mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-08 16:20:29 +00:00
silverwindandLunny Xiao
7a9fccb842
The release job has imported the Teabot GPG key since https://gitea.com/gitea/runner/pulls/116, but `.goreleaser.yaml` never had a `signs:` block, so releases were never signed. Add it so `checksums.txt` gets a detached `checksums.txt.sig`, the same way https://gitea.com/gitea/cli signs its releases. The nightly job imports the key as well since the `signs:` block applies to nightly builds, and the R2 publisher mirrors the signature to dl.gitea.com. _Written by Claude (Opus 5.5)._ --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1382 Reviewed-by: Lunny Xiao <[email protected]>
115 lines
4.0 KiB
YAML
115 lines
4.0 KiB
YAML
---
|
|
name: release-nightly
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
tags:
|
|
- '*'
|
|
|
|
env:
|
|
DOCKER_ORG: gitea
|
|
|
|
jobs:
|
|
goreleaser:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
fetch-depth: 0
|
|
# Custom publishers (the R2 upload below) run as the very last
|
|
# step of goreleaser's publish pipeline, after the Gitea release
|
|
# has already been created. Fail here instead, before anything
|
|
# is built or published, if the R2 secrets are missing.
|
|
- name: check R2 configuration
|
|
run: sh scripts/upload-r2.sh --check-config
|
|
env:
|
|
R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
|
|
R2_BUCKET: ${{ secrets.R2_BUCKET }}
|
|
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
|
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
|
|
with:
|
|
go-version-file: "go.mod"
|
|
check-latest: true
|
|
- name: Import GPG key
|
|
id: import_gpg
|
|
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
|
|
with:
|
|
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
passphrase: ${{ secrets.PASSPHRASE }}
|
|
fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
|
|
- name: goreleaser
|
|
uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7
|
|
with:
|
|
distribution: goreleaser-pro
|
|
args: release --nightly
|
|
env:
|
|
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
|
|
R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
|
|
R2_BUCKET: ${{ secrets.R2_BUCKET }}
|
|
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
|
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
|
GORELEASER_FORCE_TOKEN: "gitea"
|
|
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
|
|
|
|
release-image:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
variant:
|
|
# The basic image is built from source and can target any arch the
|
|
# toolchain supports. The dind variants are limited to the arches the
|
|
# docker:dind base image publishes.
|
|
- target: basic
|
|
tag_suffix: ""
|
|
platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
|
|
- target: dind
|
|
tag_suffix: "-dind"
|
|
platforms: linux/amd64,linux/arm64
|
|
- target: dind-rootless
|
|
tag_suffix: "-dind-rootless"
|
|
platforms: linux/amd64,linux/arm64
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
fetch-depth: 0 # all history for all branches and tags
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
|
|
|
|
- name: Set up Docker BuildX
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Echo the tag
|
|
run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
|
|
|
|
- name: Get Meta
|
|
id: meta
|
|
run: |
|
|
echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
target: ${{ matrix.variant.target }}
|
|
platforms: ${{ matrix.variant.platforms }}
|
|
push: true
|
|
tags: |
|
|
${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
|
|
build-args: |
|
|
VERSION=${{ steps.meta.outputs.REPO_VERSION }}
|