Stop publishing hub/Android binaries via ORAS

.github/workflows/ci.yml

@@ -32,8 +32,10 @@ jobs:
       - name: Install minisign
         run: sudo apt-get update && sudo apt-get install -y minisign
 
-      - name: Smoke-test minisign-sign.sh
-        run: ./scripts/test-minisign-sign.sh
+      - name: Smoke-test minisign-sign
+        env:
+          GOPROXY: direct
+        run: go test -count=1 github.com/dcc-bigfred/common/internal/minisignsign@latest
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -131,37 +133,3 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  publish-oci:
-    name: Publish OCI artifacts to GHCR (ORAS)
-    needs: build
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish loco-server-android-arm64
-        run: ./scripts/publish-oci-loco-android.sh dist/loco-server-android-arm64
-
-      - name: Publish bigfred-hub-linux-arm64
-        if: github.ref == 'refs/heads/master'
-        run: ./scripts/publish-oci-bigfred-hub.sh dist/loco-server-linux-arm64 dist/bigfred-remote-icmp-linux-arm64

.github/workflows/release.yml

@@ -65,15 +65,29 @@ jobs:
             --name binaries \
             --dir release-assets
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Install cross objcopy for arm64 ELF rewrite
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends binutils-aarch64-linux-gnu
+
       - name: Inject release version into ELF binaries
+        env:
+          GOPROXY: direct
         run: |
           set -euo pipefail
           TAG="${GITHUB_REF_NAME}"
           COMMIT="${GITHUB_SHA::7}"
+          INJECT="github.com/dcc-bigfred/common/cmd/inject-elf-version@latest"
           find release-assets -type f -print0 | while IFS= read -r -d '' f; do
             # Only ELF binaries carry the section (skip .exe if present).
             if file -b "$f" | grep -qi 'ELF'; then
-              ./scripts/inject-elf-version.sh "$f" "$TAG" "$COMMIT"
+              go run "${INJECT}" "$f" "$TAG" "$COMMIT" .bigfred.version
             else
               echo "skip (not ELF): $f"
             fi
@@ -101,7 +115,8 @@ jobs:
             exit 1
           fi
           # Signs and verifies each artifact against committed minisign.pub.
-          ./scripts/minisign-sign.sh "${FILES[@]}"
+          export GOPROXY="${GOPROXY:-direct}"
+          go run github.com/dcc-bigfred/common/cmd/minisign-sign@latest "${FILES[@]}"
 
       - name: Create release if missing
         env:
@@ -130,24 +145,3 @@ jobs:
           fi
           gh release upload "$TAG" "${FILES[@]}" --clobber
 
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Retag loco-server Android OCI artifact from main
-        env:
-          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
-          MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }}
-        run: ./scripts/retag-oci-loco-android.sh "${GITHUB_REF_NAME}"
-
-      - name: Retag hub linux/arm64 OCI artifact from master
-        env:
-          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
-          MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }}
-        run: ./scripts/retag-oci-bigfred-hub.sh "${GITHUB_REF_NAME}"

Makefile

@@ -113,7 +113,8 @@ test: ensure-go-junit-report
 
 .PHONY: test-minisign
 test-minisign:
-	./scripts/test-minisign-sign.sh
+	@command -v minisign >/dev/null 2>&1 || { echo "error: minisign required"; exit 1; }
+	GOPROXY=$${GOPROXY:-direct} go test -count=1 github.com/dcc-bigfred/common/internal/minisignsign@latest
 
 .PHONY: fmt
 fmt: ## Run go fmt against code.