mirror of
https://gitea.com/gitea/tea.git
synced 2026-08-05 23:07:39 +02:00
Lunny Xiao
61b8536e4a
Ports the Cloudflare R2 release mirror from [gitea.com/gitea/runner](https://gitea.com/gitea/runner) to `tea`, so release artifacts land in R2 alongside S3 for the duration of the migration away from S3. Two commits, meant to be reviewed in order. ## 1. `ci(goreleaser): migrate release config to goreleaser v2` A purely mechanical migration, no behaviour change intended: - add `version: 2` - `blobs.folder` -> `blobs.directory` - `snapshot.name_template` -> `snapshot.version_template` - `nightly.name_template` -> `nightly.version_template` - `version: "~> v1"` -> `"~> v2"` in both release workflows This is a prefactor rather than scope creep. Under goreleaser v1 the custom-publisher pipe runs *4th*, before the `release` pipe; under v2 it runs *last*. That ordering difference matters for the change below: on v1 a failed R2 upload would abort the publish after every artifact had already gone to S3 but **before** the Gitea release was created, leaving a half-finished release. On v2 the R2 mirror runs after the release exists, which matches the behaviour the runner repo already has in production. The pre-existing `archives.format` deprecation warning is deliberately left alone; it is orthogonal to this change and the runner repo has not addressed it either. ## 2. `ci(goreleaser): mirror release artifacts to Cloudflare R2` - **`scripts/upload-r2.sh`** — uploads one local file to one R2 object key using curl's built-in AWS SigV4 signer (R2 is S3-API compatible). Credentials are fed through `curl --config -` so they never appear in `ps` output. Also provides a `--check-config` preflight mode. This file is byte-identical to the runner repo's copy. - **`.goreleaser.yaml`** — a `publishers:` entry mirroring the existing S3 `blobs:` upload into R2. A second `blobs:` entry is not usable here: the blob pipe authenticates from the global `AWS_*` environment and has no per-entry credentials, whereas `publishers:` supports per-entry `env:`. - **Both release workflows** — forward the R2 secrets, plus an early `check R2 configuration` step. Custom publishers run as the very last step of goreleaser's publish pipeline, so without a preflight a missing secret would only surface after the release had been created and every artifact already uploaded to S3. ### Deviation from the runner implementation The publisher here also sets `signature: true` in addition to `checksum: true`. `tea` has a `signs:` block that GPG-signs the checksum file, and the S3 blob pipe uploads the resulting `checksums.txt.sig`; without `signature: true` the R2 mirror would carry the artifacts and their checksums but no signature to verify them against. The object key prefix is `tea/{{ .Version }}/...`, matching the existing S3 `directory: "tea/{{.Version}}"`. ## Required repository secrets This PR is inert until these are configured. The preflight step will fail the release loudly if they are missing: - `R2_ENDPOINT` — e.g. `https://<account>.r2.cloudflarestorage.com` - `R2_BUCKET` - `R2_ACCESS_KEY_ID` - `R2_SECRET_ACCESS_KEY` ## Verification - `goreleaser check` against the migrated config (with the pro-only `nightly:` block temporarily stripped, since the check ran with the OSS v2 binary): *configuration is valid*, the only deprecation being the pre-existing `archives.format`. - A real `goreleaser build --snapshot --clean --single-target` against the v2 config: succeeded, including the `xz` and `.goreleaser.checksum.sh` post-hooks. - `scripts/upload-r2.sh`: clean under `sh -n` and `shellcheck`; all four `--check-config` cases exercised (all vars unset, one missing, all set, wrong argument count). - The actual upload path was not exercised end to end, since that needs live R2 credentials. Reviewed-on: https://gitea.com/gitea/tea/pulls/1063 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>
96 lines
3.3 KiB
YAML
96 lines
3.3 KiB
YAML
name: goreleaser
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
|
|
jobs:
|
|
goreleaser:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
- run: git fetch --force --tags
|
|
# Custom publishers (the R2 mirror below) run as the very last
|
|
# step of goreleaser's publish pipeline, after the Gitea release
|
|
# has already been created and every artifact already uploaded
|
|
# to S3. Fail here instead, before anything is built or
|
|
# published, if the R2 secrets are missing.
|
|
- name: check R2 configuration
|
|
run: sh scripts/upload-r2.sh --check-config
|
|
env:
|
|
R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
|
|
R2_BUCKET: ${{ secrets.R2_BUCKET }}
|
|
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
|
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: "go.mod"
|
|
- name: import gpg
|
|
id: import_gpg
|
|
uses: crazy-max/ghaction-import-gpg@v7
|
|
with:
|
|
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
|
|
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
|
|
- name: get SDK version
|
|
id: sdk_version
|
|
run: echo "version=$(go list -f '{{.Version}}' -m gitea.dev/sdk)" >> "$GITHUB_OUTPUT"
|
|
- name: goreleaser
|
|
uses: goreleaser/goreleaser-action@v7
|
|
with:
|
|
distribution: goreleaser-pro
|
|
version: "~> v2"
|
|
args: release --nightly
|
|
env:
|
|
SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
|
|
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
|
|
AWS_REGION: ${{ secrets.AWS_REGION }}
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
S3_REGION: ${{ secrets.AWS_REGION }}
|
|
S3_BUCKET: ${{ secrets.AWS_BUCKET }}
|
|
R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
|
|
R2_BUCKET: ${{ secrets.R2_BUCKET }}
|
|
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
|
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
|
GORELEASER_FORCE_TOKEN: 'gitea'
|
|
GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
|
|
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
release-image:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_ORG: gitea
|
|
DOCKER_LATEST: nightly
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0 # all history for all branches and tags
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v4
|
|
|
|
- name: Set up Docker BuildX
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v7
|
|
env:
|
|
ACTIONS_RUNTIME_TOKEN: '' # See https://gitea.com/gitea/act_runner/issues/119
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: |
|
|
linux/amd64
|
|
linux/arm64
|
|
push: true
|
|
tags: |
|
|
gitea/tea:latest |