ekklesiaandClaude Opus 5.5
22f25854aa
ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
75 lines
3.0 KiB
YAML
75 lines
3.0 KiB
YAML
# PUBLISH TO PREVIEW: THE BUILT FILE, TO THE CANARY CHANNEL.
|
|
#
|
|
# "Preview" is the canary channel on updates.riverofglorymn.org under a
|
|
# friendlier name; the URL and the laptop's device.conf are unchanged.
|
|
#
|
|
# Two jobs, so that no job has both the update server's key and Docker:
|
|
#
|
|
# gate on ekklesia-ci: the full container gate, again, on the file
|
|
# the Gitea release holds, against what canary and stable
|
|
# serve right now. No secret.
|
|
# publish on ekklesia-release: update_canary.sh publishes that same
|
|
# file on that gate's report — it refuses a report for other
|
|
# bytes, or one made before canary or stable moved — then reads
|
|
# everything back over HTTPS and records it on the release.
|
|
#
|
|
# Never automatic. Nothing publishes because a branch was pushed.
|
|
name: Release 2 - publish to Preview (canary)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'The version, as built by "Release 1 - build"'
|
|
required: true
|
|
sha256:
|
|
description: 'Its SHA-256, from that release: nothing else is published'
|
|
required: true
|
|
from_versions:
|
|
description: 'Older releases rooms are still on, rehearsed as upgrades too (e.g. 0.2.2)'
|
|
required: false
|
|
default: ''
|
|
|
|
jobs:
|
|
gate:
|
|
name: gate the release's file
|
|
runs-on: ekklesia-ci
|
|
outputs:
|
|
report: ${{ steps.gate.outputs.report }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: The container gate, on exactly that file
|
|
id: gate
|
|
env:
|
|
VERSION: ${{ github.event.inputs.version }}
|
|
SHA256: ${{ github.event.inputs.sha256 }}
|
|
RELEASE_GATE_FROM: ${{ github.event.inputs.from_versions }}
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
|
|
run: RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh gate "$VERSION" "$SHA256"
|
|
|
|
publish:
|
|
name: publish to canary and read it back
|
|
needs: gate
|
|
runs-on: ekklesia-release
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: What publishing needs
|
|
run: |
|
|
command -v ssh rsync curl python3 dpkg-deb git >/dev/null \
|
|
|| { apt-get update -qq && apt-get install -y -qq --no-install-recommends \
|
|
openssh-client rsync curl python3 dpkg git ca-certificates >/dev/null; }
|
|
|
|
- name: Publish, on the gate's report, and record it
|
|
env:
|
|
VERSION: ${{ github.event.inputs.version }}
|
|
SHA256: ${{ github.event.inputs.sha256 }}
|
|
REPORT: ${{ needs.gate.outputs.report }}
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
|
|
RELEASE_SSH_KEY: ${{ secrets.CLASSROOM_UPDATES_SSH_KEY }}
|
|
RELEASE_SSH_KNOWN_HOSTS: ${{ vars.CLASSROOM_UPDATES_KNOWN_HOSTS }}
|
|
RELEASE_SSH_ADDRESS: ${{ vars.CLASSROOM_UPDATES_ADDRESS }}
|
|
RELEASE_SSH_USER: ${{ vars.CLASSROOM_UPDATES_USER }}
|
|
run: RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh preview "$VERSION" "$SHA256" "$REPORT"
|