Repository navigation
Merge dev: license, release notes fix #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Development ("edge") releases: every push to main or the development branch | |
| # publishes a signed GitHub release v<ver>-edge.<run>. Until the first stable | |
| # release (a tag vX.Y.Z, published by goreleaser in ci.yml) the edge release | |
| # of main is marked "latest", so the one-line installer works from GitHub (a | |
| # build of the development branch is always a pre-release): | |
| # | |
| # bash <(curl -fsSL https://github.com/localroot4/DeyRoute/releases/latest/download/install.sh) | |
| # | |
| # Once a stable tag exists, edge builds are numbered after it | |
| # (v1.0.1-edge.<run> after v1.0.0) and published as pre-releases that never | |
| # become "latest": the installer and `deyroute update` keep resolving to the | |
| # stable release. A given edge build installs with --version <ver>. | |
| # | |
| # Signing needs the repository secret MINISIGN_SECRET_KEY (the key whose public | |
| # half is internal/install.MinisignPublicKey). Without it the release step is | |
| # skipped with a notice instead of publishing unsigned files. | |
| name: release-edge | |
| on: | |
| push: | |
| branches: [main, dev] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-edge | |
| cancel-in-progress: true | |
| env: | |
| GOTOOLCHAIN: local | |
| BASE_VERSION: 0.3.0 | |
| jobs: | |
| edge: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: signing key present? | |
| id: key | |
| env: | |
| KEY: ${{ secrets.MINISIGN_SECRET_KEY }} | |
| run: | | |
| if [ -z "$KEY" ]; then | |
| echo "::notice::edge release skipped: add the repository secret MINISIGN_SECRET_KEY (see README)" | |
| echo "ok=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ok=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: actions/checkout@v4 | |
| if: steps.key.outputs.ok == 'true' | |
| with: { fetch-depth: 0 } # tags: the last stable version | |
| - uses: actions/setup-go@v5 | |
| if: steps.key.outputs.ok == 'true' | |
| with: { go-version: stable } | |
| - name: test | |
| if: steps.key.outputs.ok == 'true' | |
| run: go test -count=1 ./... | |
| - name: build | |
| if: steps.key.outputs.ok == 'true' | |
| run: | | |
| set -euo pipefail | |
| STABLE=$(git tag -l 'v*' --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true) | |
| if [ -n "$STABLE" ]; then | |
| IFS=. read -r major minor patch <<<"${STABLE#v}" | |
| BASE="${major}.${minor}.$((patch + 1))" LATEST=false | |
| else | |
| BASE="$BASE_VERSION" LATEST=true | |
| fi | |
| # Only main moves "latest" (the one-line installer); a build of the | |
| # development branch is a pre-release, installed with --version. | |
| if [ "$GITHUB_REF_NAME" != main ]; then LATEST=false; fi | |
| VERSION="${BASE}-edge.${GITHUB_RUN_NUMBER}" | |
| echo "VERSION=$VERSION" >> "$GITHUB_ENV" | |
| echo "LATEST=$LATEST" >> "$GITHUB_ENV" | |
| mkdir -p dist | |
| for arch in amd64 arm64; do | |
| d="dist/deyroute_${VERSION}_linux_${arch}" | |
| mkdir -p "$d" | |
| CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -trimpath \ | |
| -ldflags "-s -w -X main.version=${VERSION} -X main.commit=${GITHUB_SHA::7} -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ | |
| -o "$d/deyroute" ./cmd/deyroute | |
| cp README.md README.en.md CHANGELOG.md LICENSE "$d/" | |
| tar -C dist -czf "dist/deyroute_${VERSION}_linux_${arch}.tar.gz" "deyroute_${VERSION}_linux_${arch}" | |
| rm -rf "$d" | |
| done | |
| # CHANGELOG.md is published and listed in SHA256SUMS: `deyroute update` | |
| # shows the notes of the release before it asks (spec section 5). | |
| cp installer/install.sh internal/backend/backends.yaml CHANGELOG.md dist/ | |
| (cd dist && sha256sum deyroute_*.tar.gz install.sh backends.yaml CHANGELOG.md > SHA256SUMS) | |
| - name: sign | |
| if: steps.key.outputs.ok == 'true' | |
| env: | |
| MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }} | |
| MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }} | |
| run: | | |
| go run ./scripts/minisign sign -in dist/SHA256SUMS | |
| go run ./scripts/minisign sign -in dist/backends.yaml | |
| go run ./scripts/minisign verify -in dist/SHA256SUMS -pubkey "$(grep -o 'RW[A-Za-z0-9+/=]*' internal/install/keys.go)" | |
| - name: publish | |
| if: steps.key.outputs.ok == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| url="https://github.com/${GITHUB_REPOSITORY}/releases" | |
| if [ "$LATEST" = true ]; then | |
| flags=(--latest) | |
| install="bash <(curl -fsSL ${url}/latest/download/install.sh)" | |
| else | |
| flags=(--prerelease --latest=false) | |
| install="bash <(curl -fsSL ${url}/download/v${VERSION}/install.sh) --version ${VERSION}" | |
| fi | |
| title="DEYROUTE ${VERSION}" | |
| if [ "$LATEST" != true ]; then title="${title} (development build)"; fi | |
| repo="https://github.com/${GITHUB_REPOSITORY}" | |
| key=$(grep -o 'RW[A-Za-z0-9+/=]*' internal/install/keys.go) | |
| { | |
| echo "**Install on the hub (Iran server)** — نصب روی هاب (سرور ایران):" | |
| echo | |
| echo '```bash' | |
| echo "${install}" | |
| echo '```' | |
| echo | |
| echo "Already installed? Run \`deyroute update\` on the hub (the nodes follow), or let the automatic update install it at 04:00 server time." | |
| echo "قبلاً نصب کردهاید؟ روی هاب \`deyroute update\` بزنید (نودها خودشان دنبال میکنند)، یا بگذارید آپدیت خودکار ساعت ۴ صبح نصبش کند." | |
| echo | |
| echo "## What's new" | |
| echo | |
| # The newest three sections of the changelog; the rest is linked. | |
| # One awk reading the file: an early exit in a pipe is SIGPIPE | |
| # under pipefail. | |
| awk '/^## \[Unreleased\]/{on=1; next} | |
| on && /^## \[/{exit} | |
| on { if (!seen && /^$/) next; seen=1; if (/^### /) n++; if (n > 3) exit; print }' CHANGELOG.md | |
| echo | |
| echo "[Full changelog](${repo}/blob/${GITHUB_SHA}/CHANGELOG.md) · [راهنمای فارسی](${repo}/blob/main/docs/fa/index.md) · [English guides](${repo}/blob/main/docs/en/index.md)" | |
| echo | |
| echo "## Verify" | |
| echo | |
| echo "\`SHA256SUMS\` is signed with minisign; the installer and \`deyroute update\` check it before anything is installed. Public key: \`${key}\`" | |
| echo | |
| echo "Built from \`${GITHUB_SHA::7}\` (Linux amd64 and arm64, static binary)." | |
| } > dist/NOTES.md | |
| gh release create "v${VERSION}" dist/*.tar.gz dist/SHA256SUMS dist/SHA256SUMS.minisig \ | |
| dist/install.sh dist/backends.yaml dist/backends.yaml.minisig dist/CHANGELOG.md \ | |
| --target "$GITHUB_SHA" "${flags[@]}" \ | |
| --title "$title" \ | |
| --notes-file dist/NOTES.md | |
| # Keep only the 5 newest edge releases. | |
| gh release list --limit 100 --json tagName,createdAt \ | |
| --jq '[.[] | select(.tagName | test("-edge\\."))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName' | | |
| while read -r tag; do gh release delete "$tag" --cleanup-tag --yes; done |