Skip to content

fix: harden vcl lifecycle for varnish9 v4.3.3 #14

fix: harden vcl lifecycle for varnish9 v4.3.3

fix: harden vcl lifecycle for varnish9 v4.3.3 #14

Workflow file for this run

name: Release
on:
push:
tags:
- 'varnish9-v*'
permissions:
contents: write
env:
WASMTIME_VERSION: 44.0.0
VARNISH_VERSION: 9.0.3
jobs:
build:
runs-on: ubuntu-latest
strategy:
matrix:
arch: [amd64, arm64]
steps:
- uses: actions/checkout@v6
- name: Set up QEMU
if: matrix.arch == 'arm64'
uses: docker/setup-qemu-action@v4
with:
platforms: arm64
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Build release image
run: |
docker buildx build \
--platform linux/${{ matrix.arch }} \
--load \
-t vmod-wasm-release-${{ matrix.arch }} .
- name: Extract release metadata
id: version
shell: bash
run: |
case "$GITHUB_REF_NAME" in
varnish9-v*) version="${GITHUB_REF_NAME#varnish9-v}" ;;
*)
echo "::error::Release tags must match varnish9-vX.Y.Z"
exit 1
;;
esac
if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
echo "::error::Invalid release version: $version"
exit 1
fi
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "artifact_prefix=vmod-wasm-varnish9-$version" >> "$GITHUB_OUTPUT"
- name: Package binary artifact
env:
VERSION: ${{ steps.version.outputs.version }}
ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }}
ARCH: ${{ matrix.arch }}
run: |
mkdir -p dist
docker run --rm --platform linux/${{ matrix.arch }} \
-e VERSION="$VERSION" \
-e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \
-e ARCH="$ARCH" \
-e WASMTIME_VERSION="${{ env.WASMTIME_VERSION }}" \
-e VARNISH_VERSION="${{ env.VARNISH_VERSION }}" \
-v "$PWD/dist:/dist" \
vmod-wasm-release-${{ matrix.arch }} sh -ceu '
pkg="/tmp/${ARTIFACT_PREFIX}-linux-${ARCH}"
mkdir -p "$pkg/lib" "$pkg/licenses"
cp /src/src/.libs/libvmod_wasm.so "$pkg/lib/"
cp -a /opt/wasmtime/lib/libwasmtime.so* "$pkg/lib/"
cp /src/LICENSE "$pkg/licenses/vmod-wasm-LICENSE"
cp /src/THIRD_PARTY_NOTICES.md "$pkg/licenses/"
cat > "$pkg/INSTALL.md" <<EOF
# vmod-wasm ${VERSION} for Varnish 9 on linux/${ARCH}
This bundle contains libvmod_wasm.so and the Wasmtime ${WASMTIME_VERSION}
runtime library it was built against.
Install both shared libraries into your VMOD/runtime library location or
keep this bundle together and expose the lib directory to varnishd:
export LD_LIBRARY_PATH=/path/to/${ARTIFACT_PREFIX}-linux-${ARCH}/lib:\$LD_LIBRARY_PATH
The VMOD is built and tested against Varnish ${VARNISH_VERSION}. Source
builds remain the authoritative path for custom Varnish installations.
EOF
tar -czf "/dist/${ARTIFACT_PREFIX}-linux-${ARCH}.tar.gz" \
-C /tmp "${ARTIFACT_PREFIX}-linux-${ARCH}"
{
echo "arch=${ARCH}"
echo "varnish_version=$(/usr/sbin/varnishd -V 2>&1 | head -n1)"
echo "wasmtime_version=${WASMTIME_VERSION}"
echo "rust_version=$(rustc --version)"
} > "/dist/metadata-linux-${ARCH}.env"
'
- name: Package source and example Wasm artifacts
if: matrix.arch == 'amd64'
env:
VERSION: ${{ steps.version.outputs.version }}
ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} \
-e VERSION="$VERSION" \
-e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \
-v "$PWD/dist:/dist" \
vmod-wasm-release-${{ matrix.arch }} sh -ceu '
make dist
cp "vmod-wasm-${VERSION}.tar.gz" "/dist/${ARTIFACT_PREFIX}-src.tar.gz"
tmp="/tmp/${ARTIFACT_PREFIX}-examples-wasm"
mkdir -p "$tmp"
cp /src/tests/wasm/*.wasm "$tmp/"
cp /src/examples/edge-security-filter/config.json "$tmp/edge-security-filter-config.json"
tar -czf "/dist/${ARTIFACT_PREFIX}-examples-wasm.tar.gz" \
-C /tmp "${ARTIFACT_PREFIX}-examples-wasm"
'
- name: Smoke test binary bundle
env:
ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }}
ARCH: ${{ matrix.arch }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} \
-e ARTIFACT_PREFIX="$ARTIFACT_PREFIX" \
-e ARCH="$ARCH" \
-v "$PWD/dist:/dist" \
varnish:${{ env.VARNISH_VERSION }} sh -ceu '
pkg="/tmp/pkg/${ARTIFACT_PREFIX}-linux-${ARCH}"
mkdir -p /tmp/pkg
tar -xzf "/dist/${ARTIFACT_PREFIX}-linux-${ARCH}.tar.gz" -C /tmp/pkg
LD_LIBRARY_PATH="$pkg/lib" ldd "$pkg/lib/libvmod_wasm.so" | tee /tmp/ldd.txt
grep "libwasmtime.so.*=>.*$pkg/lib" /tmp/ldd.txt
'
- name: Upload artifacts
uses: actions/upload-artifact@v7
with:
name: release-varnish9-${{ matrix.arch }}
path: dist/
release:
runs-on: ubuntu-latest
needs: build
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Extract release metadata
id: version
shell: bash
run: |
case "$GITHUB_REF_NAME" in
varnish9-v*) version="${GITHUB_REF_NAME#varnish9-v}" ;;
*)
echo "::error::Release tags must match varnish9-vX.Y.Z"
exit 1
;;
esac
if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
echo "::error::Invalid release version: $version"
exit 1
fi
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "artifact_prefix=vmod-wasm-varnish9-$version" >> "$GITHUB_OUTPUT"
- name: Build release notes
env:
VERSION: ${{ steps.version.outputs.version }}
ARTIFACT_PREFIX: ${{ steps.version.outputs.artifact_prefix }}
WASMTIME_VERSION: ${{ env.WASMTIME_VERSION }}
VARNISH_VERSION: ${{ env.VARNISH_VERSION }}
run: |
python3 - <<'PY'
import os
version = os.environ["VERSION"]
artifact_prefix = os.environ["ARTIFACT_PREFIX"]
wasmtime_version = os.environ["WASMTIME_VERSION"]
varnish_version = os.environ["VARNISH_VERSION"]
tag = os.environ["GITHUB_REF_NAME"]
lines = open("CHANGELOG.md", encoding="utf-8").read().splitlines()
notes = []
found = False
for line in lines:
if line.startswith("## ["):
if found:
break
found = line.startswith(f"## [{version}]")
continue
if found:
notes.append(line)
changelog = "\n".join(notes).strip() or "See the repository changelog for details."
body = "\n".join([
f"# Varnish 9 / v{version}",
"",
f"This release targets Varnish 9.x and bundles Wasmtime {wasmtime_version}.",
f"Use the `{tag}` release channel for Varnish 9-compatible builds.",
"",
"## Compatibility",
f"- Varnish: 9.x, validated with `varnish:{varnish_version}`",
f"- Wasmtime: {wasmtime_version}, bundled in binary tarballs",
"- Platforms: linux/amd64 and linux/arm64",
"- VCL API: no compatibility break from v4.3.0",
"",
"## Changes",
changelog,
"",
"## Assets",
f"- `{artifact_prefix}-src.tar.gz`",
f"- `{artifact_prefix}-linux-amd64.tar.gz`",
f"- `{artifact_prefix}-linux-arm64.tar.gz`",
f"- `{artifact_prefix}-examples-wasm.tar.gz`",
f"- `manifest-varnish9-{version}.json`",
"- `SHA256SUMS`",
"",
"## Verification",
f"Binary bundles are smoke tested in a fresh `varnish:{varnish_version}` container,",
"including an `ldd` check that `libvmod_wasm.so` resolves the bundled `libwasmtime.so`.",
"`SHA256SUMS` covers all release tarballs and the manifest.",
"",
])
open("release-notes.md", "w", encoding="utf-8").write(body)
PY
- name: Download all artifacts
uses: actions/download-artifact@v8
with:
path: dist
merge-multiple: true
- name: Build manifest and checksums
env:
VERSION: ${{ steps.version.outputs.version }}
run: |
mkdir -p release-dist
cp dist/*.tar.gz release-dist/
python3 - <<'PY'
import glob
import json
import os
version = os.environ["VERSION"]
metadata = {}
for path in sorted(glob.glob("dist/metadata-linux-*.env")):
entry = {}
with open(path, encoding="utf-8") as fh:
for line in fh:
key, _, value = line.strip().partition("=")
if key:
entry[key] = value
if "arch" in entry:
metadata[entry["arch"]] = entry
manifest = {
"name": "vmod-wasm",
"version": version,
"release_channel": "varnish9",
"tag": os.environ["GITHUB_REF_NAME"],
"git_sha": os.environ["GITHUB_SHA"],
"support": {
"varnish": "9.x",
"wasmtime": "44.0.0",
"platforms": ["linux/amd64", "linux/arm64"],
},
"builds": metadata,
"artifacts": sorted(
os.path.basename(path)
for path in glob.glob("release-dist/*.tar.gz")
),
}
with open(f"release-dist/manifest-varnish9-{version}.json", "w", encoding="utf-8") as fh:
json.dump(manifest, fh, indent=2)
fh.write("\n")
PY
cd release-dist
sha256sum *.tar.gz "manifest-varnish9-${VERSION}.json" > SHA256SUMS
- name: Create GitHub Release
env:
GH_TOKEN: ${{ github.token }}
VERSION: ${{ steps.version.outputs.version }}
run: |
gh release create "$GITHUB_REF_NAME" \
--title "Varnish 9 / v${VERSION}" \
--notes-file release-notes.md \
release-dist/*