jcoffey-dev
1332ade130
scripts/build-release.sh builds reproducible linux/amd64 and linux/arm64 archives with SHA256SUMS; the release workflow runs it on a v* tag after vet, tests and govulncheck, and publishes the release. The README now covers what the tool is, what it does step by step, why each decision is made, how to deploy and run a mail host, the security model, and troubleshooting. -h exits 0.
70 lines
2.0 KiB
YAML
70 lines
2.0 KiB
YAML
# Publish a release when a version tag is pushed: test, check for known
|
|
# vulnerabilities, build the Linux binaries, attach them with their checksums.
|
|
#
|
|
# Tags are the date of the commit, as ihasmail's are: v2026.9.13, and
|
|
# v2026.9.13.1 for a second release on the same day.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
# For a tag whose run never started. GitHub has queued and then orphaned
|
|
# runs before, and a pushed tag has no other way to trigger this again.
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Existing tag to release, e.g. v2026.9.13"
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: release-${{ github.event.inputs.tag || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TAG: ${{ github.event.inputs.tag || github.ref_name }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.event.inputs.tag || github.ref }}
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Check the tag names a commit on main
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --quiet origin main
|
|
git merge-base --is-ancestor "$(git rev-parse "$TAG^{commit}")" origin/main \
|
|
|| { echo "::error::$TAG is not on main"; exit 1; }
|
|
|
|
- name: Vet and test
|
|
run: |
|
|
go vet ./...
|
|
go test ./...
|
|
|
|
- name: Known vulnerabilities
|
|
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
|
|
|
|
- name: Build
|
|
run: |
|
|
SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$TAG")" scripts/build-release.sh "$TAG" dist
|
|
|
|
- name: Publish
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if gh release view "$TAG" >/dev/null 2>&1; then
|
|
gh release upload "$TAG" dist/* --clobber
|
|
else
|
|
gh release create "$TAG" dist/* --verify-tag --title "$TAG" --generate-notes
|
|
fi
|