2026.06.22.2046 #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Runs when a drafted GitHub Release is published (see .github/workflows/ | |
| # draft-release.yml). Builds the plugin package + .plg, injects the release's | |
| # categorized changelog into the .plg <CHANGES> block, commits the built .plg | |
| # back to main (so the pluginURL serves accurate metadata + changelog), and | |
| # uploads the .txz asset to the release. | |
| # | |
| # Prereqs (one-time): | |
| # - Repo Settings -> Actions -> "Read and write permissions". | |
| on: | |
| release: | |
| types: | |
| - published | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Existing release tag to (re)build, e.g. 2026.05.27.1742' | |
| required: true | |
| permissions: | |
| contents: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| - name: Resolve release | |
| id: rel | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ github.event_name }}" = "release" ]; then | |
| TAG='${{ github.event.release.tag_name }}' | |
| else | |
| TAG='${{ inputs.tag }}' | |
| fi | |
| if [ -z "$TAG" ]; then | |
| echo "::error::No release tag to build." | |
| exit 1 | |
| fi | |
| # Fetch the drafted/published body via the API (avoids interpolating | |
| # untrusted release text straight into the shell). | |
| gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json body --jq .body \ | |
| > /tmp/release_body.md || true | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| - name: Build .txz + finalized .plg | |
| env: | |
| VERSION: ${{ steps.rel.outputs.tag }} | |
| run: ./scripts/build.sh | |
| - name: Inject changelog into <CHANGES> | |
| env: | |
| TAG: ${{ steps.rel.outputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| python3 - "$TAG" <<'PY' | |
| import re, sys, pathlib | |
| tag = sys.argv[1] | |
| MAX_ENTRIES = 12 | |
| FOOTER = "Older releases: https://github.com/netbirdio/netbird-unraid/releases" | |
| notes_path = pathlib.Path("/tmp/release_body.md") | |
| body = notes_path.read_text() if notes_path.exists() else "" | |
| body = body.replace("\r\n", "\n").replace("\r", "\n").strip() | |
| if not body: | |
| body = "- Maintenance release." | |
| # Demote any ATX headings in the body two levels so they render smaller | |
| # than the "### <version>" heading we add below. | |
| body = re.sub( | |
| r"(?m)^(#{1,6})(?=\s)", | |
| lambda m: "#" * min(len(m.group(1)) + 2, 6), | |
| body, | |
| ) | |
| new_entry = f"### {tag}\n\n{body}" | |
| plg = pathlib.Path("plugin/netbird.plg") | |
| src = plg.read_text() | |
| m = re.search( | |
| r"(<CHANGES>\s*<!\[CDATA\[\n)(.*?)(\n\]\]>\s*</CHANGES>)", | |
| src, | |
| re.S, | |
| ) | |
| if not m: | |
| raise SystemExit("Could not locate <CHANGES> CDATA block in netbird.plg") | |
| inner = m.group(2) | |
| # Drop any existing footer line; we re-add a single one at the bottom. | |
| inner = re.sub(r"(?m)^Older releases:.*$", "", inner) | |
| # Split the existing history into version blocks, newest first. | |
| blocks = [b.strip("\n") for b in re.split(r"(?m)(?=^### )", inner) if b.strip()] | |
| blocks = [new_entry] + blocks | |
| blocks = blocks[:MAX_ENTRIES] | |
| new_inner = "\n" + "\n\n".join(blocks) + "\n\n" + FOOTER + "\n" | |
| new_src = src[: m.start()] + m.group(1) + new_inner + m.group(3) + src[m.end() :] | |
| plg.write_text(new_src) | |
| PY | |
| echo "--- new CHANGES head ---" | |
| sed -n '/<CHANGES>/,/<\/CHANGES>/p' plugin/netbird.plg | head -20 | |
| - name: Rebuild so dist/.plg has the new CHANGES | |
| env: | |
| VERSION: ${{ steps.rel.outputs.tag }} | |
| run: ./scripts/build.sh >/dev/null | |
| - name: Commit built .plg to main | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| # The finalized .plg in dist/ has the version + package SHA256 + new | |
| # CHANGES substituted in. Copy it over the source so the pluginURL on | |
| # main serves accurate update metadata. | |
| cp dist/netbird.plg plugin/netbird.plg | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add plugin/netbird.plg | |
| if git commit -m "release ${{ steps.rel.outputs.tag }}"; then | |
| git push origin HEAD:main | |
| else | |
| echo "No .plg changes to commit." | |
| fi | |
| - name: Upload package to release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| PKG=$(ls dist/unraid-netbird-utils-*.txz | head -1) | |
| gh release upload "${{ steps.rel.outputs.tag }}" "$PKG" \ | |
| --repo "$GITHUB_REPOSITORY" --clobber |