sir_melonchenandClaude Opus 5.5
306efd2990
The release dry run builds and inspects the packages and proves signing and verification with a throwaway key; the release workflow signs SHA256SUMS when RELEASE_SIGNING_KEY is set and checks the signature with the installer's public key. The shell job runs the brand check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
66 lines
2.7 KiB
YAML
66 lines
2.7 KiB
YAML
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Builds release artefacts for a version tag and attaches them to the Gitea
|
|
# release of that tag (ADR 0003). Uses the job token by default; set the
|
|
# repository secret RELEASE_TOKEN if the job token lacks release permissions.
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
|
with:
|
|
node-version: "24"
|
|
- name: Ensure jq and openssl
|
|
run: |
|
|
command -v jq >/dev/null && command -v openssl >/dev/null ||
|
|
(apt-get update -qq && apt-get install -y -qq jq openssl)
|
|
- name: Install nfpm
|
|
run: scripts/ci/install-tools.sh "$HOME/.local/bin" nfpm
|
|
- name: Build
|
|
run: make release PACKAGES=1 VERSION="${{ github.ref_name }}"
|
|
- name: Verify checksums
|
|
run: cd dist && sha256sum -c SHA256SUMS
|
|
# Ed25519 signature over SHA256SUMS (ADR 0024, docs/RELEASE.md) if the
|
|
# secret RELEASE_SIGNING_KEY (PEM private key) is set. The key only
|
|
# exists in a private temporary file during signing.
|
|
- name: Sign checksums
|
|
env:
|
|
RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
|
|
run: |
|
|
if [[ -z "${RELEASE_SIGNING_KEY:-}" ]]; then
|
|
echo "::warning::RELEASE_SIGNING_KEY is not set: the release is not signed"
|
|
exit 0
|
|
fi
|
|
scripts/sign-release.sh sign dist/SHA256SUMS
|
|
# The installer must accept the signature: verify with its public
|
|
# key if one is configured there.
|
|
pub="$(mktemp)"
|
|
sed -n -e 's/^[[:space:]]*//' -e 's/.*\(-----BEGIN PUBLIC KEY-----\)/\1/' \
|
|
-e 's/\(-----END PUBLIC KEY-----\).*/\1/' \
|
|
-e '/-----BEGIN PUBLIC KEY-----/,/-----END PUBLIC KEY-----/p' scripts/install.sh >"$pub" 2>/dev/null || true
|
|
if [[ -s "$pub" ]]; then
|
|
scripts/sign-release.sh verify dist/SHA256SUMS dist/SHA256SUMS.sig "$pub"
|
|
else
|
|
echo "::warning::no public key in scripts/install.sh: the installer will not check the signature"
|
|
fi
|
|
rm -f "$pub"
|
|
- name: Upload to release
|
|
env:
|
|
GITEA_API_URL: ${{ github.server_url }}/api/v1
|
|
GITEA_REPOSITORY: ${{ github.repository }}
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
|
|
run: scripts/release-upload.sh dist "${{ github.ref_name }}"
|