mirror of
https://github.com/ivabus/pantry
synced 2024-11-14 12:35:10 +03:00
257 lines
9 KiB
YAML
257 lines
9 KiB
YAML
name: bottle
|
||
|
||
on:
|
||
workflow_call:
|
||
inputs:
|
||
new-version:
|
||
type: boolean
|
||
required: false
|
||
default: false
|
||
|
||
jobs:
|
||
bottle:
|
||
runs-on: ${{ matrix.platform.os }}
|
||
defaults:
|
||
run:
|
||
working-directory: tea.xyz/var/pantry
|
||
strategy:
|
||
matrix:
|
||
platform:
|
||
- os: macos-11
|
||
name: darwin+x86-64
|
||
- os: ubuntu-latest
|
||
name: linux+x86-64
|
||
- os: [self-hosted, macOS, ARM64]
|
||
name: darwin+aarch64
|
||
- os: [self-hosted, linux, ARM64]
|
||
name: linux+aarch64
|
||
outputs:
|
||
srcs: ${{ env.srcs }}
|
||
built: ${{ env.built }}
|
||
pr: ${{ env.PR }}
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
with:
|
||
path: tea.xyz/var/cli
|
||
repository: teaxyz/cli
|
||
|
||
- uses: actions/checkout@v3
|
||
with:
|
||
path: pantry
|
||
|
||
- uses: teaxyz/setup@v0
|
||
id: tea
|
||
with:
|
||
srcroot: tea.xyz/var/pantry
|
||
prefix: ${{ github.workspace }}
|
||
|
||
- run: |
|
||
# in case this PR contains updates to the scripts
|
||
#TODO only do for PRs
|
||
if test "$GITHUB_REPOSITORY" = "teaxyz/pantry.core"; then
|
||
cp -rv $GITHUB_WORKSPACE/pantry/scripts/* $(tea --prefix)/tea.xyz/var/pantry/scripts
|
||
fi
|
||
|
||
- uses: actions/download-artifact@v3
|
||
if: ${{ inputs.new-version }}
|
||
with:
|
||
name: ${{ matrix.platform.name }}
|
||
path: tea.xyz/var/pantry
|
||
|
||
- run: scripts/fetch-pr-artifacts.ts ${{ github.repository }} ${{ github.sha }} ${{ matrix.platform.name }} >>$GITHUB_ENV
|
||
if: ${{ !inputs.new-version }}
|
||
env:
|
||
GITHUB_TOKEN: ${{github.token}}
|
||
AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
|
||
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||
|
||
- run: tar xzf artifacts.tgz -C ${{ steps.tea.outputs.prefix }}
|
||
|
||
- run: |
|
||
for file in built relative-paths srcs; do
|
||
echo "$file=$(cat $file)" >>$GITHUB_ENV
|
||
done
|
||
working-directory: ${{ steps.tea.outputs.prefix }}
|
||
|
||
# the next three steps bless our code for Apple. It might be the case they should be
|
||
# encapulated separately.
|
||
# FIXME: using an explicit commit in a PR isn't great, but the last release was almost 3 years
|
||
# ago, and we need bugfixes.
|
||
# FIXME: replace this with a tea script based on https://localazy.com/blog/how-to-automatically-sign-macos-apps-using-github-actions
|
||
# github has a doc with similar content, but it's not returning to me atm.
|
||
- uses: apple-actions/import-codesign-certs@d54750db52a4d3eaed0fc107a8bab3958f3f7494
|
||
if: matrix.platform.name == 'darwin+aarch64' || matrix.platform.name == 'darwin+x86-64'
|
||
with:
|
||
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
|
||
p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
|
||
|
||
# Codesign libs and bins
|
||
- name: Codesign package
|
||
if: matrix.platform.name == 'darwin+aarch64' || matrix.platform.name == 'darwin+x86-64'
|
||
run: |
|
||
for PKG in ${{ env.relative-paths }}; do
|
||
find /opt/$PKG -name '*.so' -or -name '*.dylib' -print0 | \
|
||
xargs -0 codesign -s "Developer ID Application: Tea Inc. (7WV56FL599)" --force -v --deep --timestamp --preserve-metadata=entitlements -o runtime || true
|
||
codesign -s "Developer ID Application: Tea Inc. (7WV56FL599)" -v --force --deep --timestamp --preserve-metadata=entitlements -o runtime /opt/$PKG/bin/* || true
|
||
done
|
||
working-directory: ${{ steps.tea.outputs.prefix }}
|
||
|
||
# This isn't very informative, but even a no-op is safer than none
|
||
- name: Check codesigning
|
||
if: matrix.platform.name == 'darwin+aarch64' || matrix.platform.name == 'darwin+x86-64'
|
||
run: |
|
||
for PKG in ${{ env.relative-paths }}; do
|
||
for SIG in `find /opt/$PKG -name '*.so' -or -name '*.dylib'` `find /opt/$PKG/bin -type f`; do
|
||
codesign -vvv --deep --strict "$SIG"
|
||
done
|
||
done
|
||
working-directory: ${{ steps.tea.outputs.prefix }}
|
||
|
||
# Needed for self-hosted runner, since it doesn't destroy itself automatically.
|
||
- name: Delete keychain
|
||
if: always() && matrix.platform.name == 'darwin+aarch64'
|
||
run: security delete-keychain signing_temp.keychain
|
||
|
||
- run: |
|
||
tea +gnupg.org gpg-agent --daemon || true
|
||
echo $GPG_PRIVATE_KEY | \
|
||
base64 -d | \
|
||
tea +gnupg.org gpg --import --batch --yes
|
||
env:
|
||
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
||
|
||
- run: scripts/bottle.ts $built
|
||
id: bottle-xz
|
||
env:
|
||
COMPRESSION: xz
|
||
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
|
||
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
||
|
||
- run: scripts/bottle.ts $built
|
||
id: bottle-gz
|
||
env:
|
||
COMPRESSION: gz
|
||
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
|
||
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
||
|
||
- run: |
|
||
echo ${{ steps.bottle-gz.outputs.bottles }} ${{ steps.bottle-xz.outputs.bottles }} >bottles
|
||
echo ${{ steps.bottle-gz.outputs.checksums }} ${{ steps.bottle-xz.outputs.checksums }} >checksums
|
||
echo ${{ steps.bottle-gz.outputs.signatures }} ${{ steps.bottle-xz.outputs.signatures }} >signatures
|
||
|
||
SRCS=$(echo $srcs | tr -d '~')
|
||
|
||
tar cf $GITHUB_WORKSPACE/artifacts.tar \
|
||
$SRCS \
|
||
${{ steps.bottle-gz.outputs.bottles }} \
|
||
${{ steps.bottle-xz.outputs.bottles }} \
|
||
bottles checksums signatures
|
||
|
||
working-directory: ${{ steps.tea.outputs.prefix }}
|
||
|
||
- name: upload artifacts
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: ${{ matrix.platform.name }}-bottles
|
||
path: artifacts.tar
|
||
if-no-files-found: error
|
||
|
||
upload:
|
||
needs: [bottle]
|
||
runs-on: ubuntu-latest
|
||
defaults:
|
||
run:
|
||
working-directory: tea.xyz/var/pantry
|
||
strategy:
|
||
matrix:
|
||
platform:
|
||
- os: macos-11
|
||
name: darwin+x86-64
|
||
- os: ubuntu-latest
|
||
name: linux+x86-64
|
||
- os: [self-hosted, macOS, ARM64]
|
||
name: darwin+aarch64
|
||
- os: [self-hosted, linux, ARM64]
|
||
name: linux+aarch64
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
with:
|
||
path: tea.xyz/var/cli
|
||
repository: teaxyz/cli
|
||
|
||
- uses: actions/checkout@v3
|
||
with:
|
||
path: pantry
|
||
|
||
- uses: teaxyz/setup@v0
|
||
id: tea
|
||
with:
|
||
srcroot: tea.xyz/var/pantry
|
||
prefix: ${{ github.workspace }}
|
||
|
||
- uses: actions/download-artifact@v3
|
||
with:
|
||
name: ${{ matrix.platform.name }}-bottles
|
||
|
||
- run: |
|
||
tar xvf $GITHUB_WORKSPACE/artifacts.tar
|
||
|
||
for file in bottles checksums signatures; do
|
||
echo "$file=$(cat $file)" >>$GITHUB_ENV
|
||
done
|
||
working-directory: ${{ steps.tea.outputs.prefix }}
|
||
|
||
- run: |
|
||
# in case this PR contains updates to the scripts
|
||
#TODO only do for PRs
|
||
if test "$GITHUB_REPOSITORY" = "teaxyz/pantry.core"; then
|
||
cp -rv $GITHUB_WORKSPACE/pantry/scripts/* $(tea --prefix)/tea.xyz/var/pantry/scripts
|
||
fi
|
||
|
||
- name: upload bottles
|
||
id: upload
|
||
run: scripts/upload.ts
|
||
--pkgs ${{ needs.bottle.outputs.built }} ${{ needs.bottle.outputs.built }}
|
||
--srcs ${{ needs.bottle.outputs.srcs }} ${{ needs.bottle.outputs.srcs }}
|
||
--bottles $bottles
|
||
--checksums $checksums
|
||
--signatures $signatures
|
||
env:
|
||
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
|
||
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||
|
||
#NOTE ideally we’d invalidate all at once so this is atomic
|
||
# however GHA can’t consolidate outputs from a matrix :/
|
||
- uses: chetan/invalidate-cloudfront-action@v2
|
||
env:
|
||
PATHS: ${{ steps.upload.outputs.cf-invalidation-paths }}
|
||
DISTRIBUTION: ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
|
||
AWS_REGION: us-east-1
|
||
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||
|
||
cleanup:
|
||
runs-on: ubuntu-latest
|
||
needs: [bottle, upload]
|
||
if: ${{ !inputs.new-version }}
|
||
steps:
|
||
- name: Configure AWS Credentials
|
||
uses: aws-actions/configure-aws-credentials@v1
|
||
with:
|
||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||
aws-region: us-east-1
|
||
- run: |
|
||
REPO=$(echo ${{github.repository}} | sed -e 's_teaxyz/__')
|
||
|
||
if test -z "$PR"; then
|
||
echo "no PR to clean up"
|
||
exit 0
|
||
fi
|
||
|
||
aws s3 rm --recursive s3://$AWS_S3_CACHE/pull-request/$REPO/$PR
|
||
env:
|
||
AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
|
||
PR: ${{ needs.bottle.outputs.pr }}
|