57_WolveandClaude Opus 5
73d5d2f3f1
v1.10.0 carries upstream CVE fixes that the older releases predate, so stop building them. Their series move to patches/archive/<tag>/ rather than being deleted — still available for a deliberate rebuild, just not shipped — and ci/support-matrix.yaml now lists v1.10.0 alone. Dropping the matrix entries was not enough on its own. Two gaps made "not built" untrue: * apply-patches.sh only consulted the matrix `if command -v yq`, and the stock golang CI container has no yq — so in CI the registry was never actually read. The tag fell through to patches/<tag> every time. * An empty or missing patch directory was a warning and exit 0, i.e. "building vanilla upstream". Archiving the directories would therefore have made a dispatch for v1.8.0 publish an un-de-branded, unpatched, CVE-vulnerable build under this project's release name — the exact outcome we are trying to prevent. So the matrix is now an enforced allowlist: a tag it does not list exits 1, as does a patch directory with no patches in it. It is parsed with yq when present and with a small awk parse otherwise, so the allowlist holds in the CI container too. If the parse ever broke, an unmatched tag is refused rather than built, so the failure mode stays closed. PATCH_DIR remains the one bypass, and is now the documented way to rebuild an archived series on purpose. That path also needed a fix: the patch list is globbed before we cd into the source tree, so a relative PATCH_DIR — the form the new error message suggests — globbed fine and then failed in git am. PATCH_DIR is now resolved to an absolute path, with a missing directory reported as such. Also re-pointed the runnable examples in README.md, ci/run.sh and the workflow's dispatch hint from v1.5.0 to v1.10.0; following them verbatim would now hit the refusal. Verified by exercising every branch: v1.10.0 applies; v1.8.0 is refused with exit 1; PATCH_DIR=patches/archive/v1.8.0 rebuilds the archived series; an empty directory and a nonexistent one are both refused. The awk parser was checked against defaulted `patches:` fields, several tags sharing one directory, and comment lines containing decoy `- tag:` text. All seven archived patch files are recorded as pure renames. Note: existing published releases for the retired versions stay downloadable until deleted by hand in Gitea. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
87 lines
3.3 KiB
YAML
87 lines
3.3 KiB
YAML
name: build
|
|
|
|
# One version per run. Two ways in, no cron:
|
|
# - push a vX.Y.Z tag to this repo -> builds upstream versitygw vX.Y.Z
|
|
# - run manually (workflow_dispatch) -> builds the tag you enter
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Upstream versitygw tag to build (must be listed in ci/support-matrix.yaml, e.g. v1.10.0)"
|
|
required: true
|
|
|
|
jobs:
|
|
build:
|
|
# Any Linux runner — the Go toolchain comes from the golang
|
|
# container below, so the runner only needs Docker.
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: golang:latest
|
|
options: --user 0:0
|
|
|
|
steps:
|
|
- name: Checkout CI scripts + patches
|
|
env:
|
|
# Stored Gitea PAT. read:repository is enough to clone this
|
|
# repo; the publish step needs write:repository.
|
|
GITEA_TOKEN: ${{ secrets.TOKEN_GITEA }}
|
|
run: |
|
|
set -eu
|
|
apt-get update -y >/dev/null
|
|
apt-get install -y --no-install-recommends git curl jq ca-certificates >/dev/null
|
|
if [ -z "${GITEA_TOKEN:-}" ]; then
|
|
echo "ERROR: secrets.TOKEN_GITEA is empty or not visible to this run." >&2
|
|
echo "Create it under: Repo -> Settings -> Actions -> Secrets" >&2
|
|
exit 1
|
|
fi
|
|
SERVER_HOST="${GITHUB_SERVER_URL#http://}"; SERVER_HOST="${SERVER_HOST#https://}"
|
|
SCHEME="${GITHUB_SERVER_URL%%://*}"
|
|
git config --global \
|
|
url."${SCHEME}://x-access-token:${GITEA_TOKEN}@${SERVER_HOST}/".insteadOf \
|
|
"${SCHEME}://${SERVER_HOST}/"
|
|
# On a tag push GITHUB_REF_NAME is the tag (carries the matching
|
|
# patches/<tag>/); on dispatch it's the default branch.
|
|
git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" \
|
|
"${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" /tmp/ci-repo
|
|
cp -a /tmp/ci-repo/ci /tmp/ci-repo/patches .
|
|
chmod +x ci/*.sh
|
|
|
|
- name: Install GoReleaser
|
|
run: |
|
|
set -eu
|
|
curl -fsSL https://github.com/goreleaser/goreleaser/releases/latest/download/goreleaser_Linux_x86_64.tar.gz \
|
|
| tar -xz -C /usr/local/bin goreleaser
|
|
goreleaser --version | head -1
|
|
|
|
- name: Clone upstream versitygw
|
|
env:
|
|
VGW_REPO_URL: ${{ vars.VGW_REPO_URL || 'https://github.com/versity/versitygw.git' }}
|
|
# Empty on a tag push -> clone-source.sh falls back to the
|
|
# pushed tag. Set on dispatch -> builds exactly that tag.
|
|
VGW_TAG: ${{ inputs.tag }}
|
|
run: bash ci/clone-source.sh
|
|
|
|
# apply / build / publish read VGW_TAG, VGW_SRC_DIR and VGW_DIST_DIR
|
|
# from $GITHUB_ENV, which clone-source.sh / build.sh populate.
|
|
- name: Apply de-brand patches
|
|
run: bash ci/apply-patches.sh
|
|
|
|
- name: Build release artifacts
|
|
run: bash ci/build.sh
|
|
|
|
- name: Publish to Gitea release
|
|
env:
|
|
GITEA_API_URL: ${{ github.server_url }}/api/v1
|
|
GITEA_OWNER: ${{ github.repository_owner }}
|
|
GITEA_REPO: ${{ github.event.repository.name }}
|
|
# Needs write:repository to create releases + upload assets.
|
|
GITEA_TOKEN: ${{ secrets.TOKEN_GITEA }}
|
|
run: bash ci/publish-release.sh
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: ls -1 src/dist/*.tar.gz src/dist/*.deb src/dist/*.rpm 2>/dev/null || true
|