Skip to content

Commit cab8ee9

Browse files
Benjosh95Benjosh95
committed
add rpm release job and script
1 parent 9ffeeec commit cab8ee9

File tree

2 files changed

+131
-35
lines changed

2 files changed

+131
-35
lines changed

‎.github/workflows/release.yaml‎

Lines changed: 37 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -79,40 +79,42 @@ jobs:
7979
name: goreleaser-dist-temp
8080
path: dist
8181
retention-days: 1
82-
83-
# publish-apt:
84-
# name: Publish APT
85-
# runs-on: macOS-latest
86-
# needs: [goreleaser]
87-
# if: github.event_name != 'workflow_dispatch'
88-
# env:
89-
# # Needed to publish new packages to our S3-hosted APT repo
90-
# AWS_ACCESS_KEY_ID: ${{ secrets.OBJECT_STORAGE_ACCESS_KEY_ID }}
91-
# AWS_SECRET_ACCESS_KEY: ${{ secrets.OBJECT_STORAGE_SECRET_ACCESS_KEY }}
92-
# steps:
93-
# - name: Checkout
94-
# uses: actions/checkout@v5
9582

96-
# # use the artifacts from the "goreleaser" job
97-
# - name: Download artifacts from workflow
98-
# uses: actions/download-artifact@v5
99-
# with:
100-
# name: goreleaser-dist-temp
101-
# path: dist
102-
103-
# - name: Install Aptly
104-
# run: brew install aptly
105-
106-
# - name: Import GPG key
107-
# uses: crazy-max/ghaction-import-gpg@v6
108-
# id: import_gpg
109-
# with:
110-
# gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
111-
# passphrase: ${{ secrets.GPG_PASSPHRASE }}
83+
84+
85+
publish-rpm:
86+
name: Publish RPM
87+
runs-on: ubuntu-latest
88+
needs: [goreleaser]
89+
env:
90+
# Needed to publish new packages to our S3-hosted RPM repo
91+
AWS_ACCESS_KEY_ID: ${{ secrets.TEST_OBJECT_STORAGE_ACCESS_KEY_ID }}
92+
AWS_SECRET_ACCESS_KEY: ${{ secrets.TEST_OBJECT_STORAGE_SECRET_ACCESS_KEY }}
93+
steps:
94+
- name: Checkout
95+
uses: actions/checkout@v5
11296

113-
# - name: Publish packages to APT repo
114-
# if: contains(github.ref_name, '-') == false
115-
# env:
116-
# GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
117-
# GPG_PRIVATE_KEY_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
118-
# run: ./scripts/publish-apt-packages.sh
97+
- name: Download artifacts from workflow
98+
uses: actions/download-artifact@v5
99+
with:
100+
name: goreleaser-dist-temp
101+
path: dist
102+
103+
- name: Install RPM tools
104+
run: |
105+
sudo apt-get update
106+
sudo apt-get install -y createrepo-c rpm-sign
107+
108+
- name: Import GPG key
109+
uses: crazy-max/ghaction-import-gpg@v6
110+
id: import_gpg
111+
with:
112+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
113+
passphrase: ${{ secrets.GPG_PASSPHRASE }}
114+
115+
- name: Publish RPM packages
116+
# if: contains(github.ref_name, '-') == false
117+
env:
118+
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
119+
GPG_PRIVATE_KEY_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
120+
run: ./scripts/publish-rpm-packages.sh

‎scripts/publish-rpm-packages.sh‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/usr/bin/env bash
2+
3+
# This script is used to publish new RPM packages to the CLI RPM repository
4+
# Usage: ./publish-rpm-packages.sh
5+
set -eo pipefail
6+
7+
PACKAGES_BUCKET_URL="https://distribution-test.object.storage.eu01.onstackit.cloud"
8+
PUBLIC_KEY_FILE_PATH="keys/key.gpg"
9+
RPM_REPO_PATH="rpm/cli"
10+
RPM_BUCKET_NAME="distribution-test"
11+
CUSTOM_KEYRING_FILE="rpm-keyring.gpg"
12+
DISTRIBUTION="stackit"
13+
GORELEASER_PACKAGES_FOLDER="dist/"
14+
15+
# We need to disable the key database daemon (keyboxd)
16+
# This can be done by removing "use-keyboxd" from ~/.gnupg/common.conf (see https://github.com/gpg/gnupg/blob/master/README)
17+
echo -n >~/.gnupg/common.conf
18+
19+
# Create RPM repository directory structure
20+
printf ">>> Creating RPM repository structure \n"
21+
mkdir -p rpm-repo/x86_64
22+
mkdir -p rpm-repo/i386
23+
mkdir -p rpm-repo/aarch64
24+
25+
# Copy RPM packages and signatures to appropriate architecture directories
26+
printf "\n>>> Copying RPM packages and signatures to architecture directories \n"
27+
28+
# Copy x86_64 packages (amd64)
29+
for file in ${GORELEASER_PACKAGES_FOLDER}*_amd64.rpm*; do
30+
if [ -f "$file" ]; then
31+
cp "$file" rpm-repo/x86_64/
32+
printf "Copied $(basename "$file") to x86_64/\n"
33+
fi
34+
done
35+
36+
# Copy i386 packages
37+
for file in ${GORELEASER_PACKAGES_FOLDER}*_386.rpm*; do
38+
if [ -f "$file" ]; then
39+
cp "$file" rpm-repo/i386/
40+
printf "Copied $(basename "$file") to i386/\n"
41+
fi
42+
done
43+
44+
# Copy aarch64 packages (arm64)
45+
for file in ${GORELEASER_PACKAGES_FOLDER}*_arm64.rpm*; do
46+
if [ -f "$file" ]; then
47+
cp "$file" rpm-repo/aarch64/
48+
printf "Copied $(basename "$file") to aarch64/\n"
49+
fi
50+
done
51+
52+
# Download existing repository metadata if it exists
53+
printf "\n>>> Downloading existing repository metadata \n"
54+
aws s3 sync s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ rpm-repo/ --delete || echo "No existing repository found, creating new one"
55+
56+
# Create repository metadata for each architecture
57+
printf "\n>>> Creating repository metadata \n"
58+
for arch in x86_64 i386 aarch64; do
59+
if [ -d "rpm-repo/${arch}" ] && [ "$(ls -A rpm-repo/${arch})" ]; then
60+
printf "Creating metadata for ${arch}...\n"
61+
62+
# List what we're working with
63+
printf "Files in ${arch}: $(ls rpm-repo/${arch}/ | tr '\n' ' ')\n"
64+
65+
# Create repository metadata
66+
createrepo_c --update rpm-repo/${arch}
67+
68+
# Sign the repository metadata
69+
printf "Signing repository metadata for ${arch}...\n"
70+
gpg --detach-sign --armor --local-user "${GPG_PRIVATE_KEY_FINGERPRINT}" --passphrase "${GPG_PASSPHRASE}" rpm-repo/${arch}/repodata/repomd.xml
71+
72+
# Verify the signature was created
73+
if [ -f "rpm-repo/${arch}/repodata/repomd.xml.asc" ]; then
74+
printf "Repository metadata signed successfully for ${arch}\n"
75+
else
76+
printf "WARNING: Repository metadata signature not created for ${arch}\n"
77+
fi
78+
else
79+
printf "No packages found for ${arch}, skipping...\n"
80+
fi
81+
done
82+
83+
# Upload the updated repository to S3
84+
printf "\n>>> Uploading repository to S3 \n"
85+
aws s3 sync rpm-repo/ s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ --delete
86+
87+
# Upload the public key
88+
printf "\n>>> Uploading public key \n"
89+
gpg --armor --export "${GPG_PRIVATE_KEY_FINGERPRINT}" > public-key.asc
90+
aws s3 cp public-key.asc s3://${RPM_BUCKET_NAME}/${PUBLIC_KEY_FILE_PATH}
91+
92+
printf "\n>>> RPM repository published successfully! \n"
93+
printf "Repository URL: ${PACKAGES_BUCKET_URL}/${RPM_REPO_PATH}/ \n"
94+
printf "Public key URL: ${PACKAGES_BUCKET_URL}/${PUBLIC_KEY_FILE_PATH} \n"

0 commit comments

Comments
 (0)