Skip to content

Commit e40fd92

Browse files
mvachmvach
committed
ci: release, scan and publish in one step
1 parent ebf4763 commit e40fd92

File tree

2 files changed

+58
-113
lines changed

2 files changed

+58
-113
lines changed

‎.github/workflows/release.yml‎

Lines changed: 57 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -9,145 +9,89 @@ on:
99
- 'v*'
1010

1111
jobs:
12-
build:
12+
build-and-release:
1313
runs-on: ubuntu-latest
14+
permissions:
15+
contents: write
1416
steps:
15-
- uses: actions/checkout@v4
17+
- name: Checkout
18+
uses: actions/checkout@v4
1619
with:
1720
fetch-depth: 0
1821
fetch-tags: true
22+
1923
- name: Set up Go
2024
uses: actions/setup-go@v4
2125
with:
2226
go-version: '1.23'
23-
24-
- name: Install keepassxc-cli
25-
run: sudo apt-get update && sudo apt-get install -y keepassxc
2627

27-
- name: Build
28-
run: go build
28+
- name: Install system dependencies (keepassxc + clamav)
29+
run: |
30+
sudo apt-get update
31+
sudo apt-get install -y --no-install-recommends keepassxc clamav
32+
sudo freshclam || echo "freshclam may have rate-limited; continuing with existing DB"
2933
30-
- name: Test
34+
- name: Run unit tests
3135
run: go test ./...
3236

33-
release:
34-
needs: build
35-
runs-on: ubuntu-latest
36-
steps:
37-
- uses: actions/checkout@v4
38-
with:
39-
fetch-depth: 0
40-
fetch-tags: true
41-
- name: Set up Go
42-
uses: actions/setup-go@v4
43-
with:
44-
go-version: '1.23'
45-
- name: Build with GoReleaser (no publish)
46-
uses: goreleaser/goreleaser-action@v5
37+
- name: Install GoReleaser (no execution yet)
38+
uses: goreleaser/goreleaser-action@v6
4739
with:
4840
distribution: goreleaser
49-
version: latest
50-
args: build --clean
41+
version: '~> v2'
42+
install-only: true
43+
44+
- name: GoReleaser release (build only, skip publish & announce)
5145
env:
5246
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
53-
54-
- name: Upload artifacts for scanning
55-
uses: actions/upload-artifact@v4
56-
with:
57-
name: release-artifacts
58-
path: dist/
59-
retention-days: 1
47+
run: goreleaser release --clean --skip=publish --skip=announce
6048

61-
virus-scan:
62-
needs: release
63-
runs-on: ubuntu-latest
64-
steps:
65-
- name: Download release artifacts
66-
uses: actions/download-artifact@v4
67-
with:
68-
name: release-artifacts
69-
path: dist/
70-
71-
- name: Install ClamAV
49+
- name: Diagnose GoReleaser commands
7250
run: |
73-
sudo apt-get update
74-
sudo apt-get install -y clamav clamav-daemon
75-
sudo systemctl stop clamav-freshclam
76-
sudo freshclam
77-
sudo systemctl start clamav-daemon
78-
# Wait for daemon to start
79-
sleep 10
80-
81-
- name: Scan release artifacts
82-
run: |
83-
echo "Scanning release artifacts for viruses..."
84-
85-
clamscan --recursive --verbose --infected --bell dist/
86-
scan_result=$?
87-
88-
if [ $scan_result -eq 0 ]; then
89-
echo "✅ All artifacts are clean - no viruses detected"
90-
elif [ $scan_result -eq 1 ]; then
91-
echo "❌ Virus detected in artifacts!"
92-
exit 1
93-
else
94-
echo "⚠️ Scanner error occurred"
95-
exit 1
96-
fi
97-
98-
- name: Upload clean artifacts
99-
if: success()
100-
uses: actions/upload-artifact@v4
101-
with:
102-
name: scanned-artifacts
103-
path: dist/
104-
retention-days: 1
51+
set -e
52+
echo "GoReleaser version:"
53+
goreleaser --version || true
54+
echo "Root help (first lines):"
55+
goreleaser --help | head -n 40 || true
56+
echo "Subcommand help (release):"
57+
goreleaser release --help | head -n 25 || true
58+
echo "Trying 'goreleaser publish --help' (may fail if command unsupported):"
59+
goreleaser publish --help | head -n 25 || true
10560
106-
publish-release:
107-
needs: virus-scan
108-
runs-on: ubuntu-latest
109-
steps:
110-
- uses: actions/checkout@v4
111-
with:
112-
fetch-depth: 0
113-
fetch-tags: true
114-
115-
- name: Download scanned artifacts
116-
uses: actions/download-artifact@v4
117-
with:
118-
name: scanned-artifacts
119-
path: dist/
120-
121-
- name: Extract version from tag
122-
id: version
123-
run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
124-
125-
- name: List available artifacts
61+
- name: Virus scan dist artifacts
12662
run: |
127-
echo "Available artifacts in dist/:"
128-
find dist/ -type f -ls
129-
130-
- name: Create release with scanned artifacts
131-
run: |
132-
# Collect standard release artifacts (archives and checksums)
133-
ARTIFACTS=$(find dist/ \( -name "*.tar.gz" -o -name "checksums.txt" \) -type f | tr '\n' ' ')
134-
135-
echo "Artifacts to upload: $ARTIFACTS"
136-
137-
if [ -z "$ARTIFACTS" ]; then
138-
echo "❌ No artifacts found to upload!"
63+
echo "Scanning dist/ with ClamAV..."
64+
# clamscan returns 1 if a virus is found, 0 if none found.
65+
clamscan --recursive --infected --verbose dist/ || SCAN_STATUS=$?
66+
if [ "${SCAN_STATUS:-0}" -eq 1 ]; then
67+
echo "❌ Virus detected in build artifacts. Aborting publish." >&2
13968
exit 1
69+
elif [ "${SCAN_STATUS:-0}" -gt 1 ]; then
70+
echo "❌ ClamAV scan error (exit code $SCAN_STATUS). Aborting publish." >&2
71+
exit $SCAN_STATUS
14072
fi
141-
142-
gh release create ${{ steps.version.outputs.VERSION }} \
143-
--title "Release ${{ steps.version.outputs.VERSION }}" \
144-
--generate-notes \
145-
$ARTIFACTS
73+
echo "✅ No viruses found. Proceeding to publish."
74+
75+
- name: GoReleaser publish
14676
env:
14777
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
78+
run: |
79+
set -e
80+
if goreleaser --help 2>&1 | grep -q "publish"; then
81+
echo "'publish' command available; running goreleaser publish"
82+
goreleaser publish --clean
83+
else
84+
echo "'publish' command NOT available; falling back to running full release now (will rebuild/publish)."
85+
# Attempt to reuse previous artifacts by skipping build phases where possible
86+
# If skip flags are not recognized they will be ignored.
87+
goreleaser release --clean --skip=announce || {
88+
echo "Fallback release failed" >&2
89+
exit 1
90+
}
91+
fi
14892
149-
publish-versioned-docs:
150-
needs: publish-release
93+
publish-docs:
94+
needs: build-and-release
15195
runs-on: ubuntu-latest
15296
permissions:
15397
contents: write

‎.goreleaser.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ changelog:
7676
- '^refactor:'
7777
- Merge pull request
7878
- Merge branch
79+
7980
release:
8081
github:
8182
owner: mvach

0 commit comments

Comments
 (0)