Debuild Release #10
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # This is a copy from libsml. The idea is to merge both in the future. It is | |
| # however easier to develop this one standalone and later do a diff to see how | |
| # a common solution could look like. | |
| # Basically this is a fragmented bash script | |
| name: Debuild Release | |
| 'on': | |
| release: | |
| types: published | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PKG: vzlogger | |
| KEYSERVER: keyserver.ubuntu.com | |
| # Cloudsmith package repository | |
| KEYFILE: /usr/share/keyrings/volkszaehler-volkszaehler-org-project-archive-keyring.gpg | |
| CLOUDURL: https://dl.cloudsmith.io/public/volkszaehler/volkszaehler-org-project/deb | |
| CLOUD_KEY_ID: 21DBDAC56DF44DA1 | |
| REPO: volkszaehler/volkszaehler-org-project | |
| jobs: | |
| debuild: | |
| runs-on: ubuntu-latest | |
| environment: main | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set env | |
| # Here we are setting a variable from an expression. | |
| run: echo "TAG_NAME=${GITHUB_REF##*/}" >> $GITHUB_ENV | |
| - name: add cloudsmith repo | |
| run: | | |
| LISTENTRY="deb [signed-by=$KEYFILE] $CLOUDURL/debian trixie main" | |
| echo "$LISTENTRY" | sudo tee -a /etc/apt/sources.list | |
| gpg --keyserver $KEYSERVER --recv-key $CLOUD_KEY_ID | |
| sudo -E gpg -v --output "$KEYFILE" --export $CLOUD_KEY_ID | |
| sudo apt-get update | |
| - name: update repo information | |
| run: sudo apt-get update | |
| - name: install devscripts | |
| run: sudo apt-get install equivs devscripts pipx hub | |
| - name: install dependencies | |
| run: sudo mk-build-deps -ri | |
| - name: debuild | |
| run: debuild --no-sign | |
| - name: import GPG key | |
| # A secret passphrase is used because the key is stored on disk where | |
| # it may persist while the passphrase is not. | |
| run: | | |
| echo -e "$SIGNING_KEY" | \ | |
| gpg --batch --passphrase "$SIGNING_PASSPHRASE" --import | |
| gpg --list-secret-keys | |
| env: | |
| SIGNING_KEY: ${{ secrets.SIGNING_KEY }} | |
| SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }} | |
| - name: debsign | |
| run: | | |
| debsign -k"$SIGNING_KEY_ID" -p"gpg --batch --pinentry-mode loopback \ | |
| --passphrase $SIGNING_PASSPHRASE" | |
| env: | |
| SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }} | |
| # This is not a secret, but we want to have all signing | |
| # configuration in one place | |
| SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} | |
| - name: upload as Release | |
| run: | | |
| set -x | |
| assets=() | |
| for asset in ../$PKG*.{tar.xz,dsc}; do | |
| assets+=("-a" "$asset") | |
| done | |
| hub release edit "${assets[@]}" -m "$TAG_NAME" "$TAG_NAME" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: upload to Cloudsmith | |
| run: | | |
| pipx install cloudsmith-cli | |
| VERSION="${GITHUB_REF##*/v}" | |
| DESCRIPTION_FILE="../${PKG}_$VERSION.dsc" | |
| cloudsmith push deb ${REPO}/debian/any-version "$DESCRIPTION_FILE" \ | |
| --sources-file=$(dcmd --orig "$DESCRIPTION_FILE") | |
| env: | |
| CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} | |
| pbuilder: | |
| needs: debuild | |
| strategy: | |
| matrix: | |
| os: [debian, raspbian] | |
| distribution: [trixie, bookworm, bullseye] | |
| architecture: [armhf, arm64, amd64] | |
| exclude: | |
| - os: raspbian | |
| architecture: arm64 | |
| - os: raspbian | |
| architecture: amd64 | |
| - os: raspbian | |
| distribution: trixie | |
| include: | |
| - mirrorsite: http://ftp2.de.debian.org/debian/ | |
| - mirrorsite: http://mirror.netcologne.de/raspbian/raspbian/ | |
| os: raspbian | |
| - keyring: debian-archive-keyring | |
| - keyring: raspbian-archive-keyring | |
| os: raspbian | |
| runs-on: ubuntu-latest | |
| environment: main | |
| env: | |
| PBRT: /var/cache/pbuilder | |
| steps: | |
| - name: update repo information | |
| run: sudo apt-get update | |
| - name: install archive keyring | |
| run: | | |
| if [[ ${{ matrix.os }} == raspbian ]]; then | |
| wget http://raspbian.raspberrypi.org/raspbian/pool/main/r/raspbian-archive-keyring/raspbian-archive-keyring_20120528.2_all.deb | |
| sudo apt-get install ./raspbian-archive-keyring_20120528.2_all.deb | |
| else | |
| sudo apt-get install debian-archive-keyring | |
| fi | |
| - name: install pbuilder | |
| run: | | |
| sudo apt-get install pbuilder mmdebstrap qemu-user-static pipx hub | |
| # Needed for the release download | |
| - uses: actions/checkout@v4 | |
| - name: Set env | |
| # Here we are setting a variable from an expression. | |
| run: echo "TAG_NAME=${GITHUB_REF##*/}" >> $GITHUB_ENV | |
| - name: download source release | |
| run: | | |
| set -x | |
| hub release download "$TAG_NAME" | |
| ls -l | |
| - name: configure pbuilder | |
| run: | | |
| echo "MIRRORSITE=${{ matrix.mirrorsite }} | |
| HOOKDIR=$PBRT/hooks" | \ | |
| sudo tee /root/.pbuilderrc | |
| sudo mkdir -p $PBRT/hooks | |
| echo "#!/bin/sh | |
| apt-get update | |
| apt-get -y install gnupg ${{ matrix.keyring }} ca-certificates | |
| apt-key adv --keyserver $KEYSERVER --recv-keys $SIGNING_KEY_ID" | \ | |
| sudo tee $PBRT/hooks/G70Keys | |
| sudo chmod a+x $PBRT/hooks/G70Keys | |
| # OTHERMIRRORS can't do signed-by | |
| echo "#!/bin/sh | |
| LISTENTRY=\"deb [signed-by=$KEYFILE] $CLOUDURL/${{ matrix.os }} ${{ matrix.distribution }} main\" | |
| gpg --keyserver $KEYSERVER --recv-key $CLOUD_KEY_ID | |
| gpg -v --output '$KEYFILE' --export $CLOUD_KEY_ID | |
| echo \"\$LISTENTRY\" >> /etc/apt/sources.list | |
| apt-get update" | \ | |
| sudo tee $PBRT/hooks/E70Keys | |
| sudo chmod a+x $PBRT/hooks/E70Keys | |
| env: | |
| # This is not a secret, but we want to have all signing | |
| # configuration in one place | |
| SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} | |
| - name: create bootstrap | |
| run: | | |
| sudo pbuilder create --architecture ${{ matrix.architecture }} \ | |
| --distribution ${{ matrix.distribution }} \ | |
| --basetgz $PBRT/current.tgz \ | |
| --debootstrap mmdebstrap \ | |
| --debootstrapopts \ | |
| --keyring=/usr/share/keyrings/${{ matrix.keyring }}.gpg | |
| - name: pbuild ${{ matrix.os }} ${{ matrix.architecture }} ${{ matrix.distribution }} | |
| # https://stackoverflow.com/questions/70435286/resource-not-accessible-by-integration-on-github-post-repos-owner-repo-ac | |
| run: | | |
| VERSION="${GITHUB_REF##*/v}" | |
| sudo pbuilder build \ | |
| --architecture ${{ matrix.architecture }} \ | |
| --basetgz $PBRT/current.tgz ${PKG}_$VERSION.dsc | |
| - name: upload as Release | |
| run: | | |
| set -x | |
| if [[ "${{ matrix.distribution }}" != trixie ]]; then | |
| exit | |
| fi | |
| assets=() | |
| for asset in $PBRT/result/${PKG}*_${{ matrix.architecture }}.{deb,changes,buildinfo}; do | |
| assets+=("-a" "$asset") | |
| done | |
| hub release edit "${assets[@]}" -m "$TAG_NAME" "$TAG_NAME" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: upload to Cloudsmith | |
| run: | | |
| pipx install cloudsmith-cli | |
| VERSION="${GITHUB_REF##*/v}" | |
| CHANGES_FILE="$PBRT/result/${PKG}_${VERSION}_${{ matrix.architecture }}.changes" | |
| for DEB in $(dcmd --deb $CHANGES_FILE); do | |
| cloudsmith push deb \ | |
| ${REPO}/${{ matrix.os }}/${{ matrix.distribution }} "$DEB" | |
| done | |
| env: | |
| CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} |