100 lines
5.4 KiB
YAML
100 lines
5.4 KiB
YAML
name: Stable release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
canary_tag:
|
|
description: Successful immutable canary tag to promote
|
|
type: string
|
|
required: true
|
|
|
|
concurrency:
|
|
group: tensamin-central-releases
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: nixos
|
|
env:
|
|
NIX_CONFIG: experimental-features = nix-command flakes
|
|
FORGEJO_SERVER_URL: ${{ forgejo.server_url }}
|
|
FORGEJO_REPOSITORY: ${{ forgejo.repository }}
|
|
FORGEJO_RUN_ID: ${{ forgejo.run_id }}
|
|
RELEASE_CHANNEL: stable
|
|
RELEASE_TOKEN: ${{ secrets.TENSAMIN_RELEASE_TOKEN }}
|
|
FORGEJO_REGISTRY_USER: ${{ vars.FORGEJO_REGISTRY_USER }}
|
|
IOTA_RELEASE_SIGNING_KEY: ${{ secrets.IOTA_RELEASE_SIGNING_KEY }}
|
|
IOTA_RELEASE_PUBLIC_KEY: ${{ vars.IOTA_RELEASE_PUBLIC_KEY }}
|
|
IOTA_RELEASE_SIGNING_KEY_ID: ${{ vars.IOTA_RELEASE_SIGNING_KEY_ID || 'primary' }}
|
|
IOTA_BASE_VERSION: ${{ vars.IOTA_BASE_VERSION || '0.1.0' }}
|
|
NIXOS_FLAKE_REPOSITORY: ${{ vars.NIXOS_FLAKE_REPOSITORY }}
|
|
NIXOS_FLAKE_BRANCH: ${{ vars.NIXOS_FLAKE_BRANCH || 'main' }}
|
|
NIXOS_FLAKE_WRITE_TOKEN: ${{ secrets.NIXOS_FLAKE_WRITE_TOKEN }}
|
|
TENSAMIN_PROD_DEPLOY_SSH_KEY: ${{ secrets.TENSAMIN_PROD_DEPLOY_SSH_KEY }}
|
|
TENSAMIN_PROD_DEPLOY_HOST: ${{ vars.TENSAMIN_PROD_DEPLOY_HOST }}
|
|
TENSAMIN_PROD_DEPLOY_PORT: ${{ vars.TENSAMIN_PROD_DEPLOY_PORT || '22' }}
|
|
TENSAMIN_PROD_DEPLOY_JUMP_HOST: ${{ vars.TENSAMIN_PROD_DEPLOY_JUMP_HOST }}
|
|
TENSAMIN_PROD_DEPLOY_JUMP_PORT: ${{ vars.TENSAMIN_PROD_DEPLOY_JUMP_PORT || '7930' }}
|
|
TENSAMIN_SSH_KNOWN_HOSTS: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
|
|
steps:
|
|
- uses: https://data.forgejo.org/actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- name: Bootstrap pinned tools and source credentials
|
|
uses: ./.forgejo/workflows/source-access
|
|
with:
|
|
source-key: ${{ secrets.TENSAMIN_SOURCE_SSH_KEY }}
|
|
known-hosts: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
|
|
- name: Select successful canary for stable
|
|
env:
|
|
CANARY_TAG: ${{ inputs.canary_tag }}
|
|
run: python3 scripts/release.py select --tag "$CANARY_TAG"
|
|
- name: Set immutable release identity
|
|
run: |
|
|
set -euo pipefail
|
|
printf 'RELEASE_SEQUENCE=%s\nRELEASE_TAG=stable-%s-%s\n' "$(date +%s)" "$(git rev-parse HEAD)" "$FORGEJO_RUN_ID" >> "$GITHUB_ENV"
|
|
- name: Check central release scripts
|
|
run: |
|
|
set -euo pipefail
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command shellcheck scripts/release-build.sh scripts/release-client.sh
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command ruff check scripts/release.py scripts/deploy-release.py
|
|
- name: Validate and build all central packages and client assets
|
|
run: |
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-out
|
|
- name: Attempt aarch64 build with available builders
|
|
run: |
|
|
set -euo pipefail
|
|
if ! nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-arm aarch64-linux > arm-build.log 2>&1; then
|
|
printf 'aarch64 unavailable. See the attached arm-build.log.\n' > release-out/aarch64-unavailable.txt
|
|
cp arm-build.log release-out/
|
|
else
|
|
cp release-arm/*linux-aarch64* release-out/
|
|
cp release-arm/*arm64* release-out/
|
|
cp release-arm/electron-release-metadata-aarch64.json release-out/
|
|
fi
|
|
- name: Sign manifests and validate installer bundles
|
|
run: |
|
|
set -euo pipefail
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py sign --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py provenance --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
|
|
- name: Preserve combined build artifacts
|
|
uses: https://data.forgejo.org/actions/upload-artifact@v3
|
|
with:
|
|
name: combined-release
|
|
path: release-out/
|
|
- name: Stage and verify draft attachments
|
|
run: |
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py stage --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
|
|
- name: Commit infrastructure lock, deploy, check health and publish stable
|
|
run: |
|
|
nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/deploy-release.py
|
|
- name: Remove source credentials
|
|
if: always()
|
|
run: |
|
|
if [[ -n ${SSH_AGENT_PID:-} ]]; then kill "$SSH_AGENT_PID"; fi
|
|
rm -rf "$RUNNER_TEMP/tensamin-source"
|