Support Cloudflare API token for server cert initialization (#563) #44
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: goreleaser | |
| on: | |
| push: | |
| tags: | |
| - "*" | |
| permissions: | |
| contents: write | |
| jobs: | |
| goreleaser: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '>=1.23.0' | |
| - run: go version | |
| - run: make release-github | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Build a GLIBC 2.28-compatible RPM for RHEL 8 / EL8 customers. | |
| # The main goreleaser job builds inside goreleaser-cross (Ubuntu 24.04, | |
| # GLIBC 2.39) which produces binaries incompatible with RHEL 8. | |
| # This job compiles inside Rocky Linux 8 (GLIBC 2.28) to guarantee | |
| # compatibility. See: SECENG-13556, ESCALATION-2261 | |
| build-el8-rpm: | |
| runs-on: ubuntu-latest | |
| needs: goreleaser # release must exist before we can upload assets | |
| container: | |
| image: rockylinux:8 | |
| steps: | |
| - name: Install system dependencies | |
| run: | | |
| dnf install -y gcc make libtool-ltdl-devel git findutils | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fix git ownership | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Install Go 1.24.1 | |
| run: | | |
| curl -sL https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go.tar.gz | |
| tar -C /usr/local -xzf /tmp/go.tar.gz | |
| rm /tmp/go.tar.gz | |
| # Make Go available for subsequent steps | |
| ln -s /usr/local/go/bin/go /usr/local/bin/go | |
| ln -s /usr/local/go/bin/gofmt /usr/local/bin/gofmt | |
| go version | |
| - name: Build gokeyless binary | |
| run: make build/usr/bin/gokeyless | |
| - name: Verify GLIBC compatibility | |
| run: | | |
| # Ensure the binary does not require GLIBC newer than 2.28 | |
| objdump -T build/usr/bin/gokeyless | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1 | |
| MAX_GLIBC=$(objdump -T build/usr/bin/gokeyless | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1) | |
| echo "Maximum GLIBC version required: $MAX_GLIBC" | |
| # Extract version number and compare | |
| MAX_VER=$(echo "$MAX_GLIBC" | grep -oP '\d+\.\d+') | |
| if [ "$(printf '%s\n' "2.28" "$MAX_VER" | sort -V | tail -1)" != "2.28" ]; then | |
| echo "ERROR: Binary requires $MAX_GLIBC which is newer than GLIBC 2.28 (RHEL 8)" | |
| exit 1 | |
| fi | |
| echo "OK: Binary is compatible with RHEL 8 (GLIBC 2.28)" | |
| - name: Install nfpm | |
| run: | | |
| curl -sL https://github.com/goreleaser/nfpm/releases/download/v2.46.3/nfpm_2.46.3_Linux_x86_64.tar.gz -o /tmp/nfpm.tar.gz | |
| tar -C /usr/local/bin -xzf /tmp/nfpm.tar.gz nfpm | |
| rm /tmp/nfpm.tar.gz | |
| - name: Determine version | |
| id: version | |
| run: | | |
| # Strip leading 'v' from the tag to get the version number | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Build el8 RPM | |
| run: | | |
| nfpm package \ | |
| --config nfpm-el8.yml \ | |
| --packager rpm \ | |
| --target "gokeyless-${VERSION}-1.el8.x86_64.rpm" | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| - name: Upload RPM to GitHub release | |
| run: | | |
| # Install gh CLI | |
| dnf install -y 'dnf-command(config-manager)' | |
| dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo | |
| dnf install -y gh | |
| # Upload the el8 RPM as a release asset | |
| gh release upload "$GITHUB_REF_NAME" gokeyless-*.el8.x86_64.rpm --clobber | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| build-and-push-image: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| strategy: | |
| matrix: | |
| include: | |
| # github container registry | |
| - registry: "ghcr.io" | |
| username: ${{ github.actor }} | |
| password_secret: GITHUB_TOKEN | |
| image: ghcr.io/cloudflare/gokeyless | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '>=1.23.0' | |
| - run: go version | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to the Docker hub | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ matrix.registry }} | |
| username: ${{ matrix.username }} | |
| password: ${{ secrets[matrix.password_secret] }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ matrix.image }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} |