Repository navigation
111 lines (107 loc) · 4.01 KB
/
Copy pathrelease.yml
File metadata and controls
111 lines (107 loc) · 4.01 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
name: Release
on:
push:
tags: ['v*']
permissions:
contents: read
jobs:
validate-build-qualify-package:
name: Validate, qualify, and package
permissions:
contents: read
runs-on: ubuntu-24.04
timeout-minutes: 360
env:
PROBEOS_QEMU_ACCEL: tcg
PROBEOS_QEMU_TIMEOUT: 600
PROBEOS_MEMTEST_TIMEOUT: 180
PROBEOS_LAN_TIMEOUT: 600
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Validate SemVer release tag
run: |
[[ "$GITHUB_REF_NAME" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
[[ "$(git rev-parse HEAD)" == "$GITHUB_SHA" ]]
- name: Install validation and qualification tools
run: sudo apt-get update && sudo apt-get install -y curl jq ovmf qemu-system-x86 shellcheck xorriso zstd
- name: Report QEMU acceleration
run: |
test ! -e /dev/kvm || ls -l /dev/kvm
echo "QEMU acceleration: $PROBEOS_QEMU_ACCEL (software emulation forced)"
- name: Run validation suite
run: ci/validate.sh
- name: Build normal artifacts
run: ci/build-all.sh
- name: Run required qualification
run: ci/qualify.sh
- name: Generate tagged binary metadata
run: ci/generate-release-metadata.sh
- name: Generate and validate complete corresponding source
run: |
compliance/generate.py
ci/validate-compliance.sh release
- name: Upload immutable qualified release set
uses: actions/upload-artifact@v7
with:
name: probeos-release-${{ github.sha }}
path: |
out/probeos-[0-9]*-x86_64-grub.iso
out/probeos-[0-9]*-x86_64-syslinux.iso
out/probeos-[0-9]*-x86-grub.iso
out/probeos-[0-9]*-x86-syslinux.iso
out/probeos-[0-9]*-source.tar.zst
out/SHA256SUMS
out/release-manifest.json
out/SOURCE-MANIFEST.json
out/THIRD-PARTY-MANIFEST.json
out/release-notes.md
if-no-files-found: error
compression-level: 0
retention-days: 14
- name: Upload diagnostic logs on failure
if: failure()
uses: actions/upload-artifact@v7
with:
name: probeos-release-failure-logs-${{ github.sha }}
path: ci-logs/
if-no-files-found: warn
retention-days: 14
publish:
name: Publish immutable qualified release set
needs: validate-build-qualify-package
permissions:
contents: write
runs-on: ubuntu-24.04
steps:
- name: Download qualified release set
uses: actions/download-artifact@v8
with:
name: probeos-release-${{ github.sha }}
path: out
- name: Verify and publish
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
run: |
version="${GITHUB_REF_NAME#v}"
(cd out && sha256sum -c SHA256SUMS)
jq -e --arg sha "$GITHUB_SHA" --arg version "$version" \
'.manifest_version==1 and .git_commit==$sha and .probeos_version==$version and
.build_channel=="release" and (.artifacts|length)==4' \
out/release-manifest.json >/dev/null
jq -e --arg sha "$GITHUB_SHA" --arg version "$version" \
'.manifest_version==1 and .git_commit==$sha and .probeos_version==$version' \
out/SOURCE-MANIFEST.json out/THIRD-PARTY-MANIFEST.json >/dev/null
gh release create "$GITHUB_REF_NAME" \
"out/probeos-$version-x86_64-grub.iso" \
"out/probeos-$version-x86_64-syslinux.iso" \
"out/probeos-$version-x86-grub.iso" \
"out/probeos-$version-x86-syslinux.iso" \
"out/probeos-$version-source.tar.zst" \
out/SHA256SUMS out/release-manifest.json \
out/SOURCE-MANIFEST.json out/THIRD-PARTY-MANIFEST.json \
out/release-notes.md \
--verify-tag --notes-file out/release-notes.md \
--title "ProbeOS $GITHUB_REF_NAME"