From 6e41da2e5c3bee03870f03712c44d779d23dd74b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:26:03 +0200 Subject: [PATCH 1/7] Migrate CI to shared dcc-bigfred/.github workflows and scripts. Call rust-musl-ci / ORAS reusable workflows at @v1; Makefile clones .ci-github for local publish-oci. Drop duplicated ORAS helpers. Co-authored-by: Cursor --- .github/workflows/ci.yml | 158 +++----------------------------- .github/workflows/release.yml | 126 ++----------------------- .gitignore | 1 + Makefile | 40 +++++++- scripts/inject-elf-version.sh | 31 ------- scripts/publish-oci-microdns.sh | 45 --------- scripts/retag-oci-microdns.sh | 59 ------------ src/version.rs | 2 +- 8 files changed, 64 insertions(+), 398 deletions(-) delete mode 100755 scripts/inject-elf-version.sh delete mode 100755 scripts/publish-oci-microdns.sh delete mode 100755 scripts/retag-oci-microdns.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9072c6a..e8074a4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,149 +17,19 @@ concurrency: cancel-in-progress: true jobs: - test: - name: Test - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt, clippy - - - name: Cache cargo - uses: Swatinem/rust-cache@v2 - - - name: Format - run: cargo fmt --all -- --check - - - name: Clippy - run: cargo clippy --all-targets -- -D warnings - - - name: Test - run: cargo test --locked - - build: - name: Build musl (${{ matrix.name }}) - needs: test - runs-on: ${{ matrix.runner }} - strategy: - fail-fast: false - matrix: - include: - - name: arm64 - runner: ubuntu-24.04-arm - rust_target: aarch64-unknown-linux-musl - dist_name: microdns-linux-arm64 - linker_env: CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER - cc_env: CC_aarch64_unknown_linux_musl - ar_env: AR_aarch64_unknown_linux_musl - - name: amd64 - runner: ubuntu-latest - rust_target: x86_64-unknown-linux-musl - dist_name: microdns-linux-amd64 - linker_env: CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER - cc_env: CC_x86_64_unknown_linux_musl - ar_env: AR_x86_64_unknown_linux_musl - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable - with: - targets: ${{ matrix.rust_target }} - - - name: Cache cargo - uses: Swatinem/rust-cache@v2 - with: - key: ${{ matrix.name }}-musl - - - name: Install musl toolchain (apt) - run: | - set -euo pipefail - sudo apt-get update - sudo apt-get install -y musl-tools musl-dev - musl-gcc --version - - - name: Build static binary + package dist - run: | - set -euo pipefail - export ${{ matrix.linker_env }}=musl-gcc - export ${{ matrix.cc_env }}=musl-gcc - export ${{ matrix.ar_env }}=ar - export RUSTFLAGS='-C target-feature=+crt-static' - export MICRODNS_GIT_COMMIT="${GITHUB_SHA}" - export MICRODNS_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - - cargo build --release --target ${{ matrix.rust_target }} - - mkdir -p dist - cp -f "target/${{ matrix.rust_target }}/release/microdns" "dist/${{ matrix.dist_name }}" - chmod 755 "dist/${{ matrix.dist_name }}" - - if [ "${{ matrix.name }}" = "arm64" ]; then - ( - cd dist - sha256sum microdns-linux-arm64 > SHA256SUMS - ) - fi - - file "dist/${{ matrix.dist_name }}" - if ldd "dist/${{ matrix.dist_name }}" 2>&1 | grep -qi 'not a dynamic\|statically linked'; then - echo "static binary OK: dist/${{ matrix.dist_name }}" - else - echo "warning: ldd output:" >&2 - ldd "dist/${{ matrix.dist_name }}" >&2 || true - fi - ls -lh "dist/${{ matrix.dist_name }}" - - - name: Upload artifacts - uses: actions/upload-artifact@v4 - with: - name: binaries-${{ matrix.name }} - path: dist/ - if-no-files-found: error - retention-days: 90 + ci: + uses: dcc-bigfred/.github/.github/workflows/rust-musl-ci.yml@v1 + with: + binaries: '[{"name":"microdns","dist":"microdns-linux"}]' + build_env: | + MICRODNS_GIT_COMMIT=${{ github.sha }} publish-oci: - name: Publish OCI artifact to GHCR (ORAS) - needs: build - if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main') - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Download arm64 binaries - uses: actions/download-artifact@v4 - with: - name: binaries-arm64 - path: dist/ - - - name: Set up ORAS - uses: oras-project/setup-oras@v1 - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Publish microdns-linux-arm64 - run: ./scripts/publish-oci-microdns.sh dist/microdns-linux-arm64 - - - name: Job summary - run: | - { - echo "### OCI publish (ORAS)" - echo "" - echo "- Image: \`ghcr.io/dcc-bigfred/microdns-linux-arm64\`" - echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`" - } >> "$GITHUB_STEP_SUMMARY" + needs: ci + uses: dcc-bigfred/.github/.github/workflows/rust-oras-publish-main.yml@v1 + with: + oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 + oci_title: microdns + oci_layers: microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 + ci_scripts_ref: v1 + secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fd5874c..d5e5182 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,119 +11,13 @@ permissions: jobs: release: - name: Publish GitHub release + OCI tags - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Wait for CI build artifacts - id: ci - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - SHA="${GITHUB_SHA}" - DEADLINE=$(( $(date +%s) + 1800 )) - RUN_ID="" - - while [ "$(date +%s)" -lt "$DEADLINE" ]; do - RUN_JSON="$(gh run list --workflow=ci.yml --commit="$SHA" --limit=1 --json databaseId,status,conclusion)" - if [ "$RUN_JSON" = "[]" ]; then - echo "CI workflow run for ${SHA} not found yet; retrying..." - sleep 15 - continue - fi - - STATUS="$(echo "$RUN_JSON" | jq -r '.[0].status')" - CONCLUSION="$(echo "$RUN_JSON" | jq -r '.[0].conclusion')" - RUN_ID="$(echo "$RUN_JSON" | jq -r '.[0].databaseId')" - - if [ "$STATUS" = "completed" ]; then - if [ "$CONCLUSION" != "success" ]; then - echo "CI workflow run ${RUN_ID} finished with conclusion: ${CONCLUSION}" - exit 1 - fi - echo "CI workflow run ${RUN_ID} succeeded" - echo "run_id=${RUN_ID}" >> "$GITHUB_OUTPUT" - exit 0 - fi - - echo "CI workflow run ${RUN_ID} status=${STATUS}; waiting..." - sleep 15 - done - - echo "Timed out after 30 minutes waiting for CI workflow on commit ${SHA}" - exit 1 - - - name: Download CI binaries (linux arm64) - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - mkdir -p release-assets - gh run download "${{ steps.ci.outputs.run_id }}" \ - --name binaries-arm64 \ - --dir release-assets - - - name: Download CI binaries (linux amd64) - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - mkdir -p release-assets - gh run download "${{ steps.ci.outputs.run_id }}" \ - --name binaries-amd64 \ - --dir release-assets/amd64 - find release-assets/amd64 -type f -exec cp -f {} release-assets/ \; - rm -rf release-assets/amd64 - - - name: Create release if missing - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - TAG="${GITHUB_REF_NAME}" - if ! gh release view "$TAG" >/dev/null 2>&1; then - gh release create "$TAG" \ - --title "$TAG" \ - --generate-notes - else - echo "Release ${TAG} already exists" - fi - - - name: Upload binaries to release - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - TAG="${GITHUB_REF_NAME}" - mapfile -d '' FILES < <(find release-assets -type f -print0) - if [ "${#FILES[@]}" -eq 0 ]; then - echo "No release assets found" - exit 1 - fi - gh release upload "$TAG" "${FILES[@]}" --clobber - - - name: Set up ORAS - uses: oras-project/setup-oras@v1 - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Retag microdns ORAS artifact from main - run: ./scripts/retag-oci-microdns.sh "${GITHUB_REF_NAME}" - - - name: Job summary - run: | - { - echo "### Release ${GITHUB_REF_NAME}" - echo "" - echo "- GitHub Release assets uploaded (linux arm64 + amd64)" - echo "- ORAS: \`ghcr.io/dcc-bigfred/microdns-linux-arm64:${GITHUB_REF_NAME}\`" - echo "- ORAS: \`ghcr.io/dcc-bigfred/microdns-linux-arm64:latest-release\`" - } >> "$GITHUB_STEP_SUMMARY" + uses: dcc-bigfred/.github/.github/workflows/rust-oras-release.yml@v1 + with: + oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 + oci_title: microdns + oci_layers: microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 + oci_elf_layers: microdns-linux-arm64 + oci_elf_section: .microdns.version + ci_workflow: ci.yml + ci_scripts_ref: v1 + secrets: inherit diff --git a/.gitignore b/.gitignore index 4c4cfd8..cfe3178 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ /target/ /dist/ +/.ci-github/ **/*.rs.bk *.swp *.swo diff --git a/Makefile b/Makefile index 4804ff2..6bd5947 100644 --- a/Makefile +++ b/Makefile @@ -1,11 +1,22 @@ -# microdns — build / cross-compile +# microdns — build / cross-compile / OCI helpers TARGET_MUSL ?= aarch64-unknown-linux-musl CARGO ?= cargo RUSTUP_TOOLCHAIN ?= stable export RUSTUP_TOOLCHAIN -.PHONY: all build release release-musl check test clean fmt clippy +CI_SCRIPTS_REPO ?= https://github.com/dcc-bigfred/.github.git +CI_SCRIPTS_REF ?= v1 +CI_SCRIPTS_DIR ?= .ci-github + +OCI_IMAGE ?= ghcr.io/dcc-bigfred/microdns-linux-arm64 +OCI_TITLE ?= microdns +OCI_LAYERS ?= microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 +OCI_ELF_LAYERS ?= microdns-linux-arm64 +OCI_ELF_SECTION ?= .microdns.version + +.PHONY: all build release release-musl check test test-release-assertions \ + clean fmt clippy ci-scripts-update publish-oci retag-oci all: build @@ -28,6 +39,9 @@ check: test: $(CARGO) test +test-release-assertions: + $(CARGO) test --profile release-assertions + fmt: $(CARGO) fmt @@ -37,3 +51,25 @@ clippy: clean: $(CARGO) clean rm -rf dist + +$(CI_SCRIPTS_DIR)/.ok: + @echo "Cloning $(CI_SCRIPTS_REPO) @ $(CI_SCRIPTS_REF) → $(CI_SCRIPTS_DIR)" + @rm -rf "$(CI_SCRIPTS_DIR)" + @git clone --depth 1 --branch "$(CI_SCRIPTS_REF)" "$(CI_SCRIPTS_REPO)" "$(CI_SCRIPTS_DIR)" \ + || { echo "error: failed to clone $(CI_SCRIPTS_REPO) @ $(CI_SCRIPTS_REF)"; exit 1; } + @touch "$@" + +ci-scripts-update: + rm -rf "$(CI_SCRIPTS_DIR)" + $(MAKE) "$(CI_SCRIPTS_DIR)/.ok" + +publish-oci: release-musl $(CI_SCRIPTS_DIR)/.ok + cd dist && \ + OCI_IMAGE="$(OCI_IMAGE)" OCI_TITLE="$(OCI_TITLE)" OCI_LAYERS="$(OCI_LAYERS)" \ + "../$(CI_SCRIPTS_DIR)/scripts/publish-oci-linux.sh" + +retag-oci: $(CI_SCRIPTS_DIR)/.ok + @test -n "$(TAG)" || { echo "usage: make retag-oci TAG=v0.1.0"; exit 1; } + OCI_IMAGE="$(OCI_IMAGE)" OCI_TITLE="$(OCI_TITLE)" OCI_LAYERS="$(OCI_LAYERS)" \ + OCI_ELF_LAYERS="$(OCI_ELF_LAYERS)" OCI_ELF_SECTION="$(OCI_ELF_SECTION)" \ + "$(CI_SCRIPTS_DIR)/scripts/retag-oci-linux.sh" "$(TAG)" diff --git a/scripts/inject-elf-version.sh b/scripts/inject-elf-version.sh deleted file mode 100755 index 88698ed..0000000 --- a/scripts/inject-elf-version.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/usr/bin/env bash -# Inject release version metadata into an ELF binary as section -# .microdns.version (JSON {"version":"v1.2.3","commit":"abc1234"}). -# Usage: inject-elf-version.sh -set -euo pipefail - -BINARY="${1:?usage: $0 }" -VERSION="${2:?}" -TAG_COMMIT="${3:?}" - -if [[ ! -f "${BINARY}" ]]; then - echo "error: binary not found: ${BINARY}" >&2 - exit 1 -fi - -if ! command -v objcopy >/dev/null 2>&1; then - echo "error: objcopy not found (install binutils)" >&2 - exit 1 -fi - -tmpdir="$(mktemp -d)" -cleanup() { rm -rf "${tmpdir}"; } -trap cleanup EXIT - -section_file="${tmpdir}/microdns.version.json" -printf '{"version":"%s","commit":"%s"}' "${VERSION}" "${TAG_COMMIT}" > "${section_file}" - -objcopy --remove-section .microdns.version "${BINARY}" 2>/dev/null || true -objcopy --add-section ".microdns.version=${section_file}" "${BINARY}" - -echo "Injected .microdns.version into ${BINARY}: version=${VERSION} commit=${TAG_COMMIT}" diff --git a/scripts/publish-oci-microdns.sh b/scripts/publish-oci-microdns.sh deleted file mode 100755 index b4dbefa..0000000 --- a/scripts/publish-oci-microdns.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env bash -# Publish microdns linux/arm64 OCI artifact to GHCR (ORAS). -# Intended for CI on push to main/master only. -# Usage: publish-oci-microdns.sh -# -# Tags: main, sha-<7> -set -euo pipefail - -BIN="${1:?usage: $0 }" -IMAGE="${MICRODNS_OCI_IMAGE:-ghcr.io/dcc-bigfred/microdns-linux-arm64}" -BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microdns.linux.arm64.v1" - -if [[ ! -f "${BIN}" ]]; then - echo "error: binary not found: ${BIN}" >&2 - exit 1 -fi - -BRANCH="${GITHUB_REF_NAME:?GITHUB_REF_NAME required}" -if [[ "${BRANCH}" != "master" && "${BRANCH}" != "main" ]]; then - echo "error: OCI publish is only allowed from master/main (got ${BRANCH})" >&2 - exit 1 -fi - -SHA_TAG="sha-${GITHUB_SHA::7}" - -tmpdir="$(mktemp -d)" -cleanup() { rm -rf "${tmpdir}"; } -trap cleanup EXIT - -cp -f "${BIN}" "${tmpdir}/microdns-linux-arm64" -chmod 755 "${tmpdir}/microdns-linux-arm64" - -annotate=( - --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" - --annotation "org.opencontainers.image.revision=${GITHUB_SHA}" - --annotation "org.opencontainers.image.title=microdns" -) - -echo "Publishing ${IMAGE}:main and :${SHA_TAG}" -echo " microdns: $(wc -c < "${tmpdir}/microdns-linux-arm64") bytes" -( - cd "${tmpdir}" - oras push "${IMAGE}:main" "microdns-linux-arm64:${BIN_MEDIA_TYPE}" "${annotate[@]}" - oras push "${IMAGE}:${SHA_TAG}" "microdns-linux-arm64:${BIN_MEDIA_TYPE}" "${annotate[@]}" -) diff --git a/scripts/retag-oci-microdns.sh b/scripts/retag-oci-microdns.sh deleted file mode 100755 index 817b8c5..0000000 --- a/scripts/retag-oci-microdns.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/usr/bin/env bash -# Retag the microdns linux/arm64 OCI artifact from :main to a release tag and -# latest-release. Injects .microdns.version ELF section. -# Usage: retag-oci-microdns.sh e.g. v0.1.0 -set -euo pipefail - -RELEASE_TAG="${1:?usage: $0 }" -IMAGE="${MICRODNS_OCI_IMAGE:-ghcr.io/dcc-bigfred/microdns-linux-arm64}" -BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microdns.linux.arm64.v1" -TAG_COMMIT="${GITHUB_SHA:?GITHUB_SHA required (tag commit)}" - -tmpdir="$(mktemp -d)" -cleanup() { rm -rf "${tmpdir}"; } -trap cleanup EXIT - -echo "Pulling ${IMAGE}:main…" -oras pull "${IMAGE}:main" -o "${tmpdir}" - -find_layer() { - local want="$1" - if [[ -f "${tmpdir}/${want}" ]]; then - echo "${want}" - return 0 - fi - mapfile -t files < <(find "${tmpdir}" -type f \ - ! -name 'manifest.json' ! -name 'config.json' \ - -name "${want}" -printf '%f\n') - if [[ ${#files[@]} -eq 1 ]]; then - echo "${files[0]}" - return 0 - fi - return 1 -} - -BIN_NAME="$(find_layer microdns-linux-arm64)" || true -if [[ -z "${BIN_NAME}" ]]; then - echo "error: expected microdns-linux-arm64 in OCI artifact, found:" >&2 - find "${tmpdir}" -type f >&2 - exit 1 -fi - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -TAG_COMMIT_SHORT="${TAG_COMMIT:0:7}" -"${SCRIPT_DIR}/inject-elf-version.sh" "${tmpdir}/${BIN_NAME}" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}" - -annotate=( - --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY:-dcc-bigfred/microdns}" - --annotation "org.opencontainers.image.revision=${TAG_COMMIT}" - --annotation "org.opencontainers.image.version=${RELEASE_TAG}" - --annotation "org.opencontainers.image.title=microdns" -) - -echo "Publishing ${IMAGE}:${RELEASE_TAG} and :latest-release" -echo " microdns: $(wc -c < "${tmpdir}/${BIN_NAME}") bytes" -( - cd "${tmpdir}" - oras push "${IMAGE}:${RELEASE_TAG}" "${BIN_NAME}:${BIN_MEDIA_TYPE}" "${annotate[@]}" - oras push "${IMAGE}:latest-release" "${BIN_NAME}:${BIN_MEDIA_TYPE}" "${annotate[@]}" -) diff --git a/src/version.rs b/src/version.rs index 7f018a2..53af99a 100644 --- a/src/version.rs +++ b/src/version.rs @@ -11,7 +11,7 @@ use std::fs; use std::path::Path; use std::sync::OnceLock; -/// ELF section name (must match `scripts/inject-elf-version.sh`). +/// ELF section name (must match org `.github` `inject-elf-version.sh` section arg). pub const SECTION_NAME: &str = ".microdns.version"; /// Public version payload returned by `microdns info` / `--version`. From fe9eb9401cac9f479024451840778b86e46ceeed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:28:04 +0200 Subject: [PATCH 2/7] fix(ci): grant job-level permissions for reusable workflow calls. Co-authored-by: Cursor --- .github/workflows/ci.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e8074a4..570efa7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,15 +9,14 @@ on: - "v*" pull_request: -permissions: - contents: read - concurrency: group: ci-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: ci: + permissions: + contents: read uses: dcc-bigfred/.github/.github/workflows/rust-musl-ci.yml@v1 with: binaries: '[{"name":"microdns","dist":"microdns-linux"}]' @@ -26,6 +25,9 @@ jobs: publish-oci: needs: ci + permissions: + contents: read + packages: write uses: dcc-bigfred/.github/.github/workflows/rust-oras-publish-main.yml@v1 with: oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 From daac1d67d5c31b97355f13be42a4b5c358435c9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:29:44 +0200 Subject: [PATCH 3/7] Add release-assertions Cargo profile required by shared CI. Co-authored-by: Cursor --- Cargo.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index 9d93942..80d0aff 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -35,6 +35,11 @@ strip = true panic = "abort" overflow-checks = true +[profile.release-assertions] +inherits = "release" +debug-assertions = true +overflow-checks = true + [lints.rust] unused_must_use = "deny" From f00ece3603084ccfecaa7e52bb6e92bd3308049d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:34:16 +0200 Subject: [PATCH 4/7] fix(ci): set job-level permissions on release reusable call. Co-authored-by: Cursor --- .github/workflows/release.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d5e5182..d8964b9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,12 +5,11 @@ on: tags: - "v*" -permissions: - contents: write - packages: write - jobs: release: + permissions: + contents: write + packages: write uses: dcc-bigfred/.github/.github/workflows/rust-oras-release.yml@v1 with: oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 From 43edea830e0201cdbcddb6f38d5a575dc3aaed17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 15:38:19 +0200 Subject: [PATCH 5/7] Drop ORAS publish; pin shared CI workflows at v2. Co-authored-by: Cursor --- .github/workflows/ci.yml | 15 +-------------- .github/workflows/release.yml | 12 ++++-------- Makefile | 23 +++-------------------- 3 files changed, 8 insertions(+), 42 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 570efa7..84897ba 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,21 +17,8 @@ jobs: ci: permissions: contents: read - uses: dcc-bigfred/.github/.github/workflows/rust-musl-ci.yml@v1 + uses: dcc-bigfred/.github/.github/workflows/rust-musl-ci.yml@v2 with: binaries: '[{"name":"microdns","dist":"microdns-linux"}]' build_env: | MICRODNS_GIT_COMMIT=${{ github.sha }} - - publish-oci: - needs: ci - permissions: - contents: read - packages: write - uses: dcc-bigfred/.github/.github/workflows/rust-oras-publish-main.yml@v1 - with: - oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 - oci_title: microdns - oci_layers: microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 - ci_scripts_ref: v1 - secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8964b9..7ac1434 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,14 +9,10 @@ jobs: release: permissions: contents: write - packages: write - uses: dcc-bigfred/.github/.github/workflows/rust-oras-release.yml@v1 + uses: dcc-bigfred/.github/.github/workflows/rust-release.yml@v2 with: - oci_image: ghcr.io/dcc-bigfred/microdns-linux-arm64 - oci_title: microdns - oci_layers: microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 - oci_elf_layers: microdns-linux-arm64 - oci_elf_section: .microdns.version + elf_binaries: microdns-linux-arm64 + elf_section: .microdns.version ci_workflow: ci.yml - ci_scripts_ref: v1 + ci_scripts_ref: v2 secrets: inherit diff --git a/Makefile b/Makefile index 6bd5947..b69149c 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -# microdns — build / cross-compile / OCI helpers +# microdns — build / cross-compile TARGET_MUSL ?= aarch64-unknown-linux-musl CARGO ?= cargo @@ -6,17 +6,11 @@ RUSTUP_TOOLCHAIN ?= stable export RUSTUP_TOOLCHAIN CI_SCRIPTS_REPO ?= https://github.com/dcc-bigfred/.github.git -CI_SCRIPTS_REF ?= v1 +CI_SCRIPTS_REF ?= v2 CI_SCRIPTS_DIR ?= .ci-github -OCI_IMAGE ?= ghcr.io/dcc-bigfred/microdns-linux-arm64 -OCI_TITLE ?= microdns -OCI_LAYERS ?= microdns-linux-arm64=application/vnd.dcc-bigfred.microdns.linux.arm64.v1 -OCI_ELF_LAYERS ?= microdns-linux-arm64 -OCI_ELF_SECTION ?= .microdns.version - .PHONY: all build release release-musl check test test-release-assertions \ - clean fmt clippy ci-scripts-update publish-oci retag-oci + clean fmt clippy ci-scripts-update all: build @@ -62,14 +56,3 @@ $(CI_SCRIPTS_DIR)/.ok: ci-scripts-update: rm -rf "$(CI_SCRIPTS_DIR)" $(MAKE) "$(CI_SCRIPTS_DIR)/.ok" - -publish-oci: release-musl $(CI_SCRIPTS_DIR)/.ok - cd dist && \ - OCI_IMAGE="$(OCI_IMAGE)" OCI_TITLE="$(OCI_TITLE)" OCI_LAYERS="$(OCI_LAYERS)" \ - "../$(CI_SCRIPTS_DIR)/scripts/publish-oci-linux.sh" - -retag-oci: $(CI_SCRIPTS_DIR)/.ok - @test -n "$(TAG)" || { echo "usage: make retag-oci TAG=v0.1.0"; exit 1; } - OCI_IMAGE="$(OCI_IMAGE)" OCI_TITLE="$(OCI_TITLE)" OCI_LAYERS="$(OCI_LAYERS)" \ - OCI_ELF_LAYERS="$(OCI_ELF_LAYERS)" OCI_ELF_SECTION="$(OCI_ELF_SECTION)" \ - "$(CI_SCRIPTS_DIR)/scripts/retag-oci-linux.sh" "$(TAG)" From 6293fe229aa1287a54145c3a03a8c227abba8cb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 19:44:33 +0200 Subject: [PATCH 6/7] Point shared CI at dcc-bigfred/common; drop unused .ci-github bootstrap. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rename target after .github → common. Makefile no longer clones shared scripts (fetch lives in go run github.com/dcc-bigfred/common/cmd/fetch). Co-authored-by: Cursor --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- Makefile | 17 +---------------- 3 files changed, 3 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 84897ba..949794c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: ci: permissions: contents: read - uses: dcc-bigfred/.github/.github/workflows/rust-musl-ci.yml@v2 + uses: dcc-bigfred/common/.github/workflows/rust-musl-ci.yml@v2 with: binaries: '[{"name":"microdns","dist":"microdns-linux"}]' build_env: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7ac1434..bcff99e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,7 +9,7 @@ jobs: release: permissions: contents: write - uses: dcc-bigfred/.github/.github/workflows/rust-release.yml@v2 + uses: dcc-bigfred/common/.github/workflows/rust-release.yml@v2 with: elf_binaries: microdns-linux-arm64 elf_section: .microdns.version diff --git a/Makefile b/Makefile index b69149c..24463cd 100644 --- a/Makefile +++ b/Makefile @@ -5,12 +5,8 @@ CARGO ?= cargo RUSTUP_TOOLCHAIN ?= stable export RUSTUP_TOOLCHAIN -CI_SCRIPTS_REPO ?= https://github.com/dcc-bigfred/.github.git -CI_SCRIPTS_REF ?= v2 -CI_SCRIPTS_DIR ?= .ci-github - .PHONY: all build release release-musl check test test-release-assertions \ - clean fmt clippy ci-scripts-update + clean fmt clippy all: build @@ -45,14 +41,3 @@ clippy: clean: $(CARGO) clean rm -rf dist - -$(CI_SCRIPTS_DIR)/.ok: - @echo "Cloning $(CI_SCRIPTS_REPO) @ $(CI_SCRIPTS_REF) → $(CI_SCRIPTS_DIR)" - @rm -rf "$(CI_SCRIPTS_DIR)" - @git clone --depth 1 --branch "$(CI_SCRIPTS_REF)" "$(CI_SCRIPTS_REPO)" "$(CI_SCRIPTS_DIR)" \ - || { echo "error: failed to clone $(CI_SCRIPTS_REPO) @ $(CI_SCRIPTS_REF)"; exit 1; } - @touch "$@" - -ci-scripts-update: - rm -rf "$(CI_SCRIPTS_DIR)" - $(MAKE) "$(CI_SCRIPTS_DIR)/.ok" From 7a3a38866152191aaee9b4f216a59fa19884ef82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Damian=20K=C4=99ska?= <372403+keskad@users.noreply.github.com> Date: Thu, 6 Aug 2026 19:59:56 +0200 Subject: [PATCH 7/7] Drop ci_scripts_ref; rust-release injects ELF via go run Co-authored-by: Cursor --- .github/workflows/release.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bcff99e..1369fd9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,5 +14,4 @@ jobs: elf_binaries: microdns-linux-arm64 elf_section: .microdns.version ci_workflow: ci.yml - ci_scripts_ref: v2 secrets: inherit