release #7
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Creates a GitHub Release. | |
| # Workflow is manually run. | |
| # Preselect branch or tag before running this workflow. | |
| name: release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| prerelease: | |
| description: "Mark this release as a prerelease" | |
| required: false | |
| default: "auto" | |
| type: choice | |
| # auto follows semver. Prerelease versions are hyphenated with a label. ex. 0.0.0-alpha, 1.0.0-rc1 | |
| options: | |
| - auto | |
| - "true" | |
| - "false" | |
| make-latest: | |
| description: "Latest release" | |
| required: false | |
| default: true | |
| type: boolean | |
| nightly: | |
| description: "Mark as nightly build" | |
| required: true | |
| default: true | |
| type: boolean | |
| permissions: | |
| contents: write | |
| id-token: write | |
| packages: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_CLI_EXPERIMENTAL: "enabled" | |
| strategy: | |
| matrix: | |
| release_os: | |
| - linux | |
| - darwin | |
| - freebsd | |
| - illumos | |
| - netbsd | |
| - openbsd | |
| - windows | |
| steps: | |
| - name: Disable release on nightly repository | |
| if: ${{ !inputs.nightly }} | |
| run: | | |
| if [ "$GITHUB_REPOSITORY" == "openbao/openbao-nightly" ]; then | |
| echo "Refusing to run non-nightly release on nightly repo" 1>&2 | |
| exit 1 | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@v4.1.7 | |
| with: | |
| fetch-depth: 0 # Required by GoRelease | |
| - name: Disable nightly on primary repository | |
| if: inputs.nightly | |
| env: | |
| PRERELEASE: ${{ inputs.prerelease }} | |
| run: | | |
| if [ "$GITHUB_REPOSITORY" != "openbao/openbao-nightly" ]; then | |
| echo "Refusing to run nightly release on non-nightly repo" 1>&2 | |
| exit 1 | |
| fi | |
| # Otherwise, create fake tags that we do not push; this limits the | |
| # size of the changelog. | |
| git tag v9999.9999.9998 HEAD~ | |
| git tag v9999.9999.9999-n"$(date +%Y%m%d)" | |
| - name: Golang Setup | |
| uses: ./.github/actions/set-up-go | |
| - name: go-check | |
| run: go version | |
| - name: Node setup | |
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| node-version-file: "./ui/package.json" | |
| - name: Yarn setup | |
| id: install-yarn | |
| run: | | |
| npm install -g yarn | |
| # Supports syft/sbom generation | |
| - uses: anchore/sbom-action/download-syft@v0 | |
| # Supports Buildx | |
| - name: Qemu Setup | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Buildx Setup | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Cosign Install | |
| uses: sigstore/cosign-installer@v3 | |
| - name: GPG Import | |
| id: gpg-import | |
| uses: crazy-max/ghaction-import-gpg@v6 | |
| with: | |
| gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.GPG_PASSWORD }} | |
| - name: Cache Setup | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ./dist/**/bao | |
| ./dist/**/*.exe | |
| ./dist/**/*.deb | |
| ./dist/**/*.rpm | |
| ./dist/*.tar.gz | |
| ./dist/*.tar.gz.zst | |
| ./dist/*.zip | |
| key: ${{ github.ref }} | |
| - name: "Docker Login: ghcr.io" | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: "Docker Login: docker.io" | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_TOKEN }} | |
| - name: "Docker Login: quay.io" | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_TOKEN }} | |
| # Needed for nPFM | |
| - name: Create GPG Signing Key File | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| run: | | |
| GPG_KEY_FILE=/tmp/signing-key.gpg | |
| echo "${{ secrets.GPG_PRIVATE_KEY_BASE64 }}" | base64 -di > "${GPG_KEY_FILE}" | |
| echo "GPG_KEY_FILE=${GPG_KEY_FILE}" >> "${GITHUB_ENV}" | |
| env: | |
| GPG_TTY: /dev/ttys000 # Set the GPG_TTY to avoid issues with pinentry | |
| # Before executing binary builds, build the UI. | |
| - name: Install UI dependencies | |
| id: ui-dependencies | |
| working-directory: ./ui | |
| run: | | |
| yarn install --frozen-lockfile | |
| npm rebuild node-sass | |
| - name: Build UI | |
| id: ui-build | |
| run: | | |
| make static-dist | |
| # Execute Go binary builds | |
| - name: "Template GoRelaser configuration" | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| run: | | |
| sed "s/REPLACE_WITH_RELEASE_GOOS/${{ matrix.release_os }}/g" .goreleaser-template.yaml > .goreleaser.yaml | |
| sed -i "s/^#OTHERARCH#//g" .goreleaser.yaml | |
| [ "${{ matrix.release_os }}" == "linux" ] && sed -i "s/^#LINUXONLY#//g" .goreleaser.yaml || true | |
| - name: "GoReleaser: Release" | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.nightly | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: latest | |
| args: release --clean --timeout=60m --verbose --parallelism 2 | |
| env: | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GPG_FINGERPRINT: ${{ steps.gpg-import.outputs.fingerprint }} | |
| GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }} | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| GITHUB_RELEASE_PRERELEASE: ${{ inputs.prerelease }} | |
| GITHUB_RELEASE_MAKE_LATEST: ${{ inputs.make-latest }} | |
| NFPM_DEFAULT_PASSPHRASE: ${{ secrets.GPG_PASSWORD }} | |
| NIGHTLY_RELEASE: ${{ inputs.nightly }} | |
| - name: Remove GPG Signing Key File | |
| if: always() | |
| run: | | |
| if [ -n "${GPG_KEY_FILE}" ]; then | |
| rm -rf "${GPG_KEY_FILE}" | |
| fi | |
| - name: "Check free space on runner" | |
| run: | | |
| df -h . |