1401.0 #2
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| run-name: ${{ github.ref_name }} | |
| on: | |
| push: | |
| tags: | |
| - '*' | |
| workflow_dispatch: | |
| inputs: | |
| today: | |
| type: boolean | |
| default: false | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| environment: aws | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: setup binfmt | |
| run: sudo podman run --privileged ghcr.io/gardenlinux/binfmt_container | |
| - uses: actions/checkout@v4 | |
| - name: download amd64 packages | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| container="$(cat .container)" | |
| podman pull --arch amd64 "$container" | |
| podman build -t build --build-arg base="$container" . | |
| mkdir repo | |
| podman run --rm -v "$PWD/repo:/repo" -v "$PWD/package-releases:/package-releases" -v "$PWD/package-imports:/package-imports" -e GH_TOKEN build /download_pkgs /repo /package-releases /package-imports | |
| - name: download arm64 packages | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| container="$(cat .container)" | |
| podman pull --arch arm64 "$container" | |
| podman build -t build --build-arg base="$container" . | |
| mkdir repo_arm64 | |
| podman run --rm -v "$PWD/repo_arm64:/repo" -v "$PWD/package-releases:/package-releases" -v "$PWD/package-imports:/package-imports" -e GH_TOKEN build /download_pkgs /repo /package-releases /package-imports | |
| mv --no-clobber repo_arm64/* repo/ | |
| rm -rf repo_arm64 | |
| - name: build kms signing container | |
| run: | | |
| podman build -t kms kms | |
| podman build -t build --build-arg base=kms . | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ vars.AWS_OIDC_ROLE }} | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - run: aws sts get-caller-identity | |
| - name: sync pool to S3 | |
| run: | | |
| find repo/pool -type f -printf '%P\n' | sort > local_objects | |
| aws s3api list-objects --bucket '${{ vars.S3_BUCKET }}' --prefix pool/ | jq -r '.Contents // [] | .[].Key' | sed 's#^pool/##' | sort > aws_objects | |
| join -v 1 local_objects aws_objects > new_objects | |
| rm local_objects aws_objects | |
| num_objects="$(wc -l new_objects | awk '{ print $1 }')" | |
| cntr=0 | |
| while read -r obj; do | |
| aws s3 cp --quiet "repo/pool/$obj" "s3://${{ vars.S3_BUCKET }}/pool/$obj" | |
| cntr="$(( cntr + 1 ))" | |
| echo "[$cntr/$num_objects] $obj" | |
| done < new_objects | |
| rm new_objects | |
| - name: check dist ${{ github.ref_name }} | |
| id: check | |
| run: | | |
| if aws s3api head-object --bucket '${{ vars.S3_BUCKET }}' --key 'gardenlinux/dists/${{ github.ref_name }}/InRelease' > /dev/null 2>&1; then | |
| echo skip=true >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: create dist ${{ github.ref_name }} | |
| if: ${{ ! steps.check.outputs.skip }} | |
| run: | | |
| podman run --rm \ | |
| -e 'AWS_*' \ | |
| -e 'KMS_KEY_ID=${{ secrets.KMS_KEY_ID }}' \ | |
| -e 'KMS_KEY_CERT=${{ secrets.KMS_KEY_CERT }}' \ | |
| -e 'KMS_KEY_GPG=${{ secrets.KMS_KEY_GPG }}' \ | |
| -v "$PWD/repo:/repo" \ | |
| build /create_dist /repo ${{ github.ref_name }} 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}' | |
| aws s3 cp --recursive 'repo/dists/${{ github.ref_name }}' 's3://${{ vars.S3_BUCKET }}/gardenlinux/dists/${{ github.ref_name }}' | |
| - name: create dist today | |
| if: inputs.today | |
| run: | | |
| podman run --rm \ | |
| -e 'AWS_*' \ | |
| -e 'KMS_KEY_ID=${{ secrets.KMS_KEY_ID }}' \ | |
| -e 'KMS_KEY_CERT=${{ secrets.KMS_KEY_CERT }}' \ | |
| -e 'KMS_KEY_GPG=${{ secrets.KMS_KEY_GPG }}' \ | |
| -v "$PWD/repo:/repo" \ | |
| build /create_dist /repo today 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}' | |
| aws s3 cp --recursive 'repo/dists/today' 's3://${{ vars.S3_BUCKET }}/gardenlinux/dists/today' |