dnscrypt-proxy/.github/workflows/releases.yml at 1faee8c4b2b1fcb155d2b24b83352d088a69f9b6 · DNSCrypt/dnscrypt-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
on:
  push:
    paths:
      - "**.go"
      - "go.*"
      - "**/testdata/**"
      - ".ci/**"
      - ".git*"
      - ".github/workflows/releases.yml"
  pull_request:
    paths:
      - "**.go"
      - "go.*"
      - "**/testdata/**"
      - ".ci/**"
      - ".git*"
      - ".github/workflows/releases.yml"

name: GitHub CI

permissions:
  contents: write

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Get the version
        id: get_version
        env:
          GITHUB_REF: ${{ github.ref }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF/refs\/tags\//}
          else
            VERSION="dev-$(date +'%Y%m%d-%H%M%S')-${GITHUB_SHA::8}"
          fi
          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Tag version: $VERSION"

      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1
          check-latest: true
          cache: false
        id: go

      - name: Test suite
        run: |
          go version
          cd .ci
          ./ci-test.sh
          cd -

      - name: Build all
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
        run: |
          .ci/ci-build.sh "$VERSION"

      - name: Package
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
        run: |
          .ci/ci-package.sh "$VERSION"

      - name: Install minisign and sign
        if: startsWith(github.ref, 'refs/tags/')
        env:
          MINISIGN_SK: ${{ secrets.MINISIGN_SK }}
        run: |
          sudo apt-get -y install libsodium-dev
          MINISIGN_COMMIT=03ebc0dafb08a77e0548e9cbc4668a3588128de5 # 0.12
          git init minisign
          git -C minisign remote add origin https://github.com/jedisct1/minisign.git
          git -C minisign fetch --depth 1 origin "$MINISIGN_COMMIT"
          git -C minisign checkout --detach "$MINISIGN_COMMIT"
          cd minisign/src
          mkdir -p /tmp/bin
          cc -O2 -o /tmp/bin/minisign -D_GNU_SOURCE *.c -lsodium
          cd -
          /tmp/bin/minisign -v
          echo '#' > /tmp/minisign.key
          echo "$MINISIGN_SK" >> /tmp/minisign.key
          cd dnscrypt-proxy
          echo | /tmp/bin/minisign -s /tmp/minisign.key -Sm *.tar.gz *.zip
          ls -l dnscrypt-proxy*

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dnscrypt-proxy-${{ steps.get_version.outputs.VERSION }}
          path: |
            dnscrypt-proxy/*.zip
            dnscrypt-proxy/*.tar.gz
          retention-days: 30
          if-no-files-found: error

      - name: Check if release exists
        id: check_release
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REF: ${{ github.ref }}
          GH_REPO: ${{ github.repository }}
        run: |
          TAG="${GH_REF#refs/tags/}"
          HTTP_CODE=$(curl -s -o response.json -w "%{http_code}" \
            -H "Authorization: token $GH_TOKEN" \
            "https://api.github.com/repos/$GH_REPO/releases/tags/$TAG")
          if [ "$HTTP_CODE" = "200" ]; then
            echo "release_exists=true" >> "$GITHUB_ENV"
          else
            echo "release_exists=false" >> "$GITHUB_ENV"
          fi

      - name: Debug Release Existence
        if: startsWith(github.ref, 'refs/tags/')
        env:
          RELEASE_EXISTS: ${{ env.release_exists }}
        run: echo "Release exists? $RELEASE_EXISTS"

      - name: Create release and upload assets
        id: create_release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        if: startsWith(github.ref, 'refs/tags/') && env.release_exists == 'false'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: Release ${{ github.ref }}
          draft: false
          prerelease: false
          make_latest: true
          fail_on_unmatched_files: false
          files: |
            dnscrypt-proxy/*.zip
            dnscrypt-proxy/*.tar.gz
            dnscrypt-proxy/*.minisig
            dnscrypt-proxy/*.msi

      - name: Upload assets to existing release
        id: upload_to_existing_release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        if: startsWith(github.ref, 'refs/tags/') && env.release_exists == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.get_version.outputs.VERSION }}
          fail_on_unmatched_files: false
          files: |
            dnscrypt-proxy/*.zip
            dnscrypt-proxy/*.tar.gz
            dnscrypt-proxy/*.minisig
            dnscrypt-proxy/*.msi