mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-26 09:55:48 +08:00
3dfd9052be
Docker: single workflow, one job per image per platform instead of one workflow per registry. Platforms are built in parallel and pushed by digest, then combined into a manifest list pushed to Docker Hub and GHCR at once, so both registries get identical digests. arm64 and arm/v7 build on native arm runners, ppc64le is dropped. Registry provenance/sbom attestations are disabled (they were shown as unknown/unknown entries in the registries), build provenance is attested with actions/attest-build-provenance instead and is verifiable with 'gh attestation verify oci://...'. Release binaries (rpm, deb, zip) are attested the same way. cosign version is pinned and images are signed by digest.
93 lines
3.0 KiB
YAML
93 lines
3.0 KiB
YAML
name: RPM/DEB build aarch64
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
|
|
jobs:
|
|
ci:
|
|
name: "${{ matrix.target }}"
|
|
strategy:
|
|
matrix:
|
|
target:
|
|
- ubuntu-24.04-arm
|
|
runs-on: ${{ matrix.target }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- name: env
|
|
run: |
|
|
pwd
|
|
echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
|
|
echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
|
|
- name: echo env
|
|
run: echo "release $RELEASE version $VERSION"
|
|
- name: Linux libraries
|
|
run: |
|
|
sudo apt update
|
|
sudo apt install libssl-dev libpam-dev libpcre2-dev rpm build-essential debhelper
|
|
- name: configure rpm env
|
|
run: |
|
|
mkdir ~/debian
|
|
mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
|
tar -czf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz --transform "s,^,3proxy-$RELEASE/," .
|
|
ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
|
|
cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
|
|
cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
|
|
- name: rpmbuild
|
|
run: |
|
|
ret=`pwd`
|
|
cd ~/rpmbuild/SPECS
|
|
rpmbuild -ba 3proxy-$RELEASE.spec
|
|
cd $ret
|
|
mv ~/rpmbuild/RPMS/aarch64/3proxy-$RELEASE-1.aarch64.rpm 3proxy-$RELEASE.arm64.rpm
|
|
- name: Get artifact rpm
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: "3proxy-${{ env.RELEASE }}-arm64.rpm"
|
|
path: "*.rpm"
|
|
- name: Upload rpm to release
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.rpm
|
|
- name: debbuild
|
|
run: |
|
|
ret=`pwd`
|
|
cd ~/debian/
|
|
tar xzf 3proxy_$RELEASE.orig.tar.gz
|
|
cd 3proxy-$RELEASE
|
|
echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
|
|
echo " " >>debian/changelog
|
|
echo " *3proxy $RELEASE build" >>debian/changelog
|
|
echo " " >>debian/changelog
|
|
echo " -- z3APA3A <3apa3a@3proxy.org> "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
|
|
echo "">>debian/changelog
|
|
dpkg-buildpackage
|
|
cd $ret
|
|
cp ~/debian/3proxy_$RELEASE-"$VERSION"_arm64.deb ./3proxy-$RELEASE.arm64.deb
|
|
- name: Get artifact deb
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: "3proxy-${{ env.RELEASE }}-arm64.deb"
|
|
path: "*.deb"
|
|
- name: Upload deb to release
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.deb
|
|
- name: Attest build provenance
|
|
if: github.event_name == 'release'
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
*.rpm
|
|
*.deb
|