Repository navigation
Merge dev: status head, pending node sync #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Development ("edge") releases: every push to main or the development branch | |
| # publishes a signed GitHub release v<ver>-edge.<run>. Until the first stable | |
| # release (a tag vX.Y.Z, published by goreleaser in ci.yml) the edge release | |
| # of main is marked "latest", so the one-line installer works from GitHub (a | |
| # build of the development branch is always a pre-release): | |
| # | |
| # bash <(curl -fsSL https://github.com/localroot4/DeyRoute/releases/latest/download/install.sh) | |
| # | |
| # Once a stable tag exists, edge builds are numbered after it | |
| # (v1.0.1-edge.<run> after v1.0.0) and published as pre-releases that never | |
| # become "latest": the installer and `deyroute update` keep resolving to the | |
| # stable release. A given edge build installs with --version <ver>. | |
| # | |
| # Signing needs the repository secret MINISIGN_SECRET_KEY (the key whose public | |
| # half is internal/install.MinisignPublicKey). Without it the release step is | |
| # skipped with a notice instead of publishing unsigned files. | |
| name: release-edge | |
| on: | |
| push: | |
| branches: [main, dev] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-edge | |
| cancel-in-progress: true | |
| env: | |
| GOTOOLCHAIN: local | |
| BASE_VERSION: 0.3.0 | |
| jobs: | |
| edge: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: signing key present? | |
| id: key | |
| env: | |
| KEY: ${{ secrets.MINISIGN_SECRET_KEY }} | |
| run: | | |
| if [ -z "$KEY" ]; then | |
| echo "::notice::edge release skipped: add the repository secret MINISIGN_SECRET_KEY (see README)" | |
| echo "ok=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ok=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: actions/checkout@v4 | |
| if: steps.key.outputs.ok == 'true' | |
| with: { fetch-depth: 0 } # tags: the last stable version | |
| - uses: actions/setup-go@v5 | |
| if: steps.key.outputs.ok == 'true' | |
| with: { go-version: stable } | |
| - name: test | |
| if: steps.key.outputs.ok == 'true' | |
| run: go test -count=1 ./... | |
| - name: build | |
| if: steps.key.outputs.ok == 'true' | |
| run: | | |
| set -euo pipefail | |
| STABLE=$(git tag -l 'v*' --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true) | |
| if [ -n "$STABLE" ]; then | |
| IFS=. read -r major minor patch <<<"${STABLE#v}" | |
| BASE="${major}.${minor}.$((patch + 1))" LATEST=false | |
| else | |
| BASE="$BASE_VERSION" LATEST=true | |
| fi | |
| # Only main moves "latest" (the one-line installer); a build of the | |
| # development branch is a pre-release, installed with --version. | |
| if [ "$GITHUB_REF_NAME" != main ]; then LATEST=false; fi | |
| VERSION="${BASE}-edge.${GITHUB_RUN_NUMBER}" | |
| echo "VERSION=$VERSION" >> "$GITHUB_ENV" | |
| echo "LATEST=$LATEST" >> "$GITHUB_ENV" | |
| mkdir -p dist | |
| for arch in amd64 arm64; do | |
| d="dist/deyroute_${VERSION}_linux_${arch}" | |
| mkdir -p "$d" | |
| CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -trimpath \ | |
| -ldflags "-s -w -X main.version=${VERSION} -X main.commit=${GITHUB_SHA::7} -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ | |
| -o "$d/deyroute" ./cmd/deyroute | |
| cp README.md README.en.md CHANGELOG.md "$d/" | |
| tar -C dist -czf "dist/deyroute_${VERSION}_linux_${arch}.tar.gz" "deyroute_${VERSION}_linux_${arch}" | |
| rm -rf "$d" | |
| done | |
| # CHANGELOG.md is published and listed in SHA256SUMS: `deyroute update` | |
| # shows the notes of the release before it asks (spec section 5). | |
| cp installer/install.sh internal/backend/backends.yaml CHANGELOG.md dist/ | |
| (cd dist && sha256sum deyroute_*.tar.gz install.sh backends.yaml CHANGELOG.md > SHA256SUMS) | |
| - name: sign | |
| if: steps.key.outputs.ok == 'true' | |
| env: | |
| MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }} | |
| MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }} | |
| run: | | |
| go run ./scripts/minisign sign -in dist/SHA256SUMS | |
| go run ./scripts/minisign sign -in dist/backends.yaml | |
| go run ./scripts/minisign verify -in dist/SHA256SUMS -pubkey "$(grep -o 'RW[A-Za-z0-9+/=]*' internal/install/keys.go)" | |
| - name: publish | |
| if: steps.key.outputs.ok == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| url="https://github.com/${GITHUB_REPOSITORY}/releases" | |
| if [ "$LATEST" = true ]; then | |
| flags=(--latest) | |
| install="bash <(curl -fsSL ${url}/latest/download/install.sh)" | |
| else | |
| flags=(--prerelease --latest=false) | |
| install="bash <(curl -fsSL ${url}/download/v${VERSION}/install.sh) --version ${VERSION}" | |
| fi | |
| gh release create "v${VERSION}" dist/*.tar.gz dist/SHA256SUMS dist/SHA256SUMS.minisig \ | |
| dist/install.sh dist/backends.yaml dist/backends.yaml.minisig dist/CHANGELOG.md \ | |
| --target "$GITHUB_SHA" "${flags[@]}" \ | |
| --title "DEYROUTE ${VERSION} (development build)" \ | |
| --notes "Development build of ${GITHUB_REF_NAME} at ${GITHUB_SHA::7}. Install: ${install}" | |
| # Keep only the 5 newest edge releases. | |
| gh release list --limit 100 --json tagName,createdAt \ | |
| --jq '[.[] | select(.tagName | test("-edge\\."))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName' | | |
| while read -r tag; do gh release delete "$tag" --cleanup-tag --yes; done |