82 lines
2.6 KiB
YAML
82 lines
2.6 KiB
YAML
name: Verify pinned Cloud Relay
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
relay_core_tag:
|
|
description: Exact published Relay Core tag, for example relaycore/v0.1.0
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: cloud-relay-${{ inputs.relay_core_tag }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: relay
|
|
env:
|
|
GOWORK: 'off'
|
|
CGO_ENABLED: '1'
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: relay/go.mod
|
|
cache-dependency-path: relay/go.sum
|
|
|
|
- name: Require an immutable released Relay Core dependency
|
|
shell: pwsh
|
|
env:
|
|
RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
|
|
run: |
|
|
if ($env:RELAY_CORE_TAG -notmatch '^relaycore/v[0-9]+\.[0-9]+\.[0-9]+$') {
|
|
throw 'relay_core_tag must be an exact relaycore/vX.Y.Z tag'
|
|
}
|
|
if (Select-String -Path go.mod -Pattern '^replace\s' -Quiet) {
|
|
throw 'Cloud Relay go.mod must not contain replace directives'
|
|
}
|
|
$expected = $env:RELAY_CORE_TAG.Substring('relaycore/'.Length)
|
|
$actual = (go list -m -f '{{.Version}}' github.com/klarkxy/nekonest/relaycore).Trim()
|
|
if ($actual -ne $expected) {
|
|
throw "go.mod requires $actual but workflow requested $expected"
|
|
}
|
|
go mod download
|
|
|
|
- name: Test, vet, race, and build
|
|
run: |
|
|
go test -count=1 ./...
|
|
go vet ./...
|
|
go test -race -count=1 ./...
|
|
go build -trimpath -o ../release/nekonest-cloud-relay ./cmd/relay
|
|
|
|
- name: Record source provenance
|
|
shell: pwsh
|
|
env:
|
|
RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
|
|
run: |
|
|
$cloudCommit = (git -C .. rev-parse HEAD).Trim()
|
|
$binaryHash = (Get-FileHash ../release/nekonest-cloud-relay -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
[ordered]@{
|
|
cloud_commit = $cloudCommit
|
|
relay_core_tag = $env:RELAY_CORE_TAG
|
|
binary_sha256 = $binaryHash
|
|
built_at = (Get-Date).ToUniversalTime().ToString('o')
|
|
} | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM ../release/cloud-relay-provenance.json
|
|
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: nekonest-cloud-relay-${{ github.run_id }}
|
|
path: |
|
|
release/nekonest-cloud-relay
|
|
release/cloud-relay-provenance.json
|
|
if-no-files-found: error
|
|
retention-days: 7
|