chore(deps): update metio ci #127
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: The jaas Authors | |
| # SPDX-License-Identifier: 0BSD | |
| name: Automated Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Least-privilege default; the container and github jobs raise their own | |
| # job-level permissions (packages/contents/id-token) as needed. | |
| permissions: | |
| contents: read | |
| # Serialize release runs. Each run's release-notes lower bound is the latest tag | |
| # at the time its prepare job runs; two merges in quick succession would both | |
| # read that bound before either run has tagged, producing overlapping notes. | |
| # Queueing (no cancel) lets the earlier release finish and create its tag first, | |
| # so the next run's notes start from that tag and carry only its own commits. | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: false | |
| jobs: | |
| prepare: | |
| name: Prepare Release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| outputs: | |
| needed: ${{ steps.gate.outputs.needed }} | |
| version: ${{ steps.version.outputs.version }} | |
| previous: ${{ steps.gate.outputs.last }} | |
| steps: | |
| - name: Clone Git Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - id: gate | |
| name: Check whether a release is needed | |
| uses: metio/ci/needs-release@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| with: | |
| paths: go.mod main.go internal api config Dockerfile | |
| - id: version | |
| name: Compute the next version | |
| if: steps.gate.outputs.needed == 'true' | |
| uses: metio/ci/calver@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| build: | |
| name: Build ${{ matrix.goos }}/${{ matrix.goarch }} | |
| needs: prepare | |
| if: needs.prepare.outputs.needed == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| matrix: | |
| # The six linux architectures the container image ships (the set | |
| # gcr.io/distroless/static supports) plus windows and macOS (darwin) on | |
| # amd64/arm64, so the binary is available for desktop use (jaas doubles | |
| # as a cluster-free local Jsonnet renderer). | |
| include: | |
| - goos: linux | |
| goarch: amd64 | |
| - goos: linux | |
| goarch: arm | |
| goarm: "7" | |
| - goos: linux | |
| goarch: arm64 | |
| - goos: linux | |
| goarch: ppc64le | |
| - goos: linux | |
| goarch: riscv64 | |
| - goos: linux | |
| goarch: s390x | |
| - goos: windows | |
| goarch: amd64 | |
| - goos: windows | |
| goarch: arm64 | |
| - goos: darwin | |
| goarch: amd64 | |
| - goos: darwin | |
| goarch: arm64 | |
| steps: | |
| - name: Clone Git Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - id: build | |
| name: Build & Archive | |
| # Cross-compile and archive for this platform: tar.gz on linux/darwin, | |
| # zip on windows (with a .exe binary). go comes from the flake; GOOS/ | |
| # GOARCH/CGO_ENABLED ride the step env into `nix develop --command`. | |
| run: | | |
| set -euo pipefail | |
| ver="${{ needs.prepare.outputs.version }}" | |
| os="${{ matrix.goos }}" | |
| arch="${{ matrix.goarch }}" | |
| name="$REPO_NAME" | |
| ext="" | |
| [ "$os" = windows ] && ext=".exe" | |
| nix develop --command go build -o "${name}_v${ver}${ext}" -trimpath \ | |
| -ldflags="-s -w -X main.version=${ver} -X main.commit=${{ github.sha }}" . | |
| if [ "$os" = windows ]; then | |
| zip "${name}_${ver}_${os}_${arch}.zip" "${name}_v${ver}${ext}" LICENSE README.md | |
| else | |
| tar --create --gzip --file "${name}_${ver}_${os}_${arch}.tar.gz" "${name}_v${ver}${ext}" LICENSE README.md | |
| fi | |
| env: | |
| CGO_ENABLED: 0 | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| GOARM: ${{ matrix.goarm }} | |
| # Event data must reach the shell via env:, not ${{ }} inside run:. | |
| REPO_NAME: ${{ github.event.repository.name }} | |
| - name: Upload Artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: dist-${{ matrix.goos }}-${{ matrix.goarch }} | |
| if-no-files-found: error | |
| path: | | |
| *.tar.gz | |
| *.zip | |
| container: | |
| name: Container Release | |
| needs: [prepare, build] | |
| if: needs.prepare.outputs.needed == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| id-token: write # cosign keyless image signing | |
| contents: read | |
| packages: write # push to GHCR | |
| steps: | |
| - name: Clone Git Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - name: Build, push and sign the image | |
| uses: metio/ci/container-release@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| with: | |
| image: ghcr.io/${{ github.repository }} | |
| version: ${{ needs.prepare.outputs.version }} | |
| github: | |
| name: GitHub Release | |
| # Gate the release on a green image build too: the release notes advertise | |
| # ghcr.io/metio/jaas:<version>, so that tag must exist before the release is | |
| # published. A failed build/container skips the release instead of leaving a | |
| # published release that points at a non-existent image. | |
| needs: [prepare, build, container] | |
| if: needs.prepare.outputs.needed == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write # create the GitHub Release | |
| id-token: write # cosign keyless sign-blob (Fulcio OIDC) | |
| steps: | |
| - name: Clone Git Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download Artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| path: dist | |
| pattern: dist-* | |
| merge-multiple: true | |
| - name: Calculate Checksums | |
| # One SHA256SUMS over every archive (tar.gz for linux/darwin, zip for | |
| # windows). nullglob keeps the glob empty-safe. | |
| env: | |
| SUMS: ${{ github.event.repository.name }}_${{ needs.prepare.outputs.version }}_SHA256SUMS | |
| run: | | |
| cd dist | |
| shopt -s nullglob | |
| sha256sum ./*.tar.gz ./*.zip > "$SUMS" | |
| - name: Sign Checksums (cosign keyless) | |
| uses: metio/ci/cosign-sign-blob@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| with: | |
| file: dist/${{ github.event.repository.name }}_${{ needs.prepare.outputs.version }}_SHA256SUMS | |
| - id: notes | |
| name: Generate Release Notes | |
| uses: metio/ci/release-notes@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| with: | |
| version: ${{ needs.prepare.outputs.version }} | |
| previous: ${{ needs.prepare.outputs.previous }} | |
| - name: Append usage and verification footer | |
| env: | |
| VERSION: ${{ needs.prepare.outputs.version }} | |
| NOTES: ${{ steps.notes.outputs.file }} | |
| run: | | |
| cat >> "$NOTES" <<EOF | |
| ## Usage | |
| Pull the container from \`ghcr.io/metio/jaas:${VERSION}\`. | |
| See **Upgrading** — https://jaas.projects.metio.wtf/installation/upgrading/ — for any required actions on your part. | |
| Prebuilt binaries are attached below: | |
| - \`linux\`: \`amd64\`, \`arm\` (v7), \`arm64\`, \`ppc64le\`, \`riscv64\`, \`s390x\` | |
| - \`windows\`: \`amd64\`, \`arm64\` (\`.zip\`) | |
| - \`darwin\` (macOS): \`amd64\`, \`arm64\` | |
| ## Verify | |
| All release artifacts are signed with cosign keyless. See **Verifying releases** — https://jaas.projects.metio.wtf/installation/verifying-releases/ — for the verification commands. | |
| EOF | |
| - name: Create Release | |
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3 | |
| with: | |
| tag_name: ${{ needs.prepare.outputs.version }} | |
| name: ${{ needs.prepare.outputs.version }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| draft: false | |
| prerelease: false | |
| body_path: ${{ steps.notes.outputs.file }} | |
| files: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/${{ github.event.repository.name }}_${{ needs.prepare.outputs.version }}_SHA256SUMS | |
| dist/${{ github.event.repository.name }}_${{ needs.prepare.outputs.version }}_SHA256SUMS.bundle |