feat: establish NekoNest Cloud control and relay

2026-08-12 23:25:43 +08:00
commit f27606b709
222 changed files with 71456 additions and 0 deletions
@@ -0,0 +1,81 @@
+name: Verify pinned Cloud Relay
+
+on:
+  workflow_dispatch:
+    inputs:
+      relay_core_tag:
+        description: Exact published Relay Core tag, for example relaycore/v0.1.0
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloud-relay-${{ inputs.relay_core_tag }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: relay
+    env:
+      GOWORK: 'off'
+      CGO_ENABLED: '1'
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: relay/go.mod
+          cache-dependency-path: relay/go.sum
+
+      - name: Require an immutable released Relay Core dependency
+        shell: pwsh
+        env:
+          RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
+        run: |
+          if ($env:RELAY_CORE_TAG -notmatch '^relaycore/v[0-9]+\.[0-9]+\.[0-9]+$') {
+            throw 'relay_core_tag must be an exact relaycore/vX.Y.Z tag'
+          }
+          if (Select-String -Path go.mod -Pattern '^replace\s' -Quiet) {
+            throw 'Cloud Relay go.mod must not contain replace directives'
+          }
+          $expected = $env:RELAY_CORE_TAG.Substring('relaycore/'.Length)
+          $actual = (go list -m -f '{{.Version}}' github.com/klarkxy/nekonest/relaycore).Trim()
+          if ($actual -ne $expected) {
+            throw "go.mod requires $actual but workflow requested $expected"
+          }
+          go mod download
+
+      - name: Test, vet, race, and build
+        run: |
+          go test -count=1 ./...
+          go vet ./...
+          go test -race -count=1 ./...
+          go build -trimpath -o ../release/nekonest-cloud-relay ./cmd/relay
+
+      - name: Record source provenance
+        shell: pwsh
+        env:
+          RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
+        run: |
+          $cloudCommit = (git -C .. rev-parse HEAD).Trim()
+          $binaryHash = (Get-FileHash ../release/nekonest-cloud-relay -Algorithm SHA256).Hash.ToLowerInvariant()
+          [ordered]@{
+            cloud_commit = $cloudCommit
+            relay_core_tag = $env:RELAY_CORE_TAG
+            binary_sha256 = $binaryHash
+            built_at = (Get-Date).ToUniversalTime().ToString('o')
+          } | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM ../release/cloud-relay-provenance.json
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: nekonest-cloud-relay-${{ github.run_id }}
+          path: |
+            release/nekonest-cloud-relay
+            release/cloud-relay-provenance.json
+          if-no-files-found: error
+          retention-days: 7