mirror of
https://github.com/fosrl/newt.git
synced 2026-03-27 04:56:41 +00:00
Add workflow to publish APT repo to S3/CloudFront
This workflow automates the process of publishing an APT repository to S3/CloudFront upon release events. It includes steps for configuring AWS credentials, installing necessary tools, processing tags, building packages, and uploading the repository.
This commit is contained in:
Marc Schäfer
201
.github/workflows/publish-apt.yml
vendored
Normal file
201
.github/workflows/publish-apt.yml
vendored
Normal file
@@ -0,0 +1,201 @@
|
|||||||
|
name: Publish APT repo to S3/CloudFront
|
||||||
|
|
||||||
|
on:
|
||||||
|
release:
|
||||||
|
types: [published]
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
tag:
|
||||||
|
description: "Tag to publish (e.g. v1.9.0). Leave empty to use latest release."
|
||||||
|
required: false
|
||||||
|
type: string
|
||||||
|
backfill_all:
|
||||||
|
description: "Build/publish repo for ALL releases (can take a while)."
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
type: boolean
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
id-token: write
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
publish-apt:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
env:
|
||||||
|
PKG_NAME: newt
|
||||||
|
SUITE: stable
|
||||||
|
COMPONENT: main
|
||||||
|
REPO_BASE_URL: "https://repo.dev.fosrl.io/apt"
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Configure AWS credentials (OIDC)
|
||||||
|
uses: aws-actions/configure-aws-credentials@v4
|
||||||
|
with:
|
||||||
|
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
|
||||||
|
aws-region: ${{ vars.AWS_REGION }}
|
||||||
|
|
||||||
|
- name: Install tooling
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
sudo apt-get update
|
||||||
|
sudo apt-get install -y dpkg-dev apt-utils gnupg curl jq gh
|
||||||
|
|
||||||
|
# nfpm
|
||||||
|
curl -fsSL https://github.com/goreleaser/nfpm/releases/latest/download/nfpm_Linux_x86_64.tar.gz \
|
||||||
|
| sudo tar -xz -C /usr/local/bin nfpm
|
||||||
|
|
||||||
|
- name: Determine tags to process
|
||||||
|
id: tags
|
||||||
|
env:
|
||||||
|
GH_TOKEN: ${{ github.token }}
|
||||||
|
REPO: ${{ github.repository }}
|
||||||
|
EVENT_TAG: ${{ github.event.release.tag_name }}
|
||||||
|
INPUT_TAG: ${{ inputs.tag }}
|
||||||
|
BACKFILL: ${{ inputs.backfill_all }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
if [ "${BACKFILL}" = "true" ]; then
|
||||||
|
echo "Backfill mode: collecting all release tags..."
|
||||||
|
TAGS="$(gh release list -R "${REPO}" --limit 200 --json tagName --jq '.[].tagName')"
|
||||||
|
else
|
||||||
|
if [ -n "${INPUT_TAG}" ]; then
|
||||||
|
TAGS="${INPUT_TAG}"
|
||||||
|
elif [ -n "${EVENT_TAG}" ]; then
|
||||||
|
TAGS="${EVENT_TAG}"
|
||||||
|
else
|
||||||
|
echo "No tag provided; using latest release tag..."
|
||||||
|
TAGS="$(gh release view -R "${REPO}" --json tagName --jq '.tagName')"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Multi-line output for next steps
|
||||||
|
{
|
||||||
|
echo "tags<<EOF"
|
||||||
|
echo "${TAGS}"
|
||||||
|
echo "EOF"
|
||||||
|
} >> "${GITHUB_OUTPUT}"
|
||||||
|
|
||||||
|
- name: Import GPG key (APT signing)
|
||||||
|
env:
|
||||||
|
APT_GPG_PRIVATE_KEY: ${{ secrets.APT_GPG_PRIVATE_KEY }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
echo "${APT_GPG_PRIVATE_KEY}" | gpg --batch --import
|
||||||
|
gpg --list-secret-keys --keyid-format=long
|
||||||
|
|
||||||
|
- name: Pull existing repo from S3 (incremental)
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
mkdir -p repo/apt
|
||||||
|
BUCKET="${{ vars.S3_BUCKET }}"
|
||||||
|
PREFIX="${{ vars.S3_PREFIX }}"
|
||||||
|
aws s3 sync "s3://${BUCKET}/${PREFIX}apt/" repo/apt/ || true
|
||||||
|
|
||||||
|
- name: Build packages and update repo (for selected tags)
|
||||||
|
env:
|
||||||
|
GH_TOKEN: ${{ github.token }}
|
||||||
|
REPO: ${{ github.repository }}
|
||||||
|
TAGS: ${{ steps.tags.outputs.tags }}
|
||||||
|
APT_GPG_PASSPHRASE: ${{ secrets.APT_GPG_PASSPHRASE }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
KEYID="$(gpg --list-secret-keys --with-colons | awk -F: '$1=="sec"{print $5; exit}')"
|
||||||
|
test -n "${KEYID}"
|
||||||
|
|
||||||
|
mkdir -p assets build
|
||||||
|
|
||||||
|
# Iterate over tags safely (no bash <<< with GH expressions)
|
||||||
|
printf '%s\n' "${TAGS}" | while IFS= read -r TAG; do
|
||||||
|
[ -z "${TAG}" ] && continue
|
||||||
|
echo "=== Processing tag: ${TAG} ==="
|
||||||
|
|
||||||
|
rm -rf assets build
|
||||||
|
mkdir -p assets build
|
||||||
|
|
||||||
|
gh release download "${TAG}" -R "${REPO}" -p "newt_linux_amd64" -D assets
|
||||||
|
gh release download "${TAG}" -R "${REPO}" -p "newt_linux_arm64" -D assets
|
||||||
|
|
||||||
|
VERSION="${TAG#v}"
|
||||||
|
|
||||||
|
for arch in amd64 arm64; do
|
||||||
|
bin="assets/newt_linux_${arch}"
|
||||||
|
test -f "${bin}"
|
||||||
|
install -Dm755 "${bin}" "build/newt"
|
||||||
|
|
||||||
|
cat > nfpm.yaml <<'EOF'
|
||||||
|
name: newt
|
||||||
|
arch: ARCH_PLACEHOLDER
|
||||||
|
platform: linux
|
||||||
|
version: VERSION_PLACEHOLDER
|
||||||
|
section: net
|
||||||
|
priority: optional
|
||||||
|
maintainer: fosrl
|
||||||
|
description: Newt - userspace tunnel client and TCP/UDP proxy
|
||||||
|
contents:
|
||||||
|
- src: build/newt
|
||||||
|
dst: /usr/bin/newt
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Replace placeholders (avoid YAML/heredoc expression issues)
|
||||||
|
sed -i "s/ARCH_PLACEHOLDER/${arch}/" nfpm.yaml
|
||||||
|
sed -i "s/VERSION_PLACEHOLDER/${VERSION}/" nfpm.yaml
|
||||||
|
|
||||||
|
nfpm package -p deb -f nfpm.yaml -t "build/${PKG_NAME}_${VERSION}_${arch}.deb"
|
||||||
|
done
|
||||||
|
|
||||||
|
mkdir -p "repo/apt/pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}/"
|
||||||
|
cp -v build/*.deb "repo/apt/pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}/"
|
||||||
|
done
|
||||||
|
|
||||||
|
cd repo/apt
|
||||||
|
|
||||||
|
for arch in amd64 arm64; do
|
||||||
|
mkdir -p "dists/${SUITE}/${COMPONENT}/binary-${arch}"
|
||||||
|
dpkg-scanpackages -a "${arch}" pool > "dists/${SUITE}/${COMPONENT}/binary-${arch}/Packages"
|
||||||
|
gzip -fk "dists/${SUITE}/${COMPONENT}/binary-${arch}/Packages"
|
||||||
|
done
|
||||||
|
|
||||||
|
cat > apt-ftparchive.conf <<EOF
|
||||||
|
APT::FTPArchive::Release::Origin "fosrl";
|
||||||
|
APT::FTPArchive::Release::Label "newt";
|
||||||
|
APT::FTPArchive::Release::Suite "${SUITE}";
|
||||||
|
APT::FTPArchive::Release::Codename "${SUITE}";
|
||||||
|
APT::FTPArchive::Release::Architectures "amd64 arm64";
|
||||||
|
APT::FTPArchive::Release::Components "${COMPONENT}";
|
||||||
|
APT::FTPArchive::Release::Description "Newt APT repository";
|
||||||
|
EOF
|
||||||
|
|
||||||
|
apt-ftparchive -c apt-ftparchive.conf release "dists/${SUITE}" > "dists/${SUITE}/Release"
|
||||||
|
|
||||||
|
cd "dists/${SUITE}"
|
||||||
|
|
||||||
|
gpg --batch --yes --pinentry-mode loopback \
|
||||||
|
${APT_GPG_PASSPHRASE:+--passphrase "${APT_GPG_PASSPHRASE}"} \
|
||||||
|
--local-user "${KEYID}" \
|
||||||
|
--clearsign -o InRelease Release
|
||||||
|
|
||||||
|
gpg --batch --yes --pinentry-mode loopback \
|
||||||
|
${APT_GPG_PASSPHRASE:+--passphrase "${APT_GPG_PASSPHRASE}"} \
|
||||||
|
--local-user "${KEYID}" \
|
||||||
|
-abs -o Release.gpg Release
|
||||||
|
|
||||||
|
cd ../../..
|
||||||
|
gpg --batch --yes --armor --export "${KEYID}" > public.key
|
||||||
|
|
||||||
|
- name: Upload repo to S3
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
BUCKET="${{ vars.S3_BUCKET }}"
|
||||||
|
PREFIX="${{ vars.S3_PREFIX }}"
|
||||||
|
aws s3 sync repo/apt "s3://${BUCKET}/${PREFIX}apt/" --delete
|
||||||
|
|
||||||
|
- name: CloudFront invalidation (metadata only)
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
aws cloudfront create-invalidation \
|
||||||
|
--distribution-id "${{ vars.CLOUDFRONT_DISTRIBUTION_ID }}" \
|
||||||
|
--paths "/${{ vars.S3_PREFIX }}apt/dists/*" "/${{ vars.S3_PREFIX }}apt/public.key"
|
||||||
Reference in New Issue
Block a user