Adolfo Delorenzo
fb24e641ce
Some checks failed
CI / Go Tests (push) Has started running
CI / Build Go Binaries (amd64, linux, linux-amd64) (push) Has been cancelled
CI / Build Go Binaries (arm64, linux, linux-arm64) (push) Has been cancelled
CI / Shellcheck (push) Has been cancelled
ARM64 Build / Build generic ARM64 disk image (push) Failing after 14m12s
After v0.3.1 published successfully, run 524 stayed in 'queued' status overall even though all 5 jobs that actually ran completed at success. Cause: the gated build-iso-amd64 job is `if: false` with `runs-on: amd64-linux`. No runner matches `amd64-linux`, so Gitea queued the job indefinitely waiting for one. The `if:` expression is only evaluated when a runner actually picks up the job, so the skip never fires. Switch the runs-on to `ubuntu-latest` (which our Odroid claims). The runner picks the job up, evaluates `if: false`, marks it `skipped`, and the run as a whole concludes properly. Comment block updated to flag the two lines to flip when a real amd64-linux runner is registered. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
296 lines
11 KiB
YAML
296 lines
11 KiB
YAML
name: Release
|
|
|
|
# Triggered by `git push origin vX.Y.Z`. Builds Go binaries (amd64+arm64),
|
|
# x86_64 ISO + disk image, ARM64 disk image, computes SHA256SUMS over all
|
|
# artifacts, and posts a Gitea release with everything attached via the
|
|
# Gitea API.
|
|
#
|
|
# Notes for future-you:
|
|
# - upload-artifact / download-artifact are pinned to @v3 because Gitea's
|
|
# act_runner v1.0.x doesn't fully implement v4 yet.
|
|
# - The release step uses curl against Gitea's own /api/v1/repos/.../releases
|
|
# instead of a third-party action (softprops/action-gh-release et al);
|
|
# act_runner doesn't reliably proxy GitHub.com-targeted actions.
|
|
# - The arm64 disk-image build runs on the Odroid self-hosted runner via
|
|
# the `arm64-linux` label. Docs in docs/ci-runners.md.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
test:
|
|
name: Test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.22'
|
|
- name: Test cloud-init
|
|
run: cd cloud-init && go test ./... -count=1
|
|
- name: Test update agent
|
|
run: cd update && go test ./... -count=1
|
|
|
|
build-binaries:
|
|
name: Build Binaries (${{ matrix.suffix }})
|
|
runs-on: ubuntu-latest
|
|
needs: test
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- goos: linux
|
|
goarch: amd64
|
|
suffix: linux-amd64
|
|
- goos: linux
|
|
goarch: arm64
|
|
suffix: linux-arm64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.22'
|
|
- name: Get version
|
|
id: version
|
|
run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
|
- name: Build cloud-init
|
|
run: |
|
|
CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
|
|
go build -ldflags="-s -w -X main.version=${{ steps.version.outputs.version }}" \
|
|
-o kubesolo-cloudinit-${{ matrix.suffix }} ./cmd/
|
|
working-directory: cloud-init
|
|
- name: Build update agent
|
|
run: |
|
|
CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
|
|
go build -ldflags="-s -w -X main.version=${{ steps.version.outputs.version }}" \
|
|
-o kubesolo-update-${{ matrix.suffix }} .
|
|
working-directory: update
|
|
- name: Upload binaries
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: binaries-${{ matrix.suffix }}
|
|
path: |
|
|
cloud-init/kubesolo-cloudinit-${{ matrix.suffix }}
|
|
update/kubesolo-update-${{ matrix.suffix }}
|
|
|
|
build-iso-amd64:
|
|
name: Build x86_64 ISO + disk image
|
|
# Gated until an amd64-linux runner is registered. We use `runs-on:
|
|
# ubuntu-latest` (which the Odroid claims) so SOME runner picks the job
|
|
# up and evaluates `if: false`, marking it `skipped` instead of leaving
|
|
# it `queued` forever — the latter holds the overall run in `queued`
|
|
# state even when every load-bearing job is complete. When we get an
|
|
# amd64 runner, flip `if: false` to `false` -> `true` (and flip the
|
|
# `runs-on:` back to `amd64-linux`).
|
|
if: false
|
|
runs-on: ubuntu-latest
|
|
needs: build-binaries
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.22'
|
|
- name: Install build deps
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
cpio gzip genisoimage isolinux syslinux syslinux-common \
|
|
syslinux-utils xorriso xz-utils wget squashfs-tools \
|
|
dosfstools e2fsprogs fdisk parted libarchive-tools \
|
|
grub-common grub-efi-amd64-bin grub-pc-bin kpartx \
|
|
busybox-static iptables nftables
|
|
- name: Build kernel + ISO + disk-image
|
|
run: |
|
|
make kernel
|
|
make build-cloudinit build-update-agent
|
|
make rootfs initramfs
|
|
make iso
|
|
make disk-image
|
|
- name: Compress disk image
|
|
# The raw .img is 4 GB sparse; xz takes it to ~50-300 MB depending
|
|
# on dictionary level. Use -6 (default) for memory safety on the
|
|
# GitHub-Actions-style runner.
|
|
run: |
|
|
xz -k -T0 --memlimit-compress=1500MiB -6 output/*.img
|
|
ls -lh output/
|
|
- name: Upload x86_64 artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: image-amd64
|
|
path: |
|
|
output/*.iso
|
|
output/*.img.xz
|
|
|
|
build-disk-arm64:
|
|
name: Build ARM64 disk image
|
|
runs-on: arm64-linux
|
|
needs: test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Show host info
|
|
run: |
|
|
uname -a
|
|
nproc
|
|
free -h
|
|
df -h /
|
|
- name: Build kernel + rootfs + disk-image
|
|
# Runner runs as root via systemd; explicit sudo is harmless but
|
|
# documented as such in docs/ci-runners.md.
|
|
run: |
|
|
make kernel-arm64
|
|
make build-cross
|
|
make rootfs-arm64
|
|
make disk-image-arm64
|
|
- name: Compress disk image
|
|
run: |
|
|
xz -k -T0 --memlimit-compress=1500MiB -6 output/*.arm64.img
|
|
ls -lh output/
|
|
- name: Upload ARM64 artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: image-arm64
|
|
path: output/*.arm64.img.xz
|
|
|
|
release:
|
|
name: Publish Gitea Release
|
|
runs-on: ubuntu-latest
|
|
# build-iso-amd64 is gated `if: false` in v0.3.x (no amd64 runner yet);
|
|
# don't block the release on it. build-disk-arm64 is required — that's
|
|
# the headline artifact for v0.3.x. build-binaries is required since
|
|
# the Go binaries are core to every release.
|
|
needs: [build-binaries, build-disk-arm64]
|
|
# `if: always()` so the release publishes even if the gated x86 job
|
|
# somehow ran-and-failed instead of being skipped. The downstream
|
|
# `find` in the Flatten step ignores missing files gracefully.
|
|
if: always() && needs.build-binaries.result == 'success' && needs.build-disk-arm64.result == 'success'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Get version
|
|
id: version
|
|
# `cat VERSION` would be stale on tag pushes (VERSION already bumped
|
|
# for the tag, but using ref_name is unambiguous).
|
|
run: echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Flatten artifacts + compute checksums
|
|
run: |
|
|
mkdir -p release
|
|
# Each upload-artifact wrote into artifacts/<name>/...
|
|
find artifacts -type f \( \
|
|
-name "*.iso" -o \
|
|
-name "*.img.xz" -o \
|
|
-name "kubesolo-*" \
|
|
\) -exec cp {} release/ \;
|
|
(cd release && sha256sum * | sort > SHA256SUMS)
|
|
ls -lh release/
|
|
cat release/SHA256SUMS
|
|
|
|
- name: Install release tooling
|
|
run: sudo apt-get update && sudo apt-get install -y jq curl
|
|
|
|
- name: Render release body
|
|
id: body
|
|
run: |
|
|
VERSION="${{ steps.version.outputs.version }}"
|
|
# Strip the leading 'v' for cosmetic display in the body.
|
|
DISPLAY="${VERSION#v}"
|
|
cat > release-body.md <<EOF
|
|
See [docs/release-notes-${DISPLAY}.md](./docs/release-notes-${DISPLAY}.md)
|
|
and [CHANGELOG.md](./CHANGELOG.md) for the full release notes.
|
|
|
|
### Downloads
|
|
|
|
- \`kubesolo-os-${DISPLAY}.arm64.img.xz\` — ARM64 raw disk image (A/B GPT, UEFI)
|
|
- \`kubesolo-cloudinit-linux-{amd64,arm64}\` — standalone cloud-init parser
|
|
- \`kubesolo-update-linux-{amd64,arm64}\` — standalone update agent
|
|
- \`SHA256SUMS\` — checksums for every artifact above
|
|
|
|
> **x86_64 ISO + disk image**: not built automatically yet. The
|
|
> release workflow's amd64 build job needs an amd64-linux runner,
|
|
> which this Gitea instance doesn't have yet. To produce them
|
|
> yourself, clone the repo at this tag and run \`make iso disk-image\`
|
|
> on any Linux amd64 host.
|
|
|
|
### Verify
|
|
|
|
\`\`\`
|
|
sha256sum -c SHA256SUMS
|
|
\`\`\`
|
|
|
|
### Quick start (ARM64)
|
|
|
|
\`\`\`
|
|
# On Graviton/Ampere/any UEFI ARM64 host:
|
|
xz -d kubesolo-os-${DISPLAY}.arm64.img.xz
|
|
sudo dd if=kubesolo-os-${DISPLAY}.arm64.img of=/dev/sdX bs=4M status=progress
|
|
|
|
# Under qemu-system-aarch64 (Apple Silicon w/ HVF):
|
|
UEFI_FW=\$(brew --prefix qemu)/share/qemu/edk2-aarch64-code.fd
|
|
qemu-system-aarch64 -M virt -accel hvf -cpu host -m 2048 -smp 2 \\
|
|
-nographic -bios "\$UEFI_FW" \\
|
|
-drive file=kubesolo-os-${DISPLAY}.arm64.img,format=raw,if=virtio,media=disk \\
|
|
-device virtio-rng-pci \\
|
|
-net nic,model=virtio \\
|
|
-net user,hostfwd=tcp::6443-:6443,hostfwd=tcp::8080-:8080
|
|
\`\`\`
|
|
|
|
Then from the host: \`curl http://localhost:8080 > ~/.kube/kubesolo-config\`
|
|
and \`kubectl --kubeconfig ~/.kube/kubesolo-config get nodes\`.
|
|
EOF
|
|
cat release-body.md
|
|
|
|
- name: Create release via Gitea API
|
|
env:
|
|
# Gitea's act_runner auto-populates this with repo-write scope.
|
|
# If not, set a personal access token as a secret named GITEA_TOKEN
|
|
# on the org and swap the var name below.
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
TAG="${{ steps.version.outputs.version }}"
|
|
REPO_API="${{ github.api_url }}/repos/${{ github.repository }}"
|
|
|
|
# 1. Create the release. The API is GitHub-compatible at the
|
|
# request shape; the response includes the numeric release id we
|
|
# need for asset uploads.
|
|
PAYLOAD=$(jq -n \
|
|
--arg tag "$TAG" \
|
|
--arg name "KubeSolo OS $TAG" \
|
|
--rawfile body release-body.md \
|
|
'{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')
|
|
|
|
echo "==> Creating release for $TAG against $REPO_API"
|
|
CREATE_RESP=$(curl -fsSL -X POST \
|
|
-H "Authorization: token $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$PAYLOAD" \
|
|
"$REPO_API/releases")
|
|
|
|
RELEASE_ID=$(echo "$CREATE_RESP" | jq -r '.id')
|
|
if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
|
|
echo "ERROR: Could not extract release id from response:"
|
|
echo "$CREATE_RESP" | jq . || echo "$CREATE_RESP"
|
|
exit 1
|
|
fi
|
|
echo "==> Release id: $RELEASE_ID"
|
|
|
|
# 2. Upload each asset. asset?name= names the attachment; we use
|
|
# the basename so users see the same filename the build produced.
|
|
for f in release/*; do
|
|
[ -f "$f" ] || continue
|
|
name=$(basename "$f")
|
|
echo "==> Uploading $name ($(du -h "$f" | cut -f1))"
|
|
curl -fsSL -X POST \
|
|
-H "Authorization: token $TOKEN" \
|
|
-F "attachment=@$f" \
|
|
"$REPO_API/releases/$RELEASE_ID/assets?name=$name" >/dev/null
|
|
done
|
|
|
|
echo "==> Release published: $REPO_API/../releases/tag/$TAG"
|