terrarium/.github/workflows/release.yml at 034fc868d92863e4d4f1c65b16584b869bca6fa0 · terion-labs/terrarium · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: release

on:
  push:
    tags:
      - "*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing git tag to publish
        required: true

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  release_tag:
    runs-on: ubuntu-24.04
    outputs:
      value: ${{ steps.tag.outputs.value }}
    steps:
      - name: Resolve release tag
        id: tag
        env:
          INPUT_TAG: ${{ github.event.inputs.tag }}
        run: |
          if [ -n "${INPUT_TAG}" ]; then
            RELEASE_TAG="${INPUT_TAG}"
          else
            RELEASE_TAG="${GITHUB_REF_NAME}"
          fi

          if ! [[ "${RELEASE_TAG}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
            echo "Invalid release tag: ${RELEASE_TAG}" >&2
            echo "Release tags may only contain letters, numbers, '.', '_', and '-'." >&2
            exit 1
          fi

          printf 'value=%s\n' "${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"

  integration_preflight:
    needs: release_tag
    uses: ./.github/workflows/integration-full.yml
    secrets: inherit
    with:
      release_preflight: true

  build:
    runs-on: ubuntu-24.04
    needs:
      - release_tag
      - integration_preflight
    strategy:
      fail-fast: false
      matrix:
        arch:
          - x64
          - arm64
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build Terrarium binary
        env:
          TERRARIUM_VERSION: ${{ needs.release_tag.outputs.value }}
        run: |
          mkdir -p release/dist
          bun scripts/build.ts
          bun build --compile --target=bun-linux-${{ matrix.arch }} scripts/terrariumctl.ts --outfile release/dist/terrariumctl

      - name: Package release bundle
        run: |
          cp -a ansible release/ansible
          rm -rf release/ansible/.ansible
          cd release
          zip -rq "../terrarium-linux-${{ matrix.arch }}.zip" dist ansible

      - uses: actions/upload-artifact@v4
        with:
          name: terrarium-linux-${{ matrix.arch }}
          path: terrarium-linux-${{ matrix.arch }}.zip
          if-no-files-found: error

  publish:
    runs-on: ubuntu-24.04
    needs:
      - release_tag
      - build
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Prepare release assets
        env:
          RELEASE_TAG: ${{ needs.release_tag.outputs.value }}
        run: |
          mkdir -p release-assets
          cp artifacts/terrarium-linux-x64/terrarium-linux-x64.zip release-assets/
          cp artifacts/terrarium-linux-arm64/terrarium-linux-arm64.zip release-assets/
          python3 - <<'PY'
          from pathlib import Path
          import os
          import shlex

          release_tag = os.environ["RELEASE_TAG"]
          source = Path("install.sh").read_text()
          needle = 'EMBEDDED_BOOTSTRAP_REF="" # TERRARIUM_RELEASE_REF'
          replacement = f"EMBEDDED_BOOTSTRAP_REF={shlex.quote(release_tag)} # TERRARIUM_RELEASE_REF"
          if needle not in source:
              raise SystemExit("install.sh release placeholder not found")
          Path("release-assets/install.sh").write_text(source.replace(needle, replacement, 1))
          PY
          chmod 0644 release-assets/install.sh
          (
            cd release-assets
            sha256sum terrarium-linux-x64.zip terrarium-linux-arm64.zip install.sh > SHA256SUMS
          )

      - name: Generate release bundle attestations
        id: release_attestations
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: |
            release-assets/install.sh
            release-assets/SHA256SUMS
            release-assets/terrarium-linux-x64.zip
            release-assets/terrarium-linux-arm64.zip

      - name: Stage release attestation bundle
        run: cp "${{ steps.release_attestations.outputs.bundle-path }}" release-assets/terrarium-release-attestation.sigstore.json

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release_tag.outputs.value }}
          files: |
            release-assets/install.sh
            release-assets/terrarium-linux-x64.zip
            release-assets/terrarium-linux-arm64.zip
            release-assets/SHA256SUMS
            release-assets/terrarium-release-attestation.sigstore.json
          generate_release_notes: true
          prerelease: ${{ contains(needs.release_tag.outputs.value, '-') }}