Publish release bundles from GitHub Actions

Author: terion-labs

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing git tag to publish
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - x64
+          - arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build Terrarium binary
+        run: |
+          mkdir -p release/dist
+          bun build --compile --target=bun-linux-${{ matrix.arch }} scripts/terrariumctl.ts --outfile release/dist/terrariumctl
+
+      - name: Package release bundle
+        run: |
+          cd release
+          zip -rq "../terrarium-linux-${{ matrix.arch }}.zip" dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: terrarium-linux-${{ matrix.arch }}
+          path: terrarium-linux-${{ matrix.arch }}.zip
+          if-no-files-found: error
+
+  publish:
+    runs-on: ubuntu-24.04
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Resolve release tag
+        id: tag
+        env:
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+        run: |
+          if [ -n "${INPUT_TAG}" ]; then
+            echo "value=${INPUT_TAG}" >> "${GITHUB_OUTPUT}"
+          else
+            echo "value=${GITHUB_REF_NAME}" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Prepare release assets
+        env:
+          RELEASE_TAG: ${{ steps.tag.outputs.value }}
+        run: |
+          mkdir -p release-assets
+          cp artifacts/terrarium-linux-x64/terrarium-linux-x64.zip release-assets/
+          cp artifacts/terrarium-linux-arm64/terrarium-linux-arm64.zip release-assets/
+          sed "s|^EMBEDDED_BOOTSTRAP_REF=\"\" # TERRARIUM_RELEASE_REF$|EMBEDDED_BOOTSTRAP_REF=\"${RELEASE_TAG}\" # TERRARIUM_RELEASE_REF|" install.sh > release-assets/install.sh
+          chmod 0644 release-assets/install.sh
+          (
+            cd release-assets
+            sha256sum terrarium-linux-x64.zip terrarium-linux-arm64.zip install.sh > SHA256SUMS
+          )
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.value }}
+          files: |
+            release-assets/install.sh
+            release-assets/terrarium-linux-x64.zip
+            release-assets/terrarium-linux-arm64.zip
+            release-assets/SHA256SUMS
+          generate_release_notes: true
+          prerelease: ${{ contains(steps.tag.outputs.value, '-') }}

README.md

@@ -12,10 +12,16 @@ The goal is simple: make a single VPS feel safe enough for experimentation, capa
 ## Install:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/terion-name/terrarium/refs/heads/main/install.sh | bash
+curl -fsSL https://github.com/terion-name/terrarium/releases/latest/download/install.sh | bash
 ```
 
-The shell bootstrap is intentionally thin. It downloads a compiled `terrariumctl` bundle from GitHub Releases when possible, clones the Terrarium repo into `/opt/terrarium`, stages the bundled binary into that checkout, and falls back to a source build only when you target a branch-like `--ref` such as `main`.
+The shell bootstrap is intentionally thin. The release-published `install.sh` is pinned to the release it came from, downloads the matching compiled `terrariumctl` bundle from GitHub Releases, clones the Terrarium repo into `/opt/terrarium`, and stages that binary into the checkout. If you explicitly target a branch-like `--ref` such as `main`, it falls back to a source build.
+
+If you want to pin a specific release instead of `latest`, use the tagged release asset directly:
+
+```bash
+curl -fsSL https://github.com/terion-name/terrarium/releases/download/0.0.0-beta1/install.sh | bash
+```
 
 Terrarium provisions the host with:
 
@@ -41,13 +47,13 @@ Terrarium provisions the host with:
 Interactive:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/terion-name/terrarium/refs/heads/main/install.sh | bash
+curl -fsSL https://github.com/terion-name/terrarium/releases/latest/download/install.sh | bash
 ```
 
 Non-interactive:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/terion-name/terrarium/refs/heads/main/install.sh | bash -s -- \
+curl -fsSL https://github.com/terion-name/terrarium/releases/latest/download/install.sh | bash -s -- \
   --non-interactive \
   --email admin@your-domain.tld \
   --acme-email certs@your-domain.tld \

docs/architecture.md

@@ -3,7 +3,7 @@
 Terrarium is intentionally split into three layers:
 
 1. `install.sh`
-   Thin bootstrap only. It downloads a compiled `terrariumctl` bundle from Releases when possible and falls back to a source build only for branch-like refs.
+   Thin bootstrap only. The release-published installer is pinned to its own release, downloads the matching compiled `terrariumctl` bundle from Releases, and falls back to a source build only for branch-like refs.
 2. `terrariumctl`
    Single Terrarium binary. It provides `install`, `backup`, `proxy`, `idp`, and maintenance subcommands, clones or updates the Terrarium repository into `/opt/terrarium`, stages the compiled binary into that checkout, and invokes Ansible locally when needed.
 3. Ansible

install.sh

@@ -4,8 +4,14 @@ set -Eeuo pipefail
 REPO_URL="${TERRARIUM_REPO_URL:-https://github.com/terion-name/terrarium.git}"
 GITHUB_REPO="${TERRARIUM_GITHUB_REPO:-terion-name/terrarium}"
 REF=""
+EMBEDDED_BOOTSTRAP_REF="" # TERRARIUM_RELEASE_REF
+BOOTSTRAP_REF="${TERRARIUM_BOOTSTRAP_REF:-}"
 TMPDIR_PATH=""
 
+if [[ -z "${BOOTSTRAP_REF}" && -n "${EMBEDDED_BOOTSTRAP_REF}" ]]; then
+  BOOTSTRAP_REF="${EMBEDDED_BOOTSTRAP_REF}"
+fi
+
 usage() {
   cat <<'EOF'
 Usage: install.sh [options]
@@ -16,7 +22,8 @@ Usage: install.sh [options]
 All other flags are forwarded to `terrariumctl install`.
 
 Behavior:
-  - without --ref, the bootstrap downloads the latest Terrarium release bundle
+  - without --ref, the bootstrap downloads the bundled release when the installer is release-pinned
+  - otherwise without --ref, it downloads the latest Terrarium release bundle
   - with a tag-like --ref, it downloads that release bundle
   - with a branch-like --ref (for example main), it falls back to a source build
 EOF
@@ -159,6 +166,9 @@ main() {
   arch="$(detect_arch)"
 
   if [[ -z "${REF}" ]]; then
+    if [[ -n "${BOOTSTRAP_REF}" ]] && download_release_bundle "${tmpdir}" "${arch}" "${BOOTSTRAP_REF}"; then
+      exit 0
+    fi
     resolved_ref="$(resolve_latest_tag)"
     if [[ -n "${resolved_ref}" ]] && download_release_bundle "${tmpdir}" "${arch}" "${resolved_ref}"; then
       exit 0