76 lines
2.3 KiB
YAML
76 lines
2.3 KiB
YAML
name: Publish launcher release status
|
|
|
|
on:
|
|
# Manual-release mode is active. Restore the status-file push trigger when
|
|
# automatic channel/history publication is wanted again.
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: launcher-release-publication
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
history:
|
|
name: Sign and publish release history
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Check out trusted release metadata
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.ref }}
|
|
|
|
- name: Validate release status configuration
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
for command in git bash curl jq python3 openssl base64 realpath stat
|
|
do
|
|
command -v "$command" >/dev/null || {
|
|
printf 'Required metadata command is unavailable: %s\n' "$command" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
python3 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)'
|
|
python3 -m compileall -q ptlinux scripts
|
|
python3 scripts/generate_history.py --help >/dev/null
|
|
bash -n scripts/publish-release-history.sh
|
|
|
|
- name: Materialize the protected manifest signing key
|
|
shell: bash
|
|
env:
|
|
MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${MANIFEST_SIGNING_KEY:-}" ]]
|
|
then
|
|
printf '%s\n' 'MANIFEST_SIGNING_KEY is required for metadata publication.' >&2
|
|
exit 1
|
|
fi
|
|
umask 077
|
|
SIGNING_KEY_FILE="${RUNNER_TEMP}/launcher-manifest-signing-key.pem"
|
|
printf '%s\n' "$MANIFEST_SIGNING_KEY" > "$SIGNING_KEY_FILE"
|
|
chmod 0600 "$SIGNING_KEY_FILE"
|
|
printf 'PTLINUX_SIGNING_KEY=%s\n' "$SIGNING_KEY_FILE" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish signed release status and history
|
|
shell: bash
|
|
env:
|
|
RELEASE_BRANCH: main
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
./scripts/publish-release-history.sh ./dist/status
|
|
|
|
- name: Remove signing key
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
if [[ -n "${PTLINUX_SIGNING_KEY:-}" ]]
|
|
then
|
|
rm -f -- "$PTLINUX_SIGNING_KEY"
|
|
fi
|