121 lines
4.6 KiB
YAML
121 lines
4.6 KiB
YAML
---
|
|
name: Update RPM Packages
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
package:
|
|
description: "Single package to update (blank = all)"
|
|
required: false
|
|
type: string
|
|
force_rebuild:
|
|
description: "Bump the Release even with no new upstream version"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
force_refresh:
|
|
description: "Re-download the source and rebuild even when nothing changed"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
no_git_push:
|
|
description: "Dry run: build, but neither upload nor push"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
update:
|
|
runs-on: ubuntu-latest
|
|
# rpmbuild runs as the unprivileged `builder` user inside a Fedora image;
|
|
# the spec is built with `dist` undefined, so the noarch package is the
|
|
# same for every RPM distribution the registry serves.
|
|
#
|
|
# Prebuilt by build-image.yaml (see dockerfile) so the toolchain is not
|
|
# reinstalled in every job every night.
|
|
container:
|
|
image: git.bjphoster.com/rpm/autoupdate:latest
|
|
credentials:
|
|
username: ${{ vars.REGISTRY_USER }}
|
|
password: ${{ secrets.GIT_TOKEN }}
|
|
|
|
strategy:
|
|
# One broken package must not cancel the rest of the matrix.
|
|
fail-fast: false
|
|
matrix:
|
|
package:
|
|
- skeptical-updater
|
|
|
|
steps:
|
|
# No bootstrap step: node, git, jq, curl and the packaging toolchain all
|
|
# come from the prebuilt image above. node in particular has to be present
|
|
# before this action runs, since actions/checkout is JavaScript and the
|
|
# runner executes it with `node` from the image.
|
|
- uses: actions/checkout@v4
|
|
|
|
# The same credential serves git (clone/push of the package repos) and
|
|
# the package registry upload, which autoupdate.sh reads back through
|
|
# `git credential fill`. GIT_TOKEN therefore needs write:repository AND
|
|
# write:package.
|
|
- name: Configure git
|
|
env:
|
|
GIT_NAME: ${{ vars.GIT_NAME }}
|
|
GIT_EMAIL: ${{ vars.GIT_EMAIL }}
|
|
GIT_HOST: ${{ vars.GIT_HOST || 'git.bjphoster.com' }}
|
|
GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Validate HERE rather than letting a missing secret surface as an
|
|
# opaque 401 several steps later.
|
|
for v in GIT_NAME GIT_EMAIL GIT_TOKEN; do
|
|
if [ -z "${!v//[[:space:]]/}" ]; then
|
|
echo "::error::${v} is empty or unset (see README: required secrets and variables)" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
git config --global user.name "${GIT_NAME}"
|
|
git config --global user.email "${GIT_EMAIL}"
|
|
git config --global credential.helper store
|
|
echo "https://${GIT_EMAIL//@/%40}:${GIT_TOKEN}@${GIT_HOST}" > ~/.git-credentials
|
|
chmod 600 ~/.git-credentials
|
|
|
|
# The `builder` user is baked into the image; this only hands it the
|
|
# workspace and the credentials written by the previous step.
|
|
- name: Hand over to the build user
|
|
run: |
|
|
set -euo pipefail
|
|
chown -R builder:builder "${GITHUB_WORKSPACE}"
|
|
cp /root/.gitconfig /root/.git-credentials /home/builder/
|
|
chown -R builder:builder /home/builder
|
|
|
|
- name: Update ${{ matrix.package }}
|
|
env:
|
|
GIT_HOST: ${{ vars.GIT_HOST || 'git.bjphoster.com' }}
|
|
# Compared against both `true` and 'true' on purpose. A bare
|
|
# `${{ inputs.x && '1' || '' }}` is wrong if the runner hands the
|
|
# input over as the STRING "false", which is truthy -- that would
|
|
# silently enable the flag on every run.
|
|
FORCE_REBUILD: ${{ (inputs.force_rebuild == true || inputs.force_rebuild == 'true') && '1' || '' }}
|
|
FORCE_REFRESH: ${{ (inputs.force_refresh == true || inputs.force_refresh == 'true') && '1' || '' }}
|
|
NO_GIT_PUSH: ${{ (inputs.no_git_push == true || inputs.no_git_push == 'true') && '1' || '' }}
|
|
run: |
|
|
set -euo pipefail
|
|
# workflow_dispatch with a package name runs only that one.
|
|
want="${{ inputs.package }}"
|
|
if [ -n "${want}" ] && [ "${want}" != "${{ matrix.package }}" ]; then
|
|
echo "skipping ${{ matrix.package }} (dispatch asked for ${want})"
|
|
exit 0
|
|
fi
|
|
runuser -u builder -- env \
|
|
GIT_HOST="${GIT_HOST}" \
|
|
FORCE_REBUILD="${FORCE_REBUILD}" \
|
|
FORCE_REFRESH="${FORCE_REFRESH}" \
|
|
NO_GIT_PUSH="${NO_GIT_PUSH}" \
|
|
./autoupdate.sh "${{ matrix.package }}"
|