294 lines
13 KiB
YAML
294 lines
13 KiB
YAML
# Release, Go binaries. Runs on version tags (v1.2.3) pushed to main.
|
|
#
|
|
# No gate runs at the tag: the tagged tree was tested on every push to development,
|
|
# the full suite is the suite workflow's business, and race never runs in CI at all.
|
|
# This pipeline publishes and nothing else. The version contract has no injection
|
|
# step: the toolchain records the tag into the binary's build information, so the
|
|
# build simply has to happen at the tag, which the trigger guarantees.
|
|
#
|
|
# The module sits at the repository root: the toolchain records a version only for a
|
|
# root module, measured on go1.27.1, so a build of a module in a subdirectory reports
|
|
# (devel) even at its own <module>/vX.Y.Z tag and this workflow's smoke test can never
|
|
# pass for it. A Go repository is one module at the root.
|
|
#
|
|
# The matrix carries the platforms the project ships: Linux on amd64, arm64, loong64
|
|
# and riscv64. The FreeBSD port compiles in its own dispatched workflow and ships no
|
|
# binary. Nothing is installed: the fedora job image carries git, perl and node
|
|
# (verified on the runner, 2026-10-04).
|
|
#
|
|
# Each job validates the tag for itself rather than passing a value between jobs, so
|
|
# no workflow feature has to be trusted for the version to reach the file name. Every
|
|
# step is one command, and the scripted steps are Perl with builtins only: Perl drives
|
|
# curl through a list, so no argument is ever word-split, globbed or quoted wrong.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
env:
|
|
# The box is shared with the forge, so parallelism is bounded on purpose.
|
|
GOFLAGS: -p=1
|
|
GOMAXPROCS: "2"
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: fedora
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- goos: linux
|
|
goarch: amd64
|
|
- goos: linux
|
|
goarch: arm64
|
|
- goos: linux
|
|
goarch: loong64
|
|
- goos: linux
|
|
goarch: riscv64
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Validate the tag
|
|
id: version
|
|
env:
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
perl -e '
|
|
my $v = $ENV{VERSION} // q{};
|
|
$v =~ m{^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$}
|
|
or die qq{ERROR: expected a semver tag like v1.2.3, got: $v\n};
|
|
(my $nv = $v) =~ s{^v}{};
|
|
open(my $o, q{>>}, $ENV{GITEA_OUTPUT}) or die qq{GITEA_OUTPUT: $!};
|
|
print $o qq{version_no_v=$nv\n};
|
|
close($o);
|
|
print qq{version $nv\n};
|
|
'
|
|
|
|
- name: Build
|
|
env:
|
|
VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
|
|
GOOS: ${{ matrix.goos }}
|
|
GOARCH: ${{ matrix.goarch }}
|
|
CGO_ENABLED: "0"
|
|
run: |
|
|
# Nothing is injected. The toolchain records the tag into the binary's build
|
|
# information, so the version is right because this build happens at the tag, and
|
|
# there is no path for anyone to get wrong. -s -w only strips symbols.
|
|
go build -ldflags "-s -w" -o "bin/gasm-${VERSION_NO_V}-${GOOS}-${GOARCH}" ./cmd/gasm
|
|
|
|
# Artifacts stay on v3: v4 and later detect Gitea as GHES and abort.
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: gasm-${{ matrix.goos }}-${{ matrix.goarch }}
|
|
path: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
|
|
if-no-files-found: error
|
|
|
|
- name: Smoke test
|
|
# Only a binary matching the runner can be run here. The check is not that --version
|
|
# exits cleanly but that it reports the tag and nothing more: a build outside version
|
|
# control reports (devel), and a build whose tree was dirty reports +dirty, and both
|
|
# would otherwise be published.
|
|
if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
|
|
env:
|
|
TAG: ${{ gitea.ref_name }}
|
|
BIN: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
|
|
run: |
|
|
perl -e '
|
|
my $want = $ENV{TAG} // die qq{ERROR: no tag\n};
|
|
open(my $bin, q{-|}, $ENV{BIN}, q{--version}) or die qq{$ENV{BIN}: $!};
|
|
my $got = <$bin>;
|
|
close($bin);
|
|
$got = defined $got ? $got : q{};
|
|
chomp $got;
|
|
index($got, $want) >= 0
|
|
or die qq{ERROR: the binary printed "$got", which does not contain $want. Version control was disabled, so there is no recorded version.\n};
|
|
index($got, q{+dirty}) < 0
|
|
or die qq{ERROR: the binary printed "$got". The tree was dirty at build time, which means the checkout was not the tag, or the build artefacts are not ignored.\n};
|
|
print qq{$ENV{BIN} reports $got\n};
|
|
'
|
|
|
|
release:
|
|
runs-on: fedora
|
|
needs: build
|
|
permissions:
|
|
# contents: read is required for the checkout: a job that declares any
|
|
# permissions gets a token scoped to exactly those, and releases: write
|
|
# alone leaves the fetch with no read access, which Gitea answers with
|
|
# a 404 "Repository not found". Verified on the instance 2026-09-16.
|
|
contents: read
|
|
releases: write
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
path: dist
|
|
|
|
- name: Extract the CHANGELOG section
|
|
env:
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
# Each step derives what it needs from the tag, so no value has to travel between
|
|
# jobs.
|
|
perl -e '
|
|
my $v = $ENV{VERSION} // q{};
|
|
$v =~ s{^v}{};
|
|
open(my $vout, q{>}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
|
|
print $vout $v;
|
|
close($vout);
|
|
open(my $in, q{<}, q{CHANGELOG.md}) or die qq{CHANGELOG.md: $!};
|
|
my @lines = <$in>;
|
|
close($in);
|
|
my ($start, $end) = (-1, scalar @lines);
|
|
for my $i (0 .. $#lines) {
|
|
if ($start < 0) { $start = $i if $lines[$i] =~ m{^##\s+\[\Q$v\E\]} }
|
|
elsif ($lines[$i] =~ m{^##\s+\[}) { $end = $i; last }
|
|
}
|
|
$start >= 0 or die qq{ERROR: no CHANGELOG section for $v, expected a heading like: ## [$v] - YYYY-MM-DD\n};
|
|
my @body = grep { m{\S} } @lines[$start + 1 .. $end - 1];
|
|
@body or die qq{ERROR: the CHANGELOG section for $v is empty\n};
|
|
open(my $out, q{>}, q{release-body.md}) or die qq{release-body.md: $!};
|
|
print $out @body;
|
|
close($out);
|
|
printf qq{notes for %s: %d lines\n}, $v, scalar @body;
|
|
'
|
|
|
|
- name: Build the release request
|
|
run: |
|
|
perl -e '
|
|
open(my $vin, q{<}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
|
|
my $v = <$vin>;
|
|
close($vin);
|
|
chomp $v;
|
|
open(my $in, q{<:raw}, q{release-body.md}) or die qq{release-body.md: $!};
|
|
my $body = do { local $/; <$in> };
|
|
close($in);
|
|
# Byte-oriented escaping: JSON is UTF-8, so non-ASCII passes through and only the
|
|
# characters JSON forbids are rewritten.
|
|
$body =~ s/([\\"])/\\$1/g;
|
|
$body =~ s/\t/\\t/g;
|
|
$body =~ s/\r//g;
|
|
$body =~ s/\n/\\n/g;
|
|
$body =~ s/([\x00-\x08\x0b\x0c\x0e-\x1f])/sprintf(q{\u%04x}, ord($1))/ge;
|
|
my $json = sprintf(qq{{"tag_name":"v%s","name":"v%s","body":"%s","draft":false,"prerelease":false}}, $v, $v, $body);
|
|
open(my $out, q{>}, q{release.json}) or die qq{release.json: $!};
|
|
print $out $json;
|
|
close($out);
|
|
print qq{release.json written for v$v\n};
|
|
'
|
|
|
|
- name: Create the release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ gitea.server_url }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
run: |
|
|
perl -e '
|
|
my @cmd = (q{curl}, q{-sS}, q{-o}, q{response.json}, q{-w}, q{%{http_code}},
|
|
q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
|
|
q{-H}, q{Content-Type: application/json},
|
|
q{-X}, q{POST},
|
|
qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases},
|
|
q{--data-binary}, q{@release.json});
|
|
open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
|
|
my $code = <$curl>;
|
|
my $ok = close($curl);
|
|
my $exit = $? >> 8;
|
|
$code = defined $code ? $code : q{};
|
|
$ok or die qq{ERROR: curl failed (exit $exit) calling $ENV{GITEA_SERVER_URL}\n};
|
|
open(my $r, q{<:raw}, q{response.json}) or die qq{response.json: $!};
|
|
my $body = do { local $/; <$r> };
|
|
close($r);
|
|
$code eq q{201} or die qq{ERROR: the release was not created, HTTP $code: $body\n};
|
|
$body =~ m{"id"\s*:\s*([0-9]+)} or die qq{ERROR: no release id in the response: $body\n};
|
|
open(my $o, q{>}, q{release-id.txt}) or die qq{release-id.txt: $!};
|
|
print $o $1;
|
|
close($o);
|
|
print qq{release id $1\n};
|
|
'
|
|
|
|
- name: Upload assets
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ gitea.server_url }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
run: |
|
|
perl -e '
|
|
open(my $f, q{<}, q{release-id.txt}) or die qq{release-id.txt: $!};
|
|
my $id = <$f>;
|
|
close($f);
|
|
chomp $id;
|
|
my @files = grep { -f $_ } glob(q{dist/*/*});
|
|
@files or die qq{ERROR: no assets under dist/\n};
|
|
# A file that arrived empty from the artifact step would be uploaded as an
|
|
# empty attachment, every status would still be 201, and the run would go
|
|
# green over a release nobody can install. Refuse it here, before the
|
|
# upload, and verify what was stored afterwards.
|
|
my %size;
|
|
for my $path (@files) {
|
|
my $n = -s $path // 0;
|
|
(my $name = $path) =~ s{.*/}{};
|
|
$n > 0 or die qq{ERROR: $path is empty, so there is nothing to upload\n};
|
|
$size{$name} = $n;
|
|
}
|
|
my $bad = 0;
|
|
for my $path (@files) {
|
|
(my $name = $path) =~ s{.*/}{};
|
|
my @cmd = (q{curl}, q{-sS}, q{-o}, q{/dev/null}, q{-w}, q{%{http_code}},
|
|
q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
|
|
q{-H}, q{Content-Type: application/octet-stream},
|
|
# The @ must not sit inside a qq{} string: there it starts an
|
|
# array interpolation and the upload body collapses to empty,
|
|
# which Gitea stores as a 201-created zero-byte attachment.
|
|
q{-X}, q{POST}, q{--data-binary}, q{@} . $path,
|
|
qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases/$id/assets?name=$name});
|
|
open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
|
|
my $code = <$curl>;
|
|
my $ok = close($curl);
|
|
my $exit = $? >> 8;
|
|
$code = defined $code ? $code : q{};
|
|
unless ($ok) {
|
|
printf qq{%s: curl failed (exit %d)\n}, $name, $exit;
|
|
$bad = 1;
|
|
next;
|
|
}
|
|
printf qq{%s: HTTP %s\n}, $name, $code;
|
|
$bad = 1 if $code ne q{201};
|
|
}
|
|
# Read every asset back through the release download route and require the
|
|
# served length to be the file that was sent: stored but empty is a broken
|
|
# release however green the run looks.
|
|
open(my $v, q{<}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
|
|
my $v = <$v>;
|
|
close($v);
|
|
chomp $v;
|
|
for my $name (sort keys %size) {
|
|
my $url = qq{$ENV{GITEA_SERVER_URL}/$ENV{GITEA_REPOSITORY}/releases/download/v$v/$name};
|
|
my @head = (q{curl}, q{-sS}, q{-I}, q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}}, $url);
|
|
open(my $h, q{-|}, @head) or die qq{curl: $!};
|
|
my $len;
|
|
my $status;
|
|
while (my $l = <$h>) {
|
|
$status = $1 if $l =~ m{^HTTP/\S+\s+(\d+)};
|
|
$len = $1 if $l =~ m{^content-length:\s*(\d+)}i;
|
|
}
|
|
my $ok = close($h);
|
|
$len = defined $len ? $len : 0;
|
|
if (!$ok || $status != 200 || $len != $size{$name}) {
|
|
printf qq{ERROR: %s serves %s bytes, expected %d\n}, $name, $len, $size{$name};
|
|
$bad = 1;
|
|
next;
|
|
}
|
|
printf qq{%s: serves %d bytes\n}, $name, $len;
|
|
}
|
|
exit($bad ? 1 : 0);
|
|
'
|