gitlab-ci-local/.github/workflows/release.yml at 152709fc26dad1cbbc8a48182be395de01ab08bc · firecow/gitlab-ci-local · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
---
name: release
on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run (npm --dry-run, draft release, skip R2 upload)'
        type: boolean
        default: true

env:
  PKG_CACHE_PATH: .pkg
  DRY_RUN: ${{ inputs.dry-run || false }}

jobs:
  release:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Set version from tag
        run: |
          sed -i "s/0.0.0/${GITHUB_REF_NAME}/g" package.json src/index.ts

      - uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - uses: actions/cache@v5.0.3
        with:
          path: ${{ env.PKG_CACHE_PATH }}
          key: pkg-cache

      - run: npm ci
      - run: npm run build
      - run: npm run esbuild
      - run: npm run pkg-all

      - name: Install rclone
        run: sudo apt-get update && sudo apt-get install -y rclone

      - name: Download existing ppa from R2
        run: >
          rclone copy
          :s3,provider=Cloudflare,access_key_id=${R2_ACCESS_KEY_ID},secret_access_key=${R2_SECRET_ACCESS_KEY},endpoint=${R2_ENDPOINT},no_check_bucket=true:${R2_BUCKET}/
          ppa/
        env:
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}

      - name: Import GPG key and preset passphrase
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --batch --import
          echo "allow-preset-passphrase" >> ~/.gnupg/gpg-agent.conf
          gpgconf --kill gpg-agent
          gpgconf --launch gpg-agent
          for keygrip in $(gpg --list-secret-keys --with-keygrip --with-colons madsjon@gmail.com | awk -F: '/grp/{print $10}'); do
            /usr/lib/gnupg/gpg-preset-passphrase --preset --passphrase "${GPG_PASSPHRASE}" "$keygrip"
          done
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Build .deb and sign
        run: ./publish-deb

      - name: Publish to npm
        run: npm publish --provenance ${{ env.DRY_RUN == 'true' && '--dry-run' || '' }}

      - name: Create GitHub Release
        run: >
          gh release create "${GITHUB_REF_NAME}" bin/*.gz --generate-notes
          ${{ env.DRY_RUN == 'true' && '--draft' || '' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload ppa to Cloudflare R2
        if: env.DRY_RUN != 'true'
        run: >
          rclone copy ppa/
          :s3,provider=Cloudflare,access_key_id=${R2_ACCESS_KEY_ID},secret_access_key=${R2_SECRET_ACCESS_KEY},endpoint=${R2_ENDPOINT},no_check_bucket=true:${R2_BUCKET}/
        env:
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}