mirror of
https://github.com/octoleo/syncthing.git
synced 2024-09-20 13:49:02 +00:00
d21a2de055
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <h2>What's Changed</h2> <p>In scope of this release, we change Nodejs runtime from node16 to node20 (<a href="https://redirect.github.com/actions/setup-go/pull/421">actions/setup-go#421</a>). Moreover, we update some dependencies to the latest versions (<a href="https://redirect.github.com/actions/setup-go/pull/445">actions/setup-go#445</a>).</p> <p>Besides, this release contains such changes as:</p> <ul> <li>Fix hosted tool cache usage on windows by <a href="https://github.com/galargh"><code>@galargh</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/411">actions/setup-go#411</a></li> <li>Improve documentation regarding dependencies caching by <a href="https://github.com/artemgavrilov"><code>@artemgavrilov</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/417">actions/setup-go#417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/galargh"><code>@galargh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/411">actions/setup-go#411</a></li> <li><a href="https://github.com/artemgavrilov"><code>@artemgavrilov</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/417">actions/setup-go#417</a></li> <li><a href="https://github.com/chenrui333"><code>@chenrui333</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/421">actions/setup-go#421</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v4...v5.0.0">https://github.com/actions/setup-go/compare/v4...v5.0.0</a></p> <h2>v4.1.0</h2> <h2>What's Changed</h2> <p>In scope of this release, slow installation on Windows was fixed by <a href="https://github.com/dsame"><code>@dsame</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/393">actions/setup-go#393</a> and OS version was added to <code>primaryKey</code> for Ubuntu runners to avoid conflicts (<a href="https://redirect.github.com/actions/setup-go/pull/383">actions/setup-go#383</a>)</p> <p>This release also includes the following changes:</p> <ul> <li>Remove implicit dependencies by <a href="https://github.com/nikolai-laevskii"><code>@nikolai-laevskii</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/378">actions/setup-go#378</a></li> <li>Update action.yml by <a href="https://github.com/mkelly"><code>@mkelly</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/379">actions/setup-go#379</a></li> <li>Added a description that go-version should be specified as a string type by <a href="https://github.com/n3xem"><code>@n3xem</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/367">actions/setup-go#367</a></li> <li>Add note about YAML parsing versions by <a href="https://github.com/dmitry-shibanov"><code>@dmitry-shibanov</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/382">actions/setup-go#382</a></li> <li>Automatic update of configuration files from 05/23/2023 by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/377">actions/setup-go#377</a></li> <li>Bump tough-cookie and <code>@azure/ms-rest-js</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/392">actions/setup-go#392</a></li> <li>Bump word-wrap from 1.2.3 to 1.2.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/397">actions/setup-go#397</a></li> <li>Bump semver from 6.3.0 to 6.3.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/396">actions/setup-go#396</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mkelly"><code>@mkelly</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/379">actions/setup-go#379</a></li> <li><a href="https://github.com/n3xem"><code>@n3xem</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/367">actions/setup-go#367</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v4...v4.1.0">https://github.com/actions/setup-go/compare/v4...v4.1.0</a></p> <h2>v4.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update documentation for <code>v4</code> by <a href="https://github.com/dsame"><code>@dsame</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/354">actions/setup-go#354</a></li> <li>Fix glob bug in the package.json scripts section by <a href="https://github.com/IvanZosimov"><code>@IvanZosimov</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/359">actions/setup-go#359</a></li> <li>Bump <code>xml2js</code> dependency by <a href="https://github.com/dmitry-shibanov"><code>@dmitry-shibanov</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/370">actions/setup-go#370</a></li> <li>Bump <code>@actions/cache</code> dependency to v3.2.1 by <a href="https://github.com/nikolai-laevskii"><code>@nikolai-laevskii</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/374">actions/setup-go#374</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/nikolai-laevskii"><code>@nikolai-laevskii</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/374">actions/setup-go#374</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v4...v4.0.1">https://github.com/actions/setup-go/compare/v4...v4.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="0c52d547c9
"><code>0c52d54</code></a> Update dependencies for node20 (<a href="https://redirect.github.com/actions/setup-go/issues/445">#445</a>)</li> <li><a href="bfd2fb341f
"><code>bfd2fb3</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-go/issues/421">#421</a> from chenrui333/node20-runtime</li> <li><a href="3d65fa57fc
"><code>3d65fa5</code></a> feat: bump to use actions/checkout@v4</li> <li><a href="8a505c9cf2
"><code>8a505c9</code></a> feat: bump to use node20 runtime</li> <li><a href="883490dfd0
"><code>883490d</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-go/issues/417">#417</a> from artemgavrilov/main</li> <li><a href="d45ebba0ce
"><code>d45ebba</code></a> Rephrase sentence</li> <li><a href="317c6617fa
"><code>317c661</code></a> Replace <code>wildcards</code> term with <code>globs</code>.</li> <li><a href="f90673ad64
"><code>f90673a</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-go/issues/1">#1</a> from artemgavrilov/caching-docs-improvement</li> <li><a href="8018234347
"><code>8018234</code></a> Improve documentation regarding dependencies cachin</li> <li><a href="d085b4fe57
"><code>d085b4f</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-go/issues/411">#411</a> from galargh/fix/windows-hostedtoolcache</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-go/compare/v4...v5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
831 lines
25 KiB
YAML
831 lines
25 KiB
YAML
name: Build Syncthing
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
schedule:
|
|
# Run nightly build at 05:00 UTC
|
|
- cron: '00 05 * * *'
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
# The go version to use for builds. We set check-latest to true when
|
|
# installing, so we get the latest patch version that matches the
|
|
# expression.
|
|
GO_VERSION: "~1.21.5"
|
|
|
|
# Optimize compatibility on the slow archictures.
|
|
GO386: softfloat
|
|
GOARM: "5"
|
|
GOMIPS: softfloat
|
|
|
|
# Avoid hilarious amounts of obscuring log output when running tests.
|
|
LOGGER_DISCARD: "1"
|
|
|
|
# Our build metadata
|
|
BUILD_USER: builder
|
|
BUILD_HOST: github.syncthing.net
|
|
|
|
# A note on actions and third party code... The actions under actions/ (like
|
|
# `uses: actions/checkout`) are maintained by GitHub, and we need to trust
|
|
# GitHub to maintain their code and infrastructure or we're in deep shit in
|
|
# general. The same doesn't necessarily apply to other actions authors, so
|
|
# some care needs to be taken when adding steps, especially in the paths
|
|
# that lead up to code being packaged and signed.
|
|
|
|
jobs:
|
|
|
|
#
|
|
# Tests for all platforms. Runs a matrix build on Windows, Linux and Mac,
|
|
# with the list of expected supported Go versions (current, previous).
|
|
#
|
|
|
|
build-test:
|
|
name: Build and test
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
runner: ["windows-latest", "ubuntu-latest", "macos-latest"]
|
|
# The oldest version in this list should match what we have in our go.mod.
|
|
# Variables don't seem to be supported here, or we could have done something nice.
|
|
go: ["~1.20.12", "~1.21.5"]
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- name: Set git to use LF
|
|
if: matrix.runner == 'windows-latest'
|
|
# Without this, the Windows checkout will happen with CRLF line
|
|
# endings, which is fine for the source code but messes up tests
|
|
# that depend on data on disk being as expected. Ideally, those
|
|
# tests should be fixed, but not today.
|
|
run: |
|
|
git config --global core.autocrlf false
|
|
git config --global core.eol lf
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ matrix.go }}
|
|
cache: true
|
|
check-latest: true
|
|
|
|
- name: Build
|
|
run: |
|
|
go run build.go
|
|
|
|
- name: Install go-test-json-to-loki
|
|
run: |
|
|
go install calmh.dev/go-test-json-to-loki@latest
|
|
|
|
- name: Test
|
|
run: |
|
|
go version
|
|
go run build.go test | go-test-json-to-loki
|
|
env:
|
|
GOFLAGS: "-json"
|
|
LOKI_URL: ${{ vars.LOKI_URL }}
|
|
LOKI_USER: ${{ vars.LOKI_USER }}
|
|
LOKI_PASSWORD: ${{ secrets.LOKI_PASSWORD }}
|
|
LOKI_LABELS: "go=${{ matrix.go }},runner=${{ matrix.runner }},repo=${{ github.repository }},ref=${{ github.ref }}"
|
|
|
|
#
|
|
# Meta checks for formatting, copyright, etc
|
|
#
|
|
|
|
correctness:
|
|
name: Check correctness
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Check correctness
|
|
run: |
|
|
go test -v ./meta
|
|
|
|
#
|
|
# The basic checks job is a virtual one that depends on the matrix tests,
|
|
# the correctness checks, and various builds that we always do. This makes
|
|
# it easy to have the PR process have a single test as a gatekeeper for
|
|
# merging, instead of having to add all the matrix tests and update them
|
|
# each time the version changes. (The top level test is not available for
|
|
# choosing there, only the matrix "children".)
|
|
#
|
|
|
|
basics:
|
|
name: Basic checks passed
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- build-test
|
|
- correctness
|
|
- package-linux
|
|
- package-cross
|
|
- package-source
|
|
- package-debian
|
|
- govulncheck
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
#
|
|
# Windows
|
|
#
|
|
|
|
package-windows:
|
|
name: Package for Windows
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/heads/release-'))
|
|
environment: signing
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Set git to use LF
|
|
# Without this, the checkout will happen with CRLF line endings,
|
|
# which is fine for the source code but messes up tests that depend
|
|
# on data on disk being as expected. Ideally, those tests should be
|
|
# fixed, but not today.
|
|
run: |
|
|
git config --global core.autocrlf false
|
|
git config --global core.eol lf
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~\AppData\Local\go-build
|
|
~\go\pkg\mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.4.0
|
|
|
|
- name: Create packages
|
|
run: |
|
|
go run build.go -goarch amd64 zip
|
|
go run build.go -goarch arm zip
|
|
go run build.go -goarch arm64 zip
|
|
go run build.go -goarch 386 zip
|
|
env:
|
|
CGO_ENABLED: "0"
|
|
CODESIGN_SIGNTOOL: ${{ secrets.CODESIGN_SIGNTOOL }}
|
|
CODESIGN_CERTIFICATE_BASE64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
|
|
CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}
|
|
CODESIGN_TIMESTAMP_SERVER: ${{ secrets.CODESIGN_TIMESTAMP_SERVER }}
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-windows
|
|
path: syncthing-windows-*.zip
|
|
|
|
#
|
|
# Linux
|
|
#
|
|
|
|
package-linux:
|
|
name: Package for Linux
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Create packages
|
|
run: |
|
|
archs=$(go tool dist list | grep linux | sed 's#linux/##')
|
|
for goarch in $archs ; do
|
|
go run build.go -goarch "$goarch" tar
|
|
done
|
|
env:
|
|
CGO_ENABLED: "0"
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-linux
|
|
path: syncthing-linux-*.tar.gz
|
|
|
|
#
|
|
# macOS
|
|
#
|
|
|
|
package-macos:
|
|
name: Package for macOS
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/heads/release-'))
|
|
environment: signing
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Import signing certificate
|
|
run: |
|
|
# Set up a run-specific keychain, making it available for the
|
|
# `codesign` tool.
|
|
umask 066
|
|
KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain
|
|
KEYCHAIN_PASSWORD=$(uuidgen)
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
|
security default-keychain -s "$KEYCHAIN_PATH"
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
|
|
|
|
# Import the certificate
|
|
CERTIFICATE_PATH=$RUNNER_TEMP/codesign.p12
|
|
echo "$DEVELOPER_ID_CERTIFICATE_BASE64" | base64 -d -o "$CERTIFICATE_PATH"
|
|
security import "$CERTIFICATE_PATH" -k "$KEYCHAIN_PATH" -P "$DEVELOPER_ID_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k actions "$KEYCHAIN_PATH"
|
|
|
|
# Set the codesign identity for following steps
|
|
echo "CODESIGN_IDENTITY=$CODESIGN_IDENTITY" >> $GITHUB_ENV
|
|
env:
|
|
DEVELOPER_ID_CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_CERTIFICATE_BASE64 }}
|
|
DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_CERTIFICATE_PASSWORD }}
|
|
CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
|
|
|
|
- name: Create package (amd64)
|
|
run: |
|
|
go run build.go -goarch amd64 zip
|
|
env:
|
|
CGO_ENABLED: "1"
|
|
|
|
- name: Create package (arm64 cross)
|
|
run: |
|
|
cat <<EOT > xgo.sh
|
|
#!/bin/bash
|
|
CGO_ENABLED=1 \
|
|
CGO_CFLAGS="-target arm64-apple-macos10.15" \
|
|
CGO_LDFLAGS="-target arm64-apple-macos10.15" \
|
|
go "\$@"
|
|
EOT
|
|
chmod 755 xgo.sh
|
|
go run build.go -gocmd ./xgo.sh -goarch arm64 zip
|
|
env:
|
|
CGO_ENABLED: "1"
|
|
|
|
- name: Create package (universal)
|
|
run: |
|
|
rm -rf _tmp
|
|
mkdir _tmp
|
|
pushd _tmp
|
|
|
|
unzip ../syncthing-macos-amd64-*.zip
|
|
unzip ../syncthing-macos-arm64-*.zip
|
|
lipo -create syncthing-macos-amd64-*/syncthing syncthing-macos-arm64-*/syncthing -o syncthing
|
|
|
|
amd64=(syncthing-macos-amd64-*)
|
|
universal="${amd64/amd64/universal}"
|
|
mv "$amd64" "$universal"
|
|
mv syncthing "$universal"
|
|
zip -r "../$universal.zip" "$universal"
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-macos
|
|
path: syncthing-*.zip
|
|
|
|
notarize-macos:
|
|
name: Notarize for macOS
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/heads/release-'))
|
|
environment: signing
|
|
needs:
|
|
- package-macos
|
|
- basics
|
|
runs-on: macos-latest
|
|
steps:
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: packages-macos
|
|
|
|
- name: Notarize binaries
|
|
run: |
|
|
APPSTORECONNECT_API_KEY_PATH="$RUNNER_TEMP/apikey.p8"
|
|
echo "$APPSTORECONNECT_API_KEY" | base64 -d -o "$APPSTORECONNECT_API_KEY_PATH"
|
|
for file in syncthing-macos-*.zip ; do
|
|
xcrun notarytool submit \
|
|
-k "$APPSTORECONNECT_API_KEY_PATH" \
|
|
-d "$APPSTORECONNECT_API_KEY_ID" \
|
|
-i "$APPSTORECONNECT_API_KEY_ISSUER" \
|
|
$file
|
|
done
|
|
env:
|
|
APPSTORECONNECT_API_KEY: ${{ secrets.APPSTORECONNECT_API_KEY }}
|
|
APPSTORECONNECT_API_KEY_ID: ${{ secrets.APPSTORECONNECT_API_KEY_ID }}
|
|
APPSTORECONNECT_API_KEY_ISSUER: ${{ secrets.APPSTORECONNECT_API_KEY_ISSUER }}
|
|
|
|
#
|
|
# Cross compile other unixes
|
|
#
|
|
|
|
package-cross:
|
|
name: Package cross compiled
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-cross-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Create packages
|
|
run: |
|
|
platforms=$(go tool dist list \
|
|
| grep -v aix/ppc64 \
|
|
| grep -v android/ \
|
|
| grep -v darwin/ \
|
|
| grep -v ios/ \
|
|
| grep -v js/ \
|
|
| grep -v linux/ \
|
|
| grep -v nacl/ \
|
|
| grep -v plan9/ \
|
|
| grep -v windows/ \
|
|
| grep -v /wasm \
|
|
)
|
|
|
|
# Build for each platform with errors silenced, because we expect
|
|
# some oddball platforms to fail. This avoids a bunch of errors in
|
|
# the GitHub Actions output, instead summarizing each build
|
|
# failure as a warning.
|
|
for plat in $platforms; do
|
|
goos="${plat%/*}"
|
|
goarch="${plat#*/}"
|
|
echo "::group ::$plat"
|
|
if ! go run build.go -goos "$goos" -goarch "$goarch" tar 2>/dev/null; then
|
|
echo "::warning ::Failed to build for $plat"
|
|
fi
|
|
echo "::endgroup::"
|
|
done
|
|
env:
|
|
CGO_ENABLED: "0"
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-other
|
|
path: syncthing-*.tar.gz
|
|
|
|
#
|
|
# Source
|
|
#
|
|
|
|
package-source:
|
|
name: Package source code
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Package source
|
|
run: |
|
|
version=$(go run build.go version)
|
|
echo "$version" > RELEASE
|
|
|
|
go mod vendor
|
|
go run build.go assets
|
|
|
|
cd ..
|
|
|
|
tar c -z -f "syncthing-source-$version.tar.gz" \
|
|
--exclude .git \
|
|
syncthing
|
|
|
|
mv "syncthing-source-$version.tar.gz" syncthing
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-source
|
|
path: syncthing-source-*.tar.gz
|
|
|
|
#
|
|
# Sign binaries for auto upgrade, generate ASC signature files
|
|
#
|
|
|
|
sign-for-upgrade:
|
|
name: Sign for upgrade
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/heads/release-'))
|
|
environment: signing
|
|
needs:
|
|
- basics
|
|
- package-windows
|
|
- package-linux
|
|
- package-macos
|
|
- package-cross
|
|
- package-source
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
repository: syncthing/release-tools
|
|
path: tools
|
|
fetch-depth: 0
|
|
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v3
|
|
|
|
- name: Install signing tool
|
|
run: |
|
|
go install ./cmd/stsigtool
|
|
|
|
- name: Sign archives
|
|
run: |
|
|
export PRIVATE_KEY="$RUNNER_TEMP/privkey.pem"
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
echo "$STSIGTOOL_PRIVATE_KEY" | base64 -d > "$PRIVATE_KEY"
|
|
mkdir packages
|
|
mv packages-*/* packages
|
|
pushd packages
|
|
"$GITHUB_WORKSPACE/tools/sign-only"
|
|
rm -f "$PRIVATE_KEY"
|
|
env:
|
|
STSIGTOOL_PRIVATE_KEY: ${{ secrets.STSIGTOOL_PRIVATE_KEY }}
|
|
|
|
- name: Create and sign .asc files
|
|
run: |
|
|
sudo apt update
|
|
sudo apt -y install gnupg
|
|
|
|
export SIGNING_KEY="$RUNNER_TEMP/gpg-secret.asc"
|
|
echo "$GNUPG_SIGNING_KEY_BASE64" | base64 -d > "$SIGNING_KEY"
|
|
gpg --import < "$SIGNING_KEY"
|
|
|
|
pushd packages
|
|
files=(*.tar.gz *.zip)
|
|
sha1sum "${files[@]}" | gpg --clearsign > sha1sum.txt.asc
|
|
sha256sum "${files[@]}" | gpg --clearsign > sha256sum.txt.asc
|
|
gpg --sign --armour --detach syncthing-source-*.tar.gz
|
|
popd
|
|
rm -f "$SIGNING_KEY" .gnupg
|
|
env:
|
|
GNUPG_SIGNING_KEY_BASE64: ${{ secrets.GNUPG_SIGNING_KEY_BASE64 }}
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages-signed
|
|
path: packages/*
|
|
|
|
#
|
|
# Debian
|
|
#
|
|
|
|
package-debian:
|
|
name: Package for Debian
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: ruby/setup-ruby@v1
|
|
with:
|
|
ruby-version: '3.0'
|
|
|
|
- name: Install fpm
|
|
run: |
|
|
gem install fpm
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-debian-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Package for Debian
|
|
run: |
|
|
for arch in amd64 i386 armhf armel arm64 ; do
|
|
go run build.go -no-upgrade -installsuffix=no-upgrade -goarch "$arch" deb
|
|
done
|
|
env:
|
|
BUILD_USER: debian
|
|
|
|
- name: Archive artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: debian-packages
|
|
path: "*.deb"
|
|
|
|
#
|
|
# Nightlies
|
|
#
|
|
|
|
publish-nightly:
|
|
name: Publish nightly build
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && startsWith(github.ref, 'refs/heads/release-nightly')
|
|
environment: signing
|
|
needs:
|
|
- sign-for-upgrade
|
|
- notarize-macos
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
repository: syncthing/release-tools
|
|
path: tools
|
|
fetch-depth: 0
|
|
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: packages-signed
|
|
path: packages
|
|
|
|
- name: Create release json
|
|
run: |
|
|
cd packages
|
|
"$GITHUB_WORKSPACE/tools/generate-release-json" "$BASE_URL" > nightly.json
|
|
env:
|
|
BASE_URL: https://syncthing.ams3.digitaloceanspaces.com/nightly/
|
|
|
|
- name: Push artifacts
|
|
uses: docker://docker.io/rclone/rclone:latest
|
|
env:
|
|
RCLONE_CONFIG_SPACES_TYPE: s3
|
|
RCLONE_CONFIG_SPACES_PROVIDER: DigitalOcean
|
|
RCLONE_CONFIG_SPACES_ACCESS_KEY_ID: ${{ secrets.SPACES_KEY }}
|
|
RCLONE_CONFIG_SPACES_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET }}
|
|
RCLONE_CONFIG_SPACES_ENDPOINT: ams3.digitaloceanspaces.com
|
|
RCLONE_CONFIG_SPACES_ACL: public-read
|
|
with:
|
|
args: sync packages spaces:syncthing/nightly
|
|
|
|
#
|
|
# Push release artifacts to Spaces
|
|
#
|
|
|
|
publish-release-files:
|
|
name: Publish release files
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/release'
|
|
environment: signing
|
|
needs:
|
|
- sign-for-upgrade
|
|
- package-debian
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Download signed packages
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: packages-signed
|
|
path: packages
|
|
|
|
- name: Download debian packages
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: debian-packages
|
|
path: packages
|
|
|
|
- name: Set version
|
|
run: |
|
|
version=$(go run build.go version)
|
|
echo "VERSION=$version" >> $GITHUB_ENV
|
|
|
|
- name: Push to Spaces (${{ env.VERSION }})
|
|
uses: docker://docker.io/rclone/rclone:latest
|
|
env:
|
|
RCLONE_CONFIG_SPACES_TYPE: s3
|
|
RCLONE_CONFIG_SPACES_PROVIDER: DigitalOcean
|
|
RCLONE_CONFIG_SPACES_ACCESS_KEY_ID: ${{ secrets.SPACES_KEY }}
|
|
RCLONE_CONFIG_SPACES_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET }}
|
|
RCLONE_CONFIG_SPACES_ENDPOINT: ams3.digitaloceanspaces.com
|
|
RCLONE_CONFIG_SPACES_ACL: public-read
|
|
with:
|
|
args: sync packages spaces:syncthing/release/${{ env.VERSION }}
|
|
|
|
- name: Push to Spaces (latest)
|
|
uses: docker://docker.io/rclone/rclone:latest
|
|
env:
|
|
RCLONE_CONFIG_SPACES_TYPE: s3
|
|
RCLONE_CONFIG_SPACES_PROVIDER: DigitalOcean
|
|
RCLONE_CONFIG_SPACES_ACCESS_KEY_ID: ${{ secrets.SPACES_KEY }}
|
|
RCLONE_CONFIG_SPACES_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET }}
|
|
RCLONE_CONFIG_SPACES_ENDPOINT: ams3.digitaloceanspaces.com
|
|
RCLONE_CONFIG_SPACES_ACL: public-read
|
|
with:
|
|
args: sync spaces:syncthing/release/${{ env.VERSION }} spaces:syncthing/release/latest
|
|
|
|
#
|
|
# Build and push to Docker Hub
|
|
#
|
|
|
|
docker-syncthing:
|
|
name: Build and push Docker images
|
|
runs-on: ubuntu-latest
|
|
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/infrastructure' || startsWith(github.ref, 'refs/heads/release-'))
|
|
environment: docker
|
|
strategy:
|
|
matrix:
|
|
pkg:
|
|
- syncthing
|
|
- strelaysrv
|
|
- stdiscosrv
|
|
include:
|
|
- pkg: syncthing
|
|
dockerfile: Dockerfile
|
|
image: syncthing/syncthing
|
|
- pkg: strelaysrv
|
|
dockerfile: Dockerfile.strelaysrv
|
|
image: syncthing/relaysrv
|
|
- pkg: stdiscosrv
|
|
dockerfile: Dockerfile.stdiscosrv
|
|
image: syncthing/discosrv
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: Get actual Go version
|
|
run: |
|
|
go version
|
|
echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~/.cache/go-build
|
|
~/go/pkg/mod
|
|
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-docker-${{ matrix.pkg }}-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Build binaries
|
|
run: |
|
|
for arch in amd64 arm64 arm; do
|
|
go run build.go -goos linux -goarch "$arch" -no-upgrade build ${{ matrix.pkg }}
|
|
mv ${{ matrix.pkg }} ${{ matrix.pkg }}-linux-"$arch"
|
|
done
|
|
env:
|
|
CGO_ENABLED: "0"
|
|
BUILD_USER: docker
|
|
|
|
- name: Check if we will be able to push images
|
|
run: |
|
|
if [[ "${{ secrets.DOCKERHUB_TOKEN }}" != "" ]]; then
|
|
echo "DOCKER_PUSH=true" >> $GITHUB_ENV;
|
|
fi
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v3
|
|
if: env.DOCKER_PUSH == 'true'
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Set version tags
|
|
run: |
|
|
version=$(go run build.go version)
|
|
version=${version#v}
|
|
if [[ $version == @([0-9]|[0-9][0-9]).@([0-9]|[0-9][0-9]).@([0-9]|[0-9][0-9]) ]] ; then
|
|
echo Release version, pushing to :latest and version tags
|
|
major=${version%.*.*}
|
|
minor=${version%.*}
|
|
tags=${{ matrix.image }}:$version,${{ matrix.image }}:$major,${{ matrix.image }}:$minor,${{ matrix.image }}:latest
|
|
elif [[ $version == *-rc.@([0-9]|[0-9][0-9]) ]] ; then
|
|
echo Release candidate, pushing to :rc
|
|
tags=${{ matrix.image }}:rc
|
|
else
|
|
echo Development version, pushing to :edge
|
|
tags=${{ matrix.image }}:edge
|
|
fi
|
|
echo "DOCKER_TAGS=$tags" >> $GITHUB_ENV
|
|
echo "VERSION=$version" >> $GITHUB_ENV
|
|
|
|
- name: Build and push Docker image
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: ${{ matrix.dockerfile }}
|
|
platforms: linux/amd64,linux/arm64,linux/arm/7
|
|
push: ${{ env.DOCKER_PUSH == 'true' }}
|
|
tags: ${{ env.DOCKER_TAGS }}
|
|
labels: |
|
|
org.opencontainers.image.version=${{ env.VERSION }}
|
|
org.opencontainers.image.revision=${{ github.sha }}
|
|
|
|
#
|
|
# Check for known vulnerabilities in Go dependencies
|
|
#
|
|
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
name: Run govulncheck
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
cache: false
|
|
check-latest: true
|
|
|
|
- name: run govulncheck
|
|
run: |
|
|
go run build.go assets
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|