chore(release): add signed checksums for v1.7.0 #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| # Run required checks before creating release | |
| pre-commit: | |
| uses: ./.github/workflows/pre-commit.yaml | |
| tests: | |
| uses: ./.github/workflows/test.yaml | |
| create-release: | |
| needs: [pre-commit, tests] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| version: ${{ steps.get_version.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7.0.1 | |
| - name: Get version | |
| id: get_version | |
| run: | | |
| if [[ $GITHUB_REF == refs/tags/* ]]; then | |
| VERSION=${GITHUB_REF#refs/tags/} | |
| else | |
| VERSION=$(git describe --tags --always) | |
| fi | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| echo "Version: ${VERSION}" | |
| - name: Extract release notes from CHANGELOG | |
| id: extract_notes | |
| run: | | |
| VERSION=${{ steps.get_version.outputs.version }} | |
| # Extract notes for this version from CHANGELOG.md | |
| if [ -f CHANGELOG.md ]; then | |
| # Get content between version header and next version or end | |
| NOTES=$(awk "/## \[${VERSION#v}\]/{flag=1; next} /## \[/{flag=0} flag" CHANGELOG.md) | |
| if [ -z "$NOTES" ]; then | |
| NOTES="Release ${VERSION}"$'\n\n'"Built with Neutrino v0.18.0"$'\n\n'"See [CHANGELOG.md](CHANGELOG.md) for details." | |
| fi | |
| else | |
| NOTES="Release ${VERSION}" | |
| fi | |
| echo "notes<<EOF" >> $GITHUB_OUTPUT | |
| echo "$NOTES" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Create Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create ${{ steps.get_version.outputs.version }} \ | |
| --title "${{ steps.get_version.outputs.version }}" \ | |
| --notes-file - <<'EOF' | |
| ${{ steps.extract_notes.outputs.notes }} | |
| EOF | |
| build-binaries: | |
| needs: create-release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| strategy: | |
| matrix: | |
| include: | |
| - goos: linux | |
| goarch: amd64 | |
| output: neutrinod-linux-amd64 | |
| - goos: linux | |
| goarch: 386 | |
| output: neutrinod-linux-386 | |
| - goos: linux | |
| goarch: arm64 | |
| output: neutrinod-linux-arm64 | |
| - goos: linux | |
| goarch: arm | |
| goarm: 7 | |
| output: neutrinod-linux-armv7 | |
| - goos: linux | |
| goarch: arm | |
| goarm: 6 | |
| output: neutrinod-linux-armv6 | |
| - goos: darwin | |
| goarch: amd64 | |
| output: neutrinod-darwin-amd64 | |
| - goos: darwin | |
| goarch: arm64 | |
| output: neutrinod-darwin-arm64 | |
| - goos: windows | |
| goarch: amd64 | |
| output: neutrinod-windows-amd64.exe | |
| - goos: windows | |
| goarch: arm64 | |
| output: neutrinod-windows-arm64.exe | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7.0.1 | |
| - name: Get reproducible build timestamp | |
| id: source_date | |
| run: echo "epoch=$(git log -1 --pretty=%ct)" >> $GITHUB_OUTPUT | |
| - name: Set up Go | |
| uses: actions/setup-go@v7.0.0 | |
| with: | |
| go-version: '1.27.0' | |
| cache-dependency-path: neutrino_server/go.sum | |
| - name: Get dependencies | |
| working-directory: neutrino_server | |
| run: go mod download | |
| - name: Build binary | |
| working-directory: neutrino_server | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| GOARM: ${{ matrix.goarm }} | |
| CGO_ENABLED: 0 | |
| SOURCE_DATE_EPOCH: ${{ steps.source_date.outputs.epoch }} | |
| run: | | |
| VERSION=${{ needs.create-release.outputs.version }} | |
| go build \ | |
| -trimpath \ | |
| -buildvcs=false \ | |
| -ldflags="-buildid= -s -w -X main.version=${VERSION}" \ | |
| -o ${{ matrix.output }} \ | |
| ./cmd/neutrinod | |
| - name: Upload binary artifact | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: binary-${{ matrix.output }} | |
| path: neutrino_server/${{ matrix.output }} | |
| if-no-files-found: error | |
| build-docker: | |
| needs: create-release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7.0.1 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4.3.0 | |
| - name: Log in to Container registry | |
| uses: docker/login-action@v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6.2.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v7.3.0 | |
| with: | |
| context: ./neutrino_server | |
| file: ./neutrino_server/Dockerfile | |
| platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| VERSION=${{ needs.create-release.outputs.version }} | |
| BUILD_TIME=${{ github.event.repository.updated_at }} | |
| COMMIT=${{ github.sha }} | |
| checksums: | |
| needs: [create-release, build-binaries] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7.0.1 | |
| - name: Download built binaries | |
| uses: actions/download-artifact@v8.0.1 | |
| with: | |
| pattern: binary-* | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Generate checksums | |
| run: | | |
| cd artifacts | |
| sha256sum neutrinod-* | sort > SHA256SUMS | |
| cat SHA256SUMS | |
| - name: Verify signed checksums from repository | |
| run: | | |
| VERSION=${{ needs.create-release.outputs.version }} | |
| EXPECTED_DIR="signatures/${VERSION}" | |
| test -f "${EXPECTED_DIR}/SHA256SUMS" | |
| test -f "${EXPECTED_DIR}/SHA256SUMS.asc" | |
| diff -u "${EXPECTED_DIR}/SHA256SUMS" "artifacts/SHA256SUMS" | |
| for pubkey in signatures/pubkeys/*.asc; do | |
| gpg --import "$pubkey" | |
| done | |
| gpg --verify "${EXPECTED_DIR}/SHA256SUMS.asc" "artifacts/SHA256SUMS" | |
| - name: Upload binaries, checksums, and signature | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION=${{ needs.create-release.outputs.version }} | |
| gh release upload ${{ needs.create-release.outputs.version }} \ | |
| ./artifacts/neutrinod-* \ | |
| ./artifacts/SHA256SUMS \ | |
| "./signatures/${VERSION}/SHA256SUMS.asc" \ | |
| --repo ${{ github.repository }} |