mirror of
https://github.com/3proxy/3proxy.git
synced 2026-10-28 22:05:48 +08:00
9ce5de971f
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
A release whose tree has DEVEL and no RELEASE is one of the development branch (release-kind.yml, called by the workflows below). For it only the Windows x64 zip, the x86_64 and arm64 deb packages and the rpm for EL 9 and 10 (x86_64 and arm64) are built and added to the release: no Docker images, no source tarball, no ipk, armhf, watcom, win32 or Windows arm64 builds. docker.yml makes it a prerelease, not "Latest", which also keeps it out of the package repository 3proxy.github.io builds from releases. The packaging reads the version from RELEASE or DEVEL. rpm names the source archive and its directory after the spec's Version, which for 2.0.0-devel is 2.0.0~devel, so that %setup finds it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
92 lines
2.8 KiB
YAML
92 lines
2.8 KiB
YAML
name: Release source tarball
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
kind:
|
|
uses: ./.github/workflows/release-kind.yml
|
|
|
|
tarball:
|
|
# not for a release of the development branch
|
|
needs: kind
|
|
if: github.event_name != 'release' || needs.kind.outputs.devel != 'true'
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
name: "source tarball"
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: env
|
|
run: |
|
|
if [ -f RELEASE ]; then
|
|
RELEASE=$(tr -d ' \t\r\n' < RELEASE)
|
|
else
|
|
RELEASE=$(tr -d ' \t\r\n' < DEVEL)
|
|
fi
|
|
echo "RELEASE=$RELEASE" >> $GITHUB_ENV
|
|
|
|
- name: Create tarball
|
|
run: |
|
|
# git archive is reproducible from the tag: anyone can regenerate the
|
|
# tarball and compare it against the published checksum.
|
|
git archive --format=tar.gz -9 \
|
|
--prefix="3proxy-${{ env.RELEASE }}/" \
|
|
-o "3proxy-${{ env.RELEASE }}.tar.gz" HEAD
|
|
tar tzf "3proxy-${{ env.RELEASE }}.tar.gz" >/dev/null
|
|
ls -l *.tar.gz
|
|
|
|
- name: Get artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: "3proxy-${{ env.RELEASE }}-src"
|
|
path: "*.tar.gz"
|
|
|
|
- name: Import signing key
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
run: |
|
|
if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
|
|
mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
|
|
printf 'allow-loopback-pinentry\n' > ~/.gnupg/gpg-agent.conf
|
|
gpgconf --kill gpg-agent || true
|
|
printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
|
|
echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
|
|
|
|
- name: Checksums and detached signatures
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
run: |
|
|
sha256sum *.tar.gz > SHA256SUMS-src
|
|
for f in *.tar.gz SHA256SUMS-src; do
|
|
gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
|
|
-u "$GPG_KEYID" --armor --detach-sign "$f"
|
|
done
|
|
sha256sum -c SHA256SUMS-src
|
|
gpg --verify SHA256SUMS-src.asc SHA256SUMS-src
|
|
|
|
- name: Attest build provenance
|
|
if: github.event_name == 'release'
|
|
uses: actions/attest-build-provenance@v4
|
|
with:
|
|
subject-path: |
|
|
*.tar.gz
|
|
|
|
- name: Upload to release
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
run: gh release upload "$TAG" *.tar.gz *.tar.gz.asc SHA256SUMS-src SHA256SUMS-src.asc
|