH="$EVENT_SHA"; fi
|
|
echo "publishing $tag from $REPO_API (event=$EVENT_NAME)"
|
|
.ci-tools/scripts/publish-release.sh \
|
|
"$tag" "OnionWire $tag" \
|
|
.ci-tools/scripts/release-body.md \
|
|
"dist/onionwire-$TARGET" "dist/onionwire-$TARGET.sha256"
|