jcoffey-dev
0543931616
Pushing a v* tag runs .github/workflows/release.yml: vet, test, govulncheck, then scripts/build-release.sh builds reproducible archives for linux/amd64 and linux/arm64 with a SHA256SUMS file, and attaches them to the release. workflow_dispatch takes a tag for a run that never started. Same shape as ihasmail-oneshot's releases. Adds a version subcommand, set at build time. go.mod moves to 1.26.8: the workflow builds with the go.mod version, and govulncheck finds four standard-library vulnerabilities the tool reaches in 1.26.5 (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), all fixed in 1.26.6. README installs from the latest release, with building from source as the alternative; CONTRIBUTING describes how releases are cut.
70 lines
2.0 KiB
YAML
70 lines
2.0 KiB
YAML
# Publish a release when a version tag is pushed: test, check for known
|
|
# vulnerabilities, build the Linux binaries, attach them with their checksums.
|
|
#
|
|
# Tags are the date of the commit, as ihasmail's are: v2026.9.15, and
|
|
# v2026.9.15.1 for a second release on the same day.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
# For a tag whose run never started. GitHub has queued and then orphaned
|
|
# runs before, and a pushed tag has no other way to trigger this again.
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Existing tag to release, e.g. v2026.9.15"
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: release-${{ github.event.inputs.tag || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TAG: ${{ github.event.inputs.tag || github.ref_name }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.event.inputs.tag || github.ref }}
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Check the tag names a commit on main
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --quiet origin main
|
|
git merge-base --is-ancestor "$(git rev-parse "$TAG^{commit}")" origin/main \
|
|
|| { echo "::error::$TAG is not on main"; exit 1; }
|
|
|
|
- name: Vet and test
|
|
run: |
|
|
go vet ./...
|
|
go test ./...
|
|
|
|
- name: Known vulnerabilities
|
|
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
|
|
|
|
- name: Build
|
|
run: |
|
|
SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$TAG")" scripts/build-release.sh "$TAG" dist
|
|
|
|
- name: Publish
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if gh release view "$TAG" >/dev/null 2>&1; then
|
|
gh release upload "$TAG" dist/* --clobber
|
|
else
|
|
gh release create "$TAG" dist/* --verify-tag --title "$TAG" --generate-notes
|
|
fi
|