Skip to content

Commit 3158bc1

Browse files
ignoramousCopilot
ignoramous
and
Copilot
committed
gh-actions: m extract out the publish workflow
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
1 parent 86af89d commit 3158bc1

File tree

2 files changed

+101
-189
lines changed

2 files changed

+101
-189
lines changed

‎.github/workflows/go.yml‎

Lines changed: 7 additions & 181 deletions
Original file line numberDiff line numberDiff line change
@@ -316,187 +316,13 @@ jobs:
316316
- build
317317
- attestation
318318
if: ${{ needs.build.result == 'success' && needs.attestation.result == 'success' && needs.build.outputs.publish == 'true' }}
319-
runs-on: ubuntu-latest
320-
permissions:
321-
contents: read
322-
actions: read
323-
attestations: read
324-
packages: write
325-
env:
326-
# docs.github.com/en/actions/reference/workflows-and-actions/contexts#github-context
327-
GROUP_GITHUB: ${{ format('com.github.{0}', github.repository_owner) }}
328-
GROUP_OSSRH: com.celzero
329-
# project artifactId; see: pom.xml
330-
ARTIFACT: firestack
331-
REPO_GITHUB: github
332-
# central.sonatype.org/pages/ossrh-eol
333-
# or "central"
334-
REPO_OSSRH: ossrh
335-
# artefact type
336-
PACK: aar
337-
# final out from make-aar
338-
FOUT: firestack.aar
339-
FOUTDBG: firestack-debug.aar
340-
# artifact classifier; full unused
341-
CLASSFULL: full
342-
CLASSDBG: debug
343-
# artifact bytecode sources
344-
SOURCES: build/intra/tun2socks-sources.jar
345-
# POM for Maven Central
346-
POM_OSSRH: ossrhpom.xml
347-
DIST_DIR: dist
348-
# git version (short commit sha)
349-
VCSVER: ${{ needs.build.outputs.vcs-ver }}
350-
steps:
351-
- name: 🥏 Checkout
352-
uses: actions/checkout@v6
353-
with:
354-
persist-credentials: false
355-
356-
- name: ⬇️ Get artifacts
357-
uses: actions/download-artifact@v5
358-
with:
359-
name: firestack-aar-${{ github.sha }}
360-
path: ${{ env.DIST_DIR }}
361-
362-
- name: 🔐 Verify artifacts
363-
shell: bash
364-
env:
365-
SUBJECTS: ${{ needs.build.outputs.artifact-subjects }}
366-
REPO: ${{ github.repository }}
367-
ART_DIR: ${{ env.DIST_DIR }}
368-
GH_TOKEN: ${{ github.token }}
369-
run: |
370-
set -euo pipefail
371-
ls -ltr "${ART_DIR}/"
372-
if [ -z "$SUBJECTS" ] || [ "$SUBJECTS" = "[]" ]; then
373-
echo "::error::missing artifact subjects"
374-
exit 12
375-
fi
376-
jq -c '.[]' <<<"$SUBJECTS" | while read -r subject; do
377-
name=$(jq -r '.name' <<<"$subject")
378-
file="${ART_DIR}/${name##*/}"
379-
if [ ! -f "$file" ]; then
380-
echo "::error::missing artifact $file"
381-
exit 13
382-
fi
383-
gh attestation verify "$file" -R "$REPO"
384-
done
385-
386-
- name: 🧾 Verify SBOM
387-
if: ${{ needs.build.outputs.sbom-info != '' }}
388-
shell: bash
389-
env:
390-
SBOM_INFO: ${{ needs.build.outputs.sbom-info }}
391-
REPO: ${{ github.repository }}
392-
ART_DIR: ${{ env.DIST_DIR }}
393-
GH_TOKEN: ${{ github.token }}
394-
run: |
395-
set -euo pipefail
396-
# andrewlock.net/creating-sbom-attestations-in-github-actions/
397-
predicate="https://spdx.dev/Document/v2.2"
398-
jq -c '.subjects[]' <<<"$SBOM_INFO" | while read -r subject; do
399-
name=$(jq -r '.name' <<<"$subject")
400-
file="${ART_DIR}/${name##*/}"
401-
if [ ! -f "$file" ]; then
402-
echo "::error::missing SBOM subject artifact $file"
403-
exit 14
404-
fi
405-
gh attestation verify "$file" -R "$REPO" --predicate-type "$predicate"
406-
done
407-
408-
- name: 🏷️ Setup for GitHub Packages
409-
uses: actions/setup-java@v4
410-
with:
411-
java-version: '17'
412-
distribution: 'temurin'
413-
414-
# docs.github.com/en/actions/tutorials/build-and-test-code/java-with-maven
415-
# docs.github.com/en/actions/tutorials/publish-packages/publish-java-packages-with-maven#publishing-packages-to-github-packages
416-
- name: 😺 GitHub Packages
417-
shell: bash
418-
env:
419-
REPOSITORY: ${{ github.repository }}
420-
GITHUB_ACTOR: ${{ github.actor }}
421-
GITHUB_TOKEN: ${{ github.token }}
422-
run: |
423-
# uploaded at:
424-
# maven.pkg.github.com/celzero/firestack/com/github/celzero/firestack/<commit>/firestack-<commit>.aar
425-
# github.com/deelaa-marketplace/commons-workflow/blob/637dc111/flows/publish-api.yml#L49
426-
# github.com/markocto/cf-octopub/blob/bba2de2c/github/script/action.yaml#L118
427-
428-
# publish both stripped and debug
429-
mvn deploy:deploy-file \
430-
-DgroupId="${GROUP_GITHUB}" \
431-
-DartifactId="${ARTIFACT}" \
432-
-Dversion="$VCSVER" \
433-
-Dpackaging="${PACK}" \
434-
-Dfile="${DIST_DIR}/${FOUT}" \
435-
-Dfiles="${DIST_DIR}/${FOUTDBG}" \
436-
-Dtypes="${PACK}" \
437-
-Dclassifiers=${CLASSDBG} \
438-
-DrepositoryId="${REPO_GITHUB}" \
439-
-Dsources="${DIST_DIR}/${SOURCES}" \
440-
-Durl="https://maven.pkg.github.com/${REPOSITORY}"
441-
442-
# central.sonatype.org/publish/publish-portal-api/#authentication-authorization
443-
# github.com/slsa-framework/slsa-github-generator/blob/4876e96b8268/actions/maven/publish/action.yml#L49
444-
# docs.github.com/en/actions/tutorials/publish-packages/publish-java-packages-with-maven#publishing-packages-to-the-maven-central-repository-and-github-packages
445-
- name: 🏛️ Setup for Maven Central
446-
uses: actions/setup-java@v4
447-
with:
448-
java-version: '17'
449-
distribution: 'temurin'
450-
server-id: ossrh
451-
server-username: MAVEN_USERNAME
452-
server-password: MAVEN_PASSWORD
453-
gpg-private-key: ${{ secrets.OSSRH_CELZERO_GPG_PRIVATE_KEY }}
454-
gpg-passphrase: ${{ secrets.OSSRH_CELZERO_GPG_PASSPHRASE }}
455-
456-
- name: 📦 Publish to Maven Central
457-
shell: bash
458-
env:
459-
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
460-
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
461-
MAVEN_NS: ${{ secrets.OSSRH_CELZERO_NAMESPACE }}
462-
MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_CELZERO_GPG_PASSPHRASE }}
463-
run: |
464-
mvn -f ${POM_OSSRH} versions:set -DnewVersion=${VCSVER} -DgenerateBackupPoms=false
465-
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#getting-started-for-maven-api-like-plugins
466-
# github.com/videolan/vlc-android/blob/c393dd0699/buildsystem/maven/deploy-to-mavencentral.sh#L119
467-
468-
# upload both stripped and debug
469-
mvn gpg:sign-and-deploy-file \
470-
-DgroupId="${GROUP_OSSRH}" \
471-
-DartifactId="${ARTIFACT}" \
472-
-Dversion="$VCSVER" \
473-
-Dpackaging="${PACK}" \
474-
-Dfile="${DIST_DIR}/${FOUT}" \
475-
-DrepositoryId="${REPO_OSSRH}" \
476-
-DpomFile=${POM_OSSRH} \
477-
-Dgpg.keyname=C3F3F4A160BB2CFFB5528699F19CE6642C40085C \
478-
-Dsources="${DIST_DIR}/${SOURCES}" \
479-
-Durl="https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
480-
481-
mvn gpg:sign-and-deploy-file \
482-
-DgroupId="${GROUP_OSSRH}" \
483-
-DartifactId="${ARTIFACT}" \
484-
-Dversion="$VCSVER" \
485-
-Dpackaging="${PACK}" \
486-
-Dfile="${DIST_DIR}/${FOUTDBG}" \
487-
-Dclassifier=${CLASSDBG} \
488-
-DrepositoryId="${REPO_OSSRH}" \
489-
-DgeneratePom=false \
490-
-Dgpg.keyname=C3F3F4A160BB2CFFB5528699F19CE6642C40085C \
491-
-Durl="https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
492-
493-
# central.sonatype.org/publish/publish-portal-api/#authentication-authorization
494-
tok=$(printf "${MAVEN_USERNAME}:${MAVEN_PASSWORD}" | base64)
495-
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#1-modify-your-ci-script
496-
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#post-to-manualuploaddefaultrepositorynamespace
497-
# auth required for publishing_type=automatic
498-
curl -D - -X POST -H "Authorization: Bearer ${tok}" \
499-
"https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/${GROUP_OSSRH}?publishing_type=automatic"
319+
uses: ./.github/workflows/publish-manual.yml
320+
with:
321+
run-id: ${{ github.run_id }}
322+
vcsver: ${{ needs.build.outputs.vcs-ver }}
323+
artifact-subjects: ${{ needs.build.outputs.artifact-subjects }}
324+
sbom-info: ${{ needs.build.outputs.sbom-info }}
325+
secrets: inherit
500326

501327
osv:
502328
name: 🛡️ OSV scanner

.github/workflows/publish-manual.yml renamed to .github/workflows/publish.yml

Lines changed: 94 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,30 @@ on:
77
description: "Workflow run id that produced signed artifacts (from go.yml build job)"
88
required: true
99
type: number
10+
workflow_call:
11+
inputs:
12+
run-id:
13+
description: "Workflow run id that produced signed artifacts"
14+
required: true
15+
type: number
16+
vcsver:
17+
description: "Short git version"
18+
required: false
19+
type: string
20+
artifact-subjects:
21+
description: "JSON array of artifact subjects with sha256 digests"
22+
required: false
23+
type: string
24+
sbom-info:
25+
description: "SBOM info JSON blob with subjects and digest"
26+
required: false
27+
type: string
28+
29+
env:
30+
ARTIFACT_PATTERN: "firestack-aar-*"
31+
SBOM_PATTERN: "firestack-sbom-*"
32+
SBOM_MANIFEST: "manifest.spdx.json"
33+
SBOM_PREDICATE: "https://spdx.dev/Document/v2.2"
1034

1135
permissions:
1236
contents: read
@@ -42,6 +66,10 @@ jobs:
4266
# POM for Maven Central
4367
POM_OSSRH: ossrhpom.xml
4468
DIST_DIR: dist
69+
RUN_ID: ${{ inputs.run-id || inputs['build-run-id'] }}
70+
VCSVER_INPUT: ${{ inputs.vcsver }}
71+
ARTIFACT_SUBJECTS: ${{ inputs['artifact-subjects'] }}
72+
SBOM_INFO: ${{ inputs['sbom-info'] }}
4573
steps:
4674
- name: 🥏 Checkout
4775
uses: actions/checkout@v6
@@ -51,10 +79,14 @@ jobs:
5179
- name: ℹ️ Source run metadata
5280
id: runmeta
5381
env:
54-
RUN_ID: ${{ inputs.build-run-id }}
82+
RUN_ID: ${{ env.RUN_ID }}
5583
GH_TOKEN: ${{ github.token }}
5684
run: |
5785
set -euo pipefail
86+
if [ -n "${VCSVER_INPUT:-}" ]; then
87+
printf 'vcsver=%s\n' "${VCSVER_INPUT}" >> "$GITHUB_OUTPUT"
88+
exit 0
89+
fi
5890
info=$(gh run view "$RUN_ID" --json headSha,headBranch,event,displayTitle)
5991
echo "$info" | jq
6092
sha=$(echo "$info" | jq -r '.headSha')
@@ -69,16 +101,16 @@ jobs:
69101
- name: ⬇️ Download artifacts
70102
uses: actions/download-artifact@v4
71103
with:
72-
pattern: firestack-aar-*
73-
run-id: ${{ inputs.build-run-id }}
104+
pattern: ${{ env.ARTIFACT_PATTERN }}
105+
run-id: ${{ env.RUN_ID }}
74106
github-token: ${{ github.token }}
75107
path: ${{ env.DIST_DIR }}
76108

77109
- name: ⬇️ Download SBOM artifact
78110
uses: actions/download-artifact@v4
79111
with:
80-
pattern: firestack-sbom-*
81-
run-id: ${{ inputs.build-run-id }}
112+
pattern: ${{ env.SBOM_PATTERN }}
113+
run-id: ${{ env.RUN_ID }}
82114
github-token: ${{ github.token }}
83115
path: sbom
84116

@@ -97,25 +129,64 @@ jobs:
97129
gh attestation verify "$file" -R "$REPO"
98130
done
99131
132+
if [ -n "${ARTIFACT_SUBJECTS:-}" ]; then
133+
jq -c '.[]' <<<"${ARTIFACT_SUBJECTS}" | while read -r subject; do
134+
name=$(jq -r '.name' <<<"$subject")
135+
digest=$(jq -r '.digest' <<<"$subject")
136+
file="${ART_DIR}/${name##*/}"
137+
if [ ! -f "$file" ]; then
138+
echo "::error::missing artifact $file for digest check" >&2
139+
exit 13
140+
fi
141+
want=${digest#sha256:}
142+
got=$(sha256sum "$file" | awk '{print $1}')
143+
if [ "$got" != "$want" ]; then
144+
echo "::error::digest mismatch for $file (got $got, want $want)" >&2
145+
exit 14
146+
fi
147+
done
148+
fi
149+
100150
- name: 🔐 Verify SBOM attestation
101151
env:
102152
REPO: ${{ github.repository }}
103153
GH_TOKEN: ${{ github.token }}
104154
run: |
155+
# andrewlock.net/creating-sbom-attestations-in-github-actions/
105156
set -euo pipefail
106-
sbom_file=$(find sbom -name manifest.spdx.json -print -quit)
157+
if [ -n "${SBOM_INFO:-}" ]; then
158+
name=$(jq -r '.path' <<<"${SBOM_INFO}")
159+
sbom_file="sbom/$(jq -r '.artifactName' <<<"${SBOM_INFO}")/${name}"
160+
digest=$(jq -r '.digest' <<<"${SBOM_INFO}")
161+
else
162+
sbom_file=$(find sbom -name "${SBOM_MANIFEST}" -print -quit)
163+
digest=""
164+
fi
165+
107166
if [ -z "$sbom_file" ]; then
108167
echo "::error::SBOM file not found in sbom/" >&2
109-
exit 13
168+
exit 15
110169
fi
111-
gh attestation verify "$sbom_file" -R "$REPO" --predicate-type "https://spdx.dev/Document/v2.2"
170+
171+
if [ -n "$digest" ] && [ "$digest" != "null" ]; then
172+
want=${digest#sha256:}
173+
got=$(sha256sum "$sbom_file" | awk '{print $1}')
174+
if [ "$got" != "$want" ]; then
175+
echo "::error::SBOM digest mismatch (got $got, want $want)" >&2
176+
exit 16
177+
fi
178+
fi
179+
180+
gh attestation verify "$sbom_file" -R "$REPO" --predicate-type "${SBOM_PREDICATE}"
112181
113182
- name: 🏷️ Setup for GitHub Packages
114183
uses: actions/setup-java@v4
115184
with:
116185
java-version: '17'
117186
distribution: 'temurin'
118187

188+
# docs.github.com/en/actions/tutorials/build-and-test-code/java-with-maven
189+
# docs.github.com/en/actions/tutorials/publish-packages/publish-java-packages-with-maven#publishing-packages-to-github-packages
119190
- name: 😺 Publish to GitHub Packages
120191
shell: bash
121192
env:
@@ -124,6 +195,11 @@ jobs:
124195
GITHUB_TOKEN: ${{ github.token }}
125196
VCSVER: ${{ steps.runmeta.outputs.vcsver }}
126197
run: |
198+
# uploaded at:
199+
# maven.pkg.github.com/celzero/firestack/com/github/celzero/firestack/<commit>/firestack-<commit>.aar
200+
# github.com/deelaa-marketplace/commons-workflow/blob/637dc111/flows/publish-api.yml#L49
201+
# github.com/markocto/cf-octopub/blob/bba2de2c/github/script/action.yaml#L118
202+
# publish both stripped and debug
127203
mvn deploy:deploy-file \
128204
-DgroupId="${GROUP_GITHUB}" \
129205
-DartifactId="${ARTIFACT}" \
@@ -137,6 +213,9 @@ jobs:
137213
-Dsources="${DIST_DIR}/${SOURCES}" \
138214
-Durl="https://maven.pkg.github.com/${REPOSITORY}"
139215
216+
# central.sonatype.org/publish/publish-portal-api/#authentication-authorization
217+
# github.com/slsa-framework/slsa-github-generator/blob/4876e96b8268/actions/maven/publish/action.yml#L49
218+
# docs.github.com/en/actions/tutorials/publish-packages/publish-java-packages-with-maven#publishing-packages-to-the-maven-central-repository-and-github-packages
140219
- name: 🏛️ Setup for Maven Central
141220
uses: actions/setup-java@v4
142221
with:
@@ -158,6 +237,8 @@ jobs:
158237
VCSVER: ${{ steps.runmeta.outputs.vcsver }}
159238
run: |
160239
mvn -f ${POM_OSSRH} versions:set -DnewVersion=${VCSVER} -DgenerateBackupPoms=false
240+
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#getting-started-for-maven-api-like-plugins
241+
# github.com/videolan/vlc-android/blob/c393dd0699/buildsystem/maven/deploy-to-mavencentral.sh#L119
161242
162243
mvn gpg:sign-and-deploy-file \
163244
-DgroupId="${GROUP_OSSRH}" \
@@ -183,6 +264,11 @@ jobs:
183264
-Dgpg.keyname=C3F3F4A160BB2CFFB5528699F19CE6642C40085C \
184265
-Durl="https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
185266
267+
# central.sonatype.org/publish/publish-portal-api/#authentication-authorization
186268
tok=$(printf "${MAVEN_USERNAME}:${MAVEN_PASSWORD}" | base64)
269+
270+
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#1-modify-your-ci-script
271+
# central.sonatype.org/publish/publish-portal-ossrh-staging-api/#post-to-manualuploaddefaultrepositorynamespace
272+
# auth required for publishing_type=automatic
187273
curl -D - -X POST -H "Authorization: Bearer ${tok}" \
188274
"https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/${GROUP_OSSRH}?publishing_type=automatic"

0 commit comments

Comments
 (0)