Automate StartOS package releases

2026-08-08 09:03:47 -05:00
parent 4930097333
commit f32720828b
5 changed files with 184 additions and 11 deletions
@@ -0,0 +1,147 @@
+name: Build and deploy StartOS package
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*_*'
+  workflow_dispatch:
+    inputs:
+      deploy:
+        description: Install the built package on StartOS
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: startos-build
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install StartOS packaging tools
+        run: |
+          set -euo pipefail
+
+          if ! command -v mksquashfs >/dev/null; then
+            if ! command -v apt-get >/dev/null; then
+              echo "Cannot install mksquashfs: this runner does not provide apt-get." >&2
+              exit 1
+            fi
+
+            if [ "$(id -u)" -eq 0 ]; then
+              apt-get -o APT::Sandbox::User=root update
+              apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
+            elif command -v sudo >/dev/null; then
+              sudo apt-get -o APT::Sandbox::User=root update
+              sudo apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
+            else
+              echo "Cannot install mksquashfs: root access or sudo is required." >&2
+              exit 1
+            fi
+          fi
+
+          if ! command -v start-cli >/dev/null; then
+            curl --fail --silent --show-error --location \
+              https://start9.com/start-cli/install.sh \
+              | sh
+          fi
+
+          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+
+      - name: Verify runner prerequisites
+        run: |
+          set -euo pipefail
+
+          for command in docker make mksquashfs npm start-cli; do
+            command -v "${command}" >/dev/null || {
+              echo "Missing runner prerequisite: ${command}" >&2
+              exit 1
+            }
+          done
+
+          docker info >/dev/null
+
+      - name: Restore package signing key
+        env:
+          S9PK_BUILD_KEY_BASE64: ${{ secrets.S9PK_BUILD_KEY_BASE64 }}
+        run: |
+          set -euo pipefail
+
+          : "${S9PK_BUILD_KEY_BASE64:?S9PK_BUILD_KEY_BASE64 is required}"
+
+          workspace_dir="$(dirname "${GITHUB_WORKSPACE}")"
+          install -d -m 700 "${workspace_dir}/.startos"
+          printf '%s' "${S9PK_BUILD_KEY_BASE64}" \
+            | base64 --decode \
+            > "${workspace_dir}/.startos/build.key.pem"
+          chmod 600 "${workspace_dir}/.startos/build.key.pem"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate release tag
+        if: startsWith(github.ref, 'refs/tags/')
+        run: ./scripts/check-release-version.sh "${GITHUB_REF_NAME}"
+
+      - name: Recreate Buildx builder
+        run: |
+          set -euo pipefail
+
+          # The runner persists Podman containers across jobs. Remove the
+          # BuildKit container created before nested cgroups were disabled.
+          docker buildx rm --force default 2>/dev/null || true
+          docker buildx rm --force startos-ci 2>/dev/null || true
+          docker rm --force buildx_buildkit_default 2>/dev/null || true
+          docker rm --force buildx_buildkit_startos-ci0 2>/dev/null || true
+
+          docker buildx create \
+            --name startos-ci \
+            --driver docker-container \
+            --use
+          docker buildx inspect --bootstrap
+
+      - name: Build x86_64 package
+        run: make x86
+
+      - name: Verify package manifest
+        run: |
+          set -euo pipefail
+
+          test -s todo-back_x86_64.s9pk
+          start-cli s9pk inspect todo-back_x86_64.s9pk manifest
+          sha256sum todo-back_x86_64.s9pk
+
+      # Gitea currently works most consistently with the v3 artifact protocol.
+      - name: Upload workflow artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: todo-back-x86_64-${{ github.sha }}
+          path: todo-back_x86_64.s9pk
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Install release on StartOS
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.deploy == 'true'
+        env:
+          STARTOS_HOST: ${{ secrets.STARTOS_HOST }}
+        run: |
+          set -euo pipefail
+
+          : "${STARTOS_HOST:?STARTOS_HOST is required}"
+          start-cli \
+            --host "${STARTOS_HOST}" \
+            package install \
+            --sideload todo-back_x86_64.s9pk