fix: harden vcl lifecycle for varnish9 v4.3.3 #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'varnish9-v*' | |
| permissions: | |
| contents: write | |
| env: | |
| WASMTIME_VERSION: 44.0.0 | |
| VARNISH_VERSION: 9.0.3 | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| arch: [amd64, arm64] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up QEMU | |
| if: matrix.arch == 'arm64' | |
| uses: docker/setup-qemu-action@v4 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build release image | |
| run: | | |
| docker buildx build \ | |
| --platform linux/${{ matrix.arch }} \ | |
| --load \ | |
| -t vmod-wasm-release-${{ matrix.arch }} . | |
| - name: Extract release metadata | |
| id: version | |
| shell: bash | |
| run: | | |
| case "$GITHUB_REF_NAME" in | |
| varnish9-v*) version="${GITHUB_REF_NAME#varnish9-v}" ;; | |
| *) | |
| echo "::error::Release tags must match varnish9-vX.Y.Z" | |
| exit 1 | |
| ;; | |
| esac | |
| if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then | |
| echo "::error::Invalid release version: $version" | |
| exit 1 | |
| fi | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "artifact_prefix=vmod-wasm-varnish9-$version" >> "$GITHUB_OUTPUT" | |
| - name: Package binary artifact | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }} | |
| ARCH: ${{ matrix.arch }} | |
| run: | | |
| mkdir -p dist | |
| docker run --rm --platform linux/${{ matrix.arch }} \ | |
| -e VERSION="$VERSION" \ | |
| -e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \ | |
| -e ARCH="$ARCH" \ | |
| -e WASMTIME_VERSION="${{ env.WASMTIME_VERSION }}" \ | |
| -e VARNISH_VERSION="${{ env.VARNISH_VERSION }}" \ | |
| -v "$PWD/dist:/dist" \ | |
| vmod-wasm-release-${{ matrix.arch }} sh -ceu ' | |
| pkg="/tmp/${ARTIFACT_PREFIX}-linux-${ARCH}" | |
| mkdir -p "$pkg/lib" "$pkg/licenses" | |
| cp /src/src/.libs/libvmod_wasm.so "$pkg/lib/" | |
| cp -a /opt/wasmtime/lib/libwasmtime.so* "$pkg/lib/" | |
| cp /src/LICENSE "$pkg/licenses/vmod-wasm-LICENSE" | |
| cp /src/THIRD_PARTY_NOTICES.md "$pkg/licenses/" | |
| cat > "$pkg/INSTALL.md" <<EOF | |
| # vmod-wasm ${VERSION} for Varnish 9 on linux/${ARCH} | |
| This bundle contains libvmod_wasm.so and the Wasmtime ${WASMTIME_VERSION} | |
| runtime library it was built against. | |
| Install both shared libraries into your VMOD/runtime library location or | |
| keep this bundle together and expose the lib directory to varnishd: | |
| export LD_LIBRARY_PATH=/path/to/${ARTIFACT_PREFIX}-linux-${ARCH}/lib:\$LD_LIBRARY_PATH | |
| The VMOD is built and tested against Varnish ${VARNISH_VERSION}. Source | |
| builds remain the authoritative path for custom Varnish installations. | |
| EOF | |
| tar -czf "/dist/${ARTIFACT_PREFIX}-linux-${ARCH}.tar.gz" \ | |
| -C /tmp "${ARTIFACT_PREFIX}-linux-${ARCH}" | |
| { | |
| echo "arch=${ARCH}" | |
| echo "varnish_version=$(/usr/sbin/varnishd -V 2>&1 | head -n1)" | |
| echo "wasmtime_version=${WASMTIME_VERSION}" | |
| echo "rust_version=$(rustc --version)" | |
| } > "/dist/metadata-linux-${ARCH}.env" | |
| ' | |
| - name: Package source and example Wasm artifacts | |
| if: matrix.arch == 'amd64' | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }} | |
| run: | | |
| docker run --rm --platform linux/${{ matrix.arch }} \ | |
| -e VERSION="$VERSION" \ | |
| -e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \ | |
| -v "$PWD/dist:/dist" \ | |
| vmod-wasm-release-${{ matrix.arch }} sh -ceu ' | |
| make dist | |
| cp "vmod-wasm-${VERSION}.tar.gz" "/dist/${ARTIFACT_PREFIX}-src.tar.gz" | |
| tmp="/tmp/${ARTIFACT_PREFIX}-examples-wasm" | |
| mkdir -p "$tmp" | |
| cp /src/tests/wasm/*.wasm "$tmp/" | |
| cp /src/examples/edge-security-filter/config.json "$tmp/edge-security-filter-config.json" | |
| tar -czf "/dist/${ARTIFACT_PREFIX}-examples-wasm.tar.gz" \ | |
| -C /tmp "${ARTIFACT_PREFIX}-examples-wasm" | |
| ' | |
| - name: Smoke test binary bundle | |
| env: | |
| ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }} | |
| ARCH: ${{ matrix.arch }} | |
| run: | | |
| docker run --rm --platform linux/${{ matrix.arch }} \ | |
| -e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \ | |
| -e ARCH="$ARCH" \ | |
| -v "$PWD/dist:/dist" \ | |
| varnish:${{ env.VARNISH_VERSION }} sh -ceu ' | |
| pkg="/tmp/pkg/${ARTIFACT_PREFIX}-linux-${ARCH}" | |
| mkdir -p /tmp/pkg | |
| tar -xzf "/dist/${ARTIFACT_PREFIX}-linux-${ARCH}.tar.gz" -C /tmp/pkg | |
| LD_LIBRARY_PATH="$pkg/lib" ldd "$pkg/lib/libvmod_wasm.so" | tee /tmp/ldd.txt | |
| grep "libwasmtime.so.*=>.*$pkg/lib" /tmp/ldd.txt | |
| ' | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-varnish9-${{ matrix.arch }} | |
| path: dist/ | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Extract release metadata | |
| id: version | |
| shell: bash | |
| run: | | |
| case "$GITHUB_REF_NAME" in | |
| varnish9-v*) version="${GITHUB_REF_NAME#varnish9-v}" ;; | |
| *) | |
| echo "::error::Release tags must match varnish9-vX.Y.Z" | |
| exit 1 | |
| ;; | |
| esac | |
| if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then | |
| echo "::error::Invalid release version: $version" | |
| exit 1 | |
| fi | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "artifact_prefix=vmod-wasm-varnish9-$version" >> "$GITHUB_OUTPUT" | |
| - name: Build release notes | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }} | |
| WASMTIME_VERSION: ${{ env.WASMTIME_VERSION }} | |
| VARNISH_VERSION: ${{ env.VARNISH_VERSION }} | |
| run: | | |
| python3 - <<'PY' | |
| import os | |
| version = os.environ["VERSION"] | |
| artifact_prefix = os.environ["ARTIFACT_PREFIX"] | |
| wasmtime_version = os.environ["WASMTIME_VERSION"] | |
| varnish_version = os.environ["VARNISH_VERSION"] | |
| tag = os.environ["GITHUB_REF_NAME"] | |
| lines = open("CHANGELOG.md", encoding="utf-8").read().splitlines() | |
| notes = [] | |
| found = False | |
| for line in lines: | |
| if line.startswith("## ["): | |
| if found: | |
| break | |
| found = line.startswith(f"## [{version}]") | |
| continue | |
| if found: | |
| notes.append(line) | |
| changelog = "\n".join(notes).strip() or "See the repository changelog for details." | |
| body = "\n".join([ | |
| f"# Varnish 9 / v{version}", | |
| "", | |
| f"This release targets Varnish 9.x and bundles Wasmtime {wasmtime_version}.", | |
| f"Use the `{tag}` release channel for Varnish 9-compatible builds.", | |
| "", | |
| "## Compatibility", | |
| f"- Varnish: 9.x, validated with `varnish:{varnish_version}`", | |
| f"- Wasmtime: {wasmtime_version}, bundled in binary tarballs", | |
| "- Platforms: linux/amd64 and linux/arm64", | |
| "- VCL API: no compatibility break from v4.3.0", | |
| "", | |
| "## Changes", | |
| changelog, | |
| "", | |
| "## Assets", | |
| f"- `{artifact_prefix}-src.tar.gz`", | |
| f"- `{artifact_prefix}-linux-amd64.tar.gz`", | |
| f"- `{artifact_prefix}-linux-arm64.tar.gz`", | |
| f"- `{artifact_prefix}-examples-wasm.tar.gz`", | |
| f"- `manifest-varnish9-{version}.json`", | |
| "- `SHA256SUMS`", | |
| "", | |
| "## Verification", | |
| f"Binary bundles are smoke tested in a fresh `varnish:{varnish_version}` container,", | |
| "including an `ldd` check that `libvmod_wasm.so` resolves the bundled `libwasmtime.so`.", | |
| "`SHA256SUMS` covers all release tarballs and the manifest.", | |
| "", | |
| ]) | |
| open("release-notes.md", "w", encoding="utf-8").write(body) | |
| PY | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Build manifest and checksums | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| mkdir -p release-dist | |
| cp dist/*.tar.gz release-dist/ | |
| python3 - <<'PY' | |
| import glob | |
| import json | |
| import os | |
| version = os.environ["VERSION"] | |
| metadata = {} | |
| for path in sorted(glob.glob("dist/metadata-linux-*.env")): | |
| entry = {} | |
| with open(path, encoding="utf-8") as fh: | |
| for line in fh: | |
| key, _, value = line.strip().partition("=") | |
| if key: | |
| entry[key] = value | |
| if "arch" in entry: | |
| metadata[entry["arch"]] = entry | |
| manifest = { | |
| "name": "vmod-wasm", | |
| "version": version, | |
| "release_channel": "varnish9", | |
| "tag": os.environ["GITHUB_REF_NAME"], | |
| "git_sha": os.environ["GITHUB_SHA"], | |
| "support": { | |
| "varnish": "9.x", | |
| "wasmtime": "44.0.0", | |
| "platforms": ["linux/amd64", "linux/arm64"], | |
| }, | |
| "builds": metadata, | |
| "artifacts": sorted( | |
| os.path.basename(path) | |
| for path in glob.glob("release-dist/*.tar.gz") | |
| ), | |
| } | |
| with open(f"release-dist/manifest-varnish9-{version}.json", "w", encoding="utf-8") as fh: | |
| json.dump(manifest, fh, indent=2) | |
| fh.write("\n") | |
| PY | |
| cd release-dist | |
| sha256sum *.tar.gz "manifest-varnish9-${VERSION}.json" > SHA256SUMS | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" \ | |
| --title "Varnish 9 / v${VERSION}" \ | |
| --notes-file release-notes.md \ | |
| release-dist/* |