109 lines
4.4 KiB
YAML
109 lines
4.4 KiB
YAML
name: services/www - manual release
|
|
'on':
|
|
workflow_dispatch:
|
|
inputs:
|
|
tested_sha:
|
|
description: Full tested source commit
|
|
required: true
|
|
type: string
|
|
tested_digest:
|
|
description: OCI sha256 digest from the successful build
|
|
required: true
|
|
type: string
|
|
build_run_id:
|
|
description: Successful WWW build run ID
|
|
required: true
|
|
type: string
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
jobs:
|
|
release:
|
|
runs-on: apex-debian13
|
|
if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
|
|
&& github.actor == 'deytenit'
|
|
steps:
|
|
- run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
|
|
case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
|
|
AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
|
|
\ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
|
|
git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
|
|
\ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
|
|
git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
|
|
test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
|
|
\ = recursive ]; then\n key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
|
|
)\n trap 'rm -f \"$key_file\"' EXIT\n umask 077\n printf '%s\\n'\
|
|
\ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n chmod 600 \"$key_file\"\n export\
|
|
\ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
|
|
\ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
|
|
\n git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
|
|
\ = true ]; then\n git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
|
|
\ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
|
|
env:
|
|
CHECKOUT_REF: ${{ github.sha }}
|
|
CHECKOUT_SUBMODULES: 'false'
|
|
CHECKOUT_TOKEN: ${{ github.token }}
|
|
PERSIST_CREDENTIALS: 'false'
|
|
HEXTRA_READ_KEY: ''
|
|
- name: Authenticate local registry
|
|
run: python3 .gitea/scripts/docker.py login
|
|
env:
|
|
REGISTRY: git.ermnvldmr.com
|
|
REGISTRY_USER: deytenit
|
|
REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
|
|
- name: Verify successful build and immutable digest
|
|
id: provenance
|
|
run: python3 .gitea/scripts/provenance.py
|
|
env:
|
|
TESTED_SHA: ${{ inputs.tested_sha }}
|
|
TESTED_DIGEST: ${{ inputs.tested_digest }}
|
|
BUILD_RUN_ID: ${{ inputs.build_run_id }}
|
|
PROVENANCE_TOKEN: ${{ github.token }}
|
|
- name: Promote tested digest and create release tag
|
|
env:
|
|
TESTED_SHA: ${{ inputs.tested_sha }}
|
|
TESTED_DIGEST: ${{ inputs.tested_digest }}
|
|
BUILD_RUN_ID: ${{ inputs.build_run_id }}
|
|
PROVENANCE_TOKEN: ${{ github.token }}
|
|
GIT_WRITE_KEY: ${{ secrets.WWW_RELEASE_KEY }}
|
|
run: 'set -euo pipefail
|
|
|
|
VERSION=$(bash ci/scripts/calver-release.sh)
|
|
|
|
[[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
|
|
|
|
if git show-ref --verify --quiet "refs/tags/$VERSION"; then exit 1; fi
|
|
|
|
docker buildx imagetools create --prefer-index=false "git.ermnvldmr.com/deytenit/ermnvldmr.com/www@$TESTED_DIGEST"
|
|
--tag "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
|
|
|
|
test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
|
|
--format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"
|
|
|
|
git tag "$VERSION" "$TESTED_SHA"
|
|
|
|
python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"
|
|
|
|
export VERSION
|
|
|
|
mkdir -p .ci
|
|
|
|
python3 - <<''RELEASE_PROVENANCE''
|
|
|
|
import json, os
|
|
|
|
from pathlib import Path
|
|
|
|
Path(''.ci/www-release.json'').write_text(json.dumps({''sha'': os.environ[''TESTED_SHA''],
|
|
''digest'': os.environ[''TESTED_DIGEST''], ''run_id'': os.environ[''BUILD_RUN_ID''],
|
|
''repository'': ''deytenit/ermnvldmr.com'', ''release_tag'': os.environ[''VERSION'']}))
|
|
|
|
RELEASE_PROVENANCE
|
|
|
|
'
|
|
- uses: ./.gitea/actions/upload-artifact
|
|
with:
|
|
name: www-release-provenance
|
|
path: .ci/www-release.json
|
|
retention-days: 30
|