piadina/.github/workflows/generate_binaries_linux.yml at main · erlef/piadina · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: Build piadina and azdora binaries - (linux)

on:
  workflow_call:
    inputs:
      arch:
        type: string
        description: The architecture to build for
        required: false
        default: "amd64" # amd64, arm64

      attest:
        type: boolean
        description: Whether to attest the build provenance
        required: false
        default: false

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  build:
    runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-latest' }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install deps
      run: |
        sudo apt update
        sudo apt install -y \
          git binutils build-essential \
          musl-dev musl-tools

    - name: download and build libcbor
      env:
        flags: >-
          -DCMAKE_C_COMPILER_AR=/usr/bin/ar
          -DCMAKE_C_COMPILER_RANLIB=/usr/bin/ranlib
          -DBUILD_SHARED_LIBS=OFF
          -DWITH_TESTS=OFF
      run: |
        git clone https://github.com/PJK/libcbor.git && \
        cd libcbor && \
        CC=musl-gcc cmake -B _build ${{ env.flags }} && \
        cmake --build _build -j$(nproc)

    - name: download and build libarchive
      env:
        flags: >-
          -DCMAKE_C_COMPILER_AR=/usr/bin/ar
          -DCMAKE_C_COMPILER_RANLIB=/usr/bin/ranlib
          -DENABLE_TEST=OFF
          -DENABLE_OPENSSL=OFF
          -DENABLE_ZLIB=OFF
          -DENABLE_BZip2=OFF
          -DENABLE_LZMA=OFF
          -DENABLE_ZSTD=OFF
          -DENABLE_LZ4=OFF
          -DENABLE_EXPAT=OFF
          -DENABLE_ICONV=OFF
          -DPOSIX_REGEX_LIB=NONE
          -DENABLE_LIBB2=OFF
          -DENABLE_LIBXML2=OFF
      run: |
        git clone https://github.com/libarchive/libarchive.git && \
        cd libarchive && \
        CC=musl-gcc cmake -B _build ${{ env.flags }} && \
        cmake --build _build -j$(nproc)

    - name: build piadina and azdora
      run: |
        ./autogen.sh && \
        ./configure && \
        make -j$(nproc) && \
        make check && \
        mv ${{ github.workspace }}/piadina/piadina ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }} && \
        mv ${{ github.workspace }}/azdora/azdora ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}

    - name: Compute checksums
      run: |
        sha256sum ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }} > ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}.sha256
        sha256sum ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }} > ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}.sha256

    - name: Attest build provenance of piadina
      if: ${{ inputs.attest }}
      uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
      id: attest-provenance-piadina
      with:
        subject-path: ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}

    - name: Export provenance bundle of piadina
      if: ${{ inputs.attest }}
      env:
        ATT_BUNDLE: ${{ steps.attest-provenance-piadina.outputs.bundle-path }}
      run: |
        set -euo pipefail
        cp "${{ env.ATT_BUNDLE }}" "${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}.sigstore"

    - name: Attest build provenance of azdora
      if: ${{ inputs.attest }}
      uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
      id: attest-provenance-azdora
      with:
        subject-path: ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}

    - name: Export provenance bundle of azdora
      if: ${{ inputs.attest }}
      env:
        ATT_BUNDLE: ${{ steps.attest-provenance-azdora.outputs.bundle-path }}
      run: |
        set -euo pipefail
        cp "${{ env.ATT_BUNDLE }}" "${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}.sigstore"

    - name: Upload piadina's binaries
      uses: actions/upload-artifact@v4
      with:
        name: piadina-linux-${{ inputs.arch }}
        path: |
           ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}
           ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}.sha256
           ${{ github.workspace }}/piadina/piadina-linux-${{ inputs.arch }}.sigstore

    - name: Upload azdora's binaries
      uses: actions/upload-artifact@v4
      with:
        name: azdora-linux-${{ inputs.arch }}
        path: |
           ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}
           ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}.sha256
           ${{ github.workspace }}/azdora/azdora-linux-${{ inputs.arch }}.sigstore