Repository navigation
feat(ci/cd): release packages to repo.linuxfabrik.ch without a manual step - #32
Merged
Merged
Conversation
… step Upstream bumps are built and smoke-tested on all target distros in the pull request and merged automatically. The merge creates a GitHub prerelease with the unsigned packages, SHA256SUMS and a build provenance attestation (testing channel); lf-promote.yml turns it into a release after 7 days, or right away / never on manual request. build/publish.sh runs on the repository server and pulls instead of GitHub pushing: it verifies each asset against its attestation, signs RPMs and repodata with the Linuxfabrik key, and publishes into the aggregated layout from GitLab 001/project-big-picture#1252 (createrepo_c, freight). Verified end-to-end on a Rocky 10.2 test server with Rocky 10 and Debian 13 clients, using a gh stub for the GitHub side. DEB versions now carry the distro (+debian13, +ubuntu24.04), so builds for different suites never share a file name in a common pool.
check-upstream.sh reads PKG_UPSTREAM_TYPE (github, gitlab, none), PKG_UPSTREAM_PROJECT, PKG_UPSTREAM_SOURCE (releases, tags), PKG_UPSTREAM_TAG_PREFIX and PKG_UPSTREAM_URL instead of PKG_GITHUB_USER/REPO. Releases come from the GitHub or GitLab API, tags from an anonymous `git ls-remote`, skipping alpha/beta/dev/pre/rc tags. Errors now really exit 2: a failed curl used to end the script with curl's own code (22), which lf-check-upstream.yml took for "up to date", so a project without releases silently never got a bump. The workflow now reports such packages and fails after checking all others. Tested against glances, freight, git/git, mydumper (GitHub) and duplicity (gitlab.com, prefix rel., dev tags).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every release of a packaged project now reaches repo.linuxfabrik.ch without a manual step: first the
testingchannel, after 7 daysrelease. Decisions and background: GitLab001/project-big-picture#1257 and #1252.Pipeline
lf-check-upstream.yml(hourly, orrepository_dispatchtypeupstream-release) opens a bump PR when an upstream is ahead. Upstreams on GitHub and GitLab, by release or by tag (PKG_UPSTREAM_*inpackage.conf). An upstream that cannot be queried now fails the run instead of passing as "up to date".lf-build-pr.ymlbuilds every touched package on all target distros and smoke-tests it in a fresh container (PKG_SMOKE_TEST, run asnobody). Check nameBuild result, now required in the ruleset.auto-merge.ymlmerges bump PRs without review once the required checks pass (app token, so the merge triggers the release).lf-release.ymlcreates the GitHub prerelease<package>-<version>-<iteration>with the unsigned packages,SHA256SUMSand a build provenance attestation. The iteration counts up automatically.lf-promote.ymlpromotes prereleases after 7 days; manualpromoteorrejectviaworkflow_dispatch.build/publish.shruns on the repository server (systemd timer, LFOps role still to do): it pulls the releases, verifies each file withgh attestation verify, signs RPMs and repodata and publishes withcreaterepo_cand freight. The signing key never reaches GitHub.DEB versions carry the distro (
4.5.8-1+debian13), so suites never share a file name in a common pool.Tested
publish.shon a Rocky 10.2 test server (fresh clone of the template VM, freight from source, throwaway key) with aghstub for the GitHub side: publish to testing, promote, reject, tampered asset (run aborts, nothing published). Rocky 10 client withgpgcheck=1/repo_gpgcheck=1and Debian 13 client withsigned-byinstalled glances.check-upstream.shagainst glances, freight, git/git, mydumper (GitHub) and duplicity (gitlab.com, prefixrel., dev tags), 15 cases including error paths.Not yet tested
The real
gh attestation verifyand the workflows themselves on GitHub. Merging this changespackages/glances/, so it runslf-release.ymlfor the first time and creates the prereleaseglances-4.5.8-1.