jcoffey-dev
c4e496d3e1
The install guide tells people to curl .../releases/latest/download/<file> which is a GitHub URL shape. GitLab's equivalent is /-/releases/permalink/latest/downloads/<path> but it only resolves for assets that declare direct_asset_path, and the release job was creating plain links to the package registry. Those carry the tag in the URL, so they can never be a "latest" link. Each asset now also declares /binaries/<file>, which is what the docs will point at. The path is load-bearing: changing it breaks a documented install command.
109 lines
4.2 KiB
YAML
109 lines
4.2 KiB
YAML
# CI on the self-hosted GitLab, ported from .github/workflows/release.yml when
|
|
# the GitHub account was suspended on 2026-09-20. The Actions file stays in the
|
|
# tree: it is the reference this was written from and works unchanged if the
|
|
# appeal succeeds.
|
|
#
|
|
# The shape is the same -- tag-driven, amd64 and arm64, reproducible -- but the
|
|
# publishing half is necessarily different. There is no `gh release`, so the
|
|
# tarballs go to this project's generic package registry and the Release is
|
|
# created with release-cli, linking to them. The docs guide installs from
|
|
# release assets, so those links are the part that has to keep working.
|
|
#
|
|
# Images are pinned by digest, with the tag in the trailing comment: the
|
|
# replacement for the workflow's SHA-pinned actions, since GitLab has no
|
|
# action allowlist.
|
|
|
|
stages: [test, build, release]
|
|
|
|
variables:
|
|
PKG: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/stalwart-migrate"
|
|
|
|
default:
|
|
interruptible: true
|
|
|
|
.go: &go
|
|
image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
|
|
cache:
|
|
key: go-mod
|
|
paths: [.gocache/]
|
|
variables:
|
|
GOPATH: "$CI_PROJECT_DIR/.gocache"
|
|
|
|
test:
|
|
<<: *go
|
|
stage: test
|
|
script:
|
|
- go vet ./...
|
|
- go test ./...
|
|
# Kept as `go run ...@latest` exactly as the workflow had it: the point of
|
|
# a vulnerability check is to use today's database, not a pinned copy of
|
|
# last month's.
|
|
- go run golang.org/x/vuln/cmd/govulncheck@latest ./...
|
|
rules:
|
|
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_COMMIT_TAG
|
|
|
|
build:
|
|
<<: *go
|
|
stage: build
|
|
needs: [test]
|
|
script:
|
|
# The workflow refused to release a tag that is not an ancestor of main,
|
|
# so that a release can never describe code that was never reviewed onto
|
|
# the default branch. GIT_DEPTH is unset below to make the ancestry
|
|
# available -- a shallow clone cannot answer this.
|
|
- git fetch --quiet origin "$CI_DEFAULT_BRANCH"
|
|
- |
|
|
git merge-base --is-ancestor "$(git rev-parse "${CI_COMMIT_TAG}^{commit}")" "origin/$CI_DEFAULT_BRANCH" \
|
|
|| { echo "!! $CI_COMMIT_TAG is not on $CI_DEFAULT_BRANCH"; exit 1; }
|
|
# SOURCE_DATE_EPOCH is what makes the tarballs reproducible: without it
|
|
# every build stamps a new mtime and two builds of one tag differ.
|
|
- SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$CI_COMMIT_TAG")" scripts/build-release.sh "$CI_COMMIT_TAG" dist
|
|
- sha256sum dist/*.tar.gz
|
|
variables:
|
|
GIT_DEPTH: "0"
|
|
artifacts:
|
|
paths: [dist/]
|
|
expire_in: 1 week
|
|
rules:
|
|
- if: $CI_COMMIT_TAG
|
|
|
|
release:
|
|
stage: release
|
|
image: registry.gitlab.com/gitlab-org/cli:latest@sha256:3f0a591b3b96c39ac8e28480ee99bb93201b7bcea1fbca7ed50c034098111db2 # latest
|
|
needs: [build]
|
|
script:
|
|
# Upload first, then create the Release pointing at what was uploaded. A
|
|
# Release whose assets 404 is worse than no Release: the install guide
|
|
# sends people straight at these URLs.
|
|
- |
|
|
set -eu
|
|
for f in dist/*; do
|
|
n=$(basename "$f")
|
|
echo "uploading $n"
|
|
curl --fail --silent --show-error \
|
|
--header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
|
|
--upload-file "$f" \
|
|
"${PKG}/${CI_COMMIT_TAG}/${n}"
|
|
done
|
|
- |
|
|
set -eu
|
|
args=""
|
|
for f in dist/*; do
|
|
n=$(basename "$f")
|
|
# direct_asset_path is what makes the permalink work. Without it the
|
|
# only stable URL is the package registry one, which carries the tag
|
|
# and so cannot be a "latest" link. With it, every release exposes
|
|
# /-/releases/permalink/latest/downloads/binaries/<file>
|
|
# which is the GitLab equivalent of the GitHub
|
|
# /releases/latest/download/<file> URL the install guide has always
|
|
# used. Changing this path breaks documented install commands.
|
|
args="$args --assets-link {\"name\":\"${n}\",\"url\":\"${PKG}/${CI_COMMIT_TAG}/${n}\",\"direct_asset_path\":\"/binaries/${n}\"}"
|
|
done
|
|
# shellcheck disable=SC2086
|
|
release-cli create --name "$CI_COMMIT_TAG" --tag-name "$CI_COMMIT_TAG" \
|
|
--description "Binaries for linux/amd64 and linux/arm64. Verify with SHA256SUMS." $args
|
|
rules:
|
|
- if: $CI_COMMIT_TAG
|