Automate StartOS package releases

.gitea/workflows/build-startos.yaml

@@ -0,0 +1,137 @@
+name: Build and deploy StartOS package
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*_*'
+  workflow_dispatch:
+    inputs:
+      deploy:
+        description: Install the built package on StartOS
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: startos-build
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install StartOS packaging tools
+        run: |
+          set -euo pipefail
+
+          if ! command -v mksquashfs >/dev/null; then
+            if ! command -v apt-get >/dev/null; then
+              echo "Cannot install mksquashfs: this runner does not provide apt-get." >&2
+              exit 1
+            fi
+
+            if [ "$(id -u)" -eq 0 ]; then
+              apt-get -o APT::Sandbox::User=root update
+              apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
+            elif command -v sudo >/dev/null; then
+              sudo apt-get -o APT::Sandbox::User=root update
+              sudo apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
+            else
+              echo "Cannot install mksquashfs: root access or sudo is required." >&2
+              exit 1
+            fi
+          fi
+
+          if ! command -v start-cli >/dev/null; then
+            curl --fail --silent --show-error --location \
+              https://start9.com/start-cli/install.sh \
+              | sh
+          fi
+
+          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+
+      - name: Verify runner prerequisites
+        run: |
+          set -euo pipefail
+
+          for command in docker make mksquashfs npm start-cli; do
+            command -v "${command}" >/dev/null || {
+              echo "Missing runner prerequisite: ${command}" >&2
+              exit 1
+            }
+          done
+
+          docker info >/dev/null
+
+      - name: Restore package signing key
+        env:
+          S9PK_BUILD_KEY_BASE64: ${{ secrets.S9PK_BUILD_KEY_BASE64 }}
+        run: |
+          set -euo pipefail
+
+          : "${S9PK_BUILD_KEY_BASE64:?S9PK_BUILD_KEY_BASE64 is required}"
+
+          workspace_dir="$(dirname "${GITHUB_WORKSPACE}")"
+          install -d -m 700 "${workspace_dir}/.startos"
+          printf '%s' "${S9PK_BUILD_KEY_BASE64}" \
+            | base64 --decode \
+            > "${workspace_dir}/.startos/build.key.pem"
+          chmod 600 "${workspace_dir}/.startos/build.key.pem"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate release tag
+        if: startsWith(github.ref, 'refs/tags/')
+        run: ./scripts/check-release-version.sh "${GITHUB_REF_NAME}"
+
+      - name: Inspect runtime
+        run: |
+          set -euo pipefail
+          docker info --format 'Cgroup driver: {{.CgroupDriver}}'
+          docker version
+          docker buildx version
+
+      - name: Build x86_64 package
+        run: make x86
+
+      - name: Verify package manifest
+        run: |
+          set -euo pipefail
+
+          test -s todo-back_x86_64.s9pk
+          start-cli s9pk inspect todo-back_x86_64.s9pk manifest
+          sha256sum todo-back_x86_64.s9pk
+
+      # Gitea currently works most consistently with the v3 artifact protocol.
+      - name: Upload workflow artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: todo-back-x86_64-${{ github.sha }}
+          path: todo-back_x86_64.s9pk
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Install release on StartOS
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.deploy == 'true'
+        env:
+          STARTOS_HOST: ${{ secrets.STARTOS_HOST }}
+        run: |
+          set -euo pipefail
+
+          : "${STARTOS_HOST:?STARTOS_HOST is required}"
+          start-cli \
+            --host "${STARTOS_HOST}" \
+            package install \
+            --sideload todo-back_x86_64.s9pk

README.md

@@ -38,6 +38,8 @@ make x86
 
 The resulting `todo-back_x86_64.s9pk` can be uploaded from StartOS under **System → Sideload Service**.
 
+Gitea Actions builds an artifact for each push to `main`. A matching StartOS extended-SemVer tag, such as `v0.2.0_0` for package version `0.2.0:0`, additionally installs the package through the configured Gitea runner. See `.ai-workspace/UPDATING.md` for the release policy and runner requirements.
+
 ## Status
 
 This is an unauthenticated MVP intended for sideload testing on a trusted network. Add authentication before exposing its interface beyond trusted gateways.

UPDATING.md

@@ -1,5 +0,0 @@
-# Updating
-
-The Rails application is developed in this repository. Update Ruby and gems deliberately in `Gemfile`, `.ruby-version`, `Gemfile.lock`, and `Dockerfile` together.
-
-The PostgreSQL image is pinned in `startos/manifest/index.ts`. Before changing it, confirm the exact official image tag exists and review PostgreSQL upgrade requirements. Update `startos/versions/current.ts` and its release notes for every package release.

scripts/check-release-version.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tag="${1:-}"
+
+if [[ ! "${tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(_[0-9]+)$ ]]; then
+  echo "Invalid release tag '${tag}'. Expected vMAJOR.MINOR.PATCH_WRAPPER, for example v0.2.0_0." >&2
+  exit 1
+fi
+
+package_version="$({
+  sed -n "s/^[[:space:]]*version: '\([^']*\)'.*/\1/p" \
+    startos/versions/current.ts
+} | head -n 1)"
+
+if [[ -z "${package_version}" ]]; then
+  echo "Could not read the package version from startos/versions/current.ts." >&2
+  exit 1
+fi
+
+expected_tag="v${package_version/:/_}"
+
+if [[ "${tag}" != "${expected_tag}" ]]; then
+  echo "Release tag '${tag}' does not match package version '${package_version}'." >&2
+  echo "Expected tag: ${expected_tag}" >&2
+  exit 1
+fi
+
+echo "Release tag ${tag} matches package version ${package_version}."

startos/versions/current.ts

@@ -1,13 +1,13 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '0.1.3:0',
+  version: '0.1.3:1',
   releaseNotes: {
-    en_US: 'Show a concise database readiness message in the service status.',
+    en_US: 'Add automated Gitea builds and tagged StartOS deployments.',
-    es_ES: 'Muestra un mensaje conciso sobre el estado de la base de datos.',
+    es_ES: 'Agrega compilaciones automatizadas de Gitea y despliegues etiquetados en StartOS.',
-    de_DE: 'Zeigt eine kurze Meldung zur Datenbankbereitschaft an.',
+    de_DE: 'Fügt automatisierte Gitea-Builds und markierte StartOS-Bereitstellungen hinzu.',
-    pl_PL: 'Wyświetla zwięzły komunikat o gotowości bazy danych.',
+    pl_PL: 'Dodaje automatyczne kompilacje Gitea i oznaczone wdrożenia StartOS.',
-    fr_FR: 'Affiche un message concis sur la disponibilité de la base de données.',
+    fr_FR: 'Ajoute les builds Gitea automatisés et les déploiements StartOS étiquetés.',
   },
   migrations: {
     up: async () => {},