Merge pull request 'Add release machinery: version bump, nfpm RPM, release-on-tag' (#2) from benvin/release-machinery into main
Reviewed-on: #2
This commit was merged in pull request #2.
This commit is contained in:
@@ -0,0 +1,82 @@
|
|||||||
|
when:
|
||||||
|
- event: tag
|
||||||
|
ref: refs/tags/v*
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: test
|
||||||
|
image: golang:1.23
|
||||||
|
commands:
|
||||||
|
- go test ./...
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
|
|
||||||
|
- name: build
|
||||||
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
||||||
|
commands:
|
||||||
|
- make dist-build VERSION=${CI_COMMIT_TAG}
|
||||||
|
depends_on: [test]
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
|
|
||||||
|
- name: package
|
||||||
|
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
||||||
|
commands:
|
||||||
|
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
||||||
|
depends_on: [build]
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
|
|
||||||
|
- name: upload-rpm
|
||||||
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||||
|
commands:
|
||||||
|
- |
|
||||||
|
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
||||||
|
REPO="rpm-internal"
|
||||||
|
for rpm in dist/*.rpm; do
|
||||||
|
FILE=$$(basename "$$rpm")
|
||||||
|
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
||||||
|
if [ "$$code" = "200" ]; then
|
||||||
|
echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
|
||||||
|
curl -f -X PUT \
|
||||||
|
"$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
|
||||||
|
-H "Content-Type: application/x-rpm" \
|
||||||
|
--data-binary @"$$rpm"
|
||||||
|
done
|
||||||
|
depends_on: [package]
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 128Mi
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 500m
|
||||||
@@ -1,12 +1,17 @@
|
|||||||
BINARY := tomswall
|
BINARY := tomswall
|
||||||
MODULE := git.unkin.net/unkin/tomswall
|
MODULE := git.unkin.net/unkin/tomswall
|
||||||
PREFIX := /usr/local
|
PREFIX := /usr/local
|
||||||
CONFDIR := /etc/tomswall
|
CONFDIR := /etc/tomswall
|
||||||
|
DIST := dist
|
||||||
|
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
|
||||||
|
GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
|
||||||
|
OS ?= $(shell go env GOOS)
|
||||||
|
ARCH ?= $(shell go env GOARCH)
|
||||||
|
|
||||||
.PHONY: build install clean check test
|
.PHONY: build install clean check test fmt dist-build completions rpm rpm-package patch minor major _tag
|
||||||
|
|
||||||
build:
|
build:
|
||||||
go build -o $(BINARY) ./cmd/tomswall
|
go build $(GOFLAGS) -o $(BINARY) ./cmd/tomswall
|
||||||
|
|
||||||
install: build
|
install: build
|
||||||
install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
|
install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
|
||||||
@@ -17,9 +22,54 @@ install: build
|
|||||||
|
|
||||||
clean:
|
clean:
|
||||||
rm -f $(BINARY)
|
rm -f $(BINARY)
|
||||||
|
rm -rf $(DIST)
|
||||||
|
|
||||||
check:
|
check:
|
||||||
go vet ./...
|
go vet ./...
|
||||||
|
|
||||||
test:
|
test:
|
||||||
go test ./...
|
go test ./...
|
||||||
|
|
||||||
|
fmt:
|
||||||
|
gofmt -w .
|
||||||
|
|
||||||
|
# Build the binary into dist/ for the RPM packaging step.
|
||||||
|
dist-build:
|
||||||
|
@mkdir -p $(DIST)
|
||||||
|
CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./cmd/tomswall
|
||||||
|
|
||||||
|
# Generate bash/zsh completions into dist/completions.
|
||||||
|
completions: dist-build
|
||||||
|
@mkdir -p $(DIST)/completions
|
||||||
|
$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
|
||||||
|
$(DIST)/$(BINARY) completion zsh > $(DIST)/completions/_$(BINARY)
|
||||||
|
|
||||||
|
# Build the binary then package it (with completions) into an RPM via nfpm.
|
||||||
|
rpm: dist-build rpm-package
|
||||||
|
|
||||||
|
# Package an already-built dist/ binary into an RPM (used by CI after build).
|
||||||
|
rpm-package:
|
||||||
|
./scripts/build-rpm.sh $(VERSION)
|
||||||
|
|
||||||
|
# Bump helpers — read the latest semver tag and create+push the next one, which
|
||||||
|
# triggers the release-on-tag pipeline. Starts from v0.0.0 when no tag exists.
|
||||||
|
_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
|
||||||
|
_BASE := $(if $(_LATEST),$(_LATEST),v0.0.0)
|
||||||
|
_MAJ := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
|
||||||
|
_MIN := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
|
||||||
|
_PAT := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
|
||||||
|
|
||||||
|
patch:
|
||||||
|
@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||||
|
|
||||||
|
minor:
|
||||||
|
@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||||
|
|
||||||
|
major:
|
||||||
|
@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||||
|
|
||||||
|
_tag:
|
||||||
|
git push origin $(TAG)
|
||||||
|
|||||||
@@ -0,0 +1,58 @@
|
|||||||
|
---
|
||||||
|
# nfpm config for building the tomswall RPM.
|
||||||
|
# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
|
||||||
|
|
||||||
|
name: ${PACKAGE_NAME}
|
||||||
|
version: ${PACKAGE_VERSION}
|
||||||
|
release: ${PACKAGE_RELEASE}
|
||||||
|
arch: ${PACKAGE_ARCH}
|
||||||
|
platform: ${PACKAGE_PLATFORM}
|
||||||
|
section: default
|
||||||
|
priority: extra
|
||||||
|
description: "${PACKAGE_DESCRIPTION}"
|
||||||
|
|
||||||
|
maintainer: ${PACKAGE_MAINTAINER}
|
||||||
|
homepage: ${PACKAGE_HOMEPAGE}
|
||||||
|
license: ${PACKAGE_LICENSE}
|
||||||
|
|
||||||
|
disable_globbing: false
|
||||||
|
|
||||||
|
replaces:
|
||||||
|
- tomswall
|
||||||
|
provides:
|
||||||
|
- tomswall
|
||||||
|
|
||||||
|
contents:
|
||||||
|
- src: dist/tomswall
|
||||||
|
dst: /usr/sbin/tomswall
|
||||||
|
file_info:
|
||||||
|
mode: 0755
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
|
||||||
|
# Example configuration (never overwrites an existing tomswall.yaml).
|
||||||
|
- src: tomswall.example.yaml
|
||||||
|
dst: /etc/tomswall/tomswall.example.yaml
|
||||||
|
file_info:
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
# systemd unit + environment file for the control-plane agent.
|
||||||
|
- src: packaging/tomswall-agent.service
|
||||||
|
dst: /usr/lib/systemd/system/tomswall-agent.service
|
||||||
|
file_info:
|
||||||
|
mode: 0644
|
||||||
|
- src: packaging/tomswall-agent.env
|
||||||
|
dst: /etc/tomswall/agent.env
|
||||||
|
type: config|noreplace
|
||||||
|
file_info:
|
||||||
|
mode: 0640
|
||||||
|
|
||||||
|
# Shell completions (generated by scripts/build-rpm.sh before packaging).
|
||||||
|
- src: dist/completions/tomswall.bash
|
||||||
|
dst: /usr/share/bash-completion/completions/tomswall
|
||||||
|
file_info:
|
||||||
|
mode: 0644
|
||||||
|
- src: dist/completions/_tomswall
|
||||||
|
dst: /usr/share/zsh/site-functions/_tomswall
|
||||||
|
file_info:
|
||||||
|
mode: 0644
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
# Environment for the tomswall control-plane agent (tomswall-agent.service).
|
||||||
|
# The agent reads these; flags may also be passed via ExecStart.
|
||||||
|
|
||||||
|
# Base URL of the tomswallapi control plane.
|
||||||
|
TOMSWALL_API_URL=https://tomswallapi.k8s.syd1.au.unkin.net
|
||||||
|
|
||||||
|
# Agent bearer token (issued by the control plane / Vault). Keep this file 0640.
|
||||||
|
TOMSWALL_AGENT_TOKEN=
|
||||||
|
|
||||||
|
# The device name defaults to the system hostname. To override it, add
|
||||||
|
# `--device <name>` to ExecStart in the unit (drop-in), e.g.:
|
||||||
|
# ExecStart=/usr/sbin/tomswall agent --device fw-a
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=tomswall control-plane agent (pull and apply firewall config)
|
||||||
|
Documentation=https://git.unkin.net/unkin/tomswall
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
EnvironmentFile=/etc/tomswall/agent.env
|
||||||
|
ExecStart=/usr/sbin/tomswall agent
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=10
|
||||||
|
# The agent programs nftables and needs the requisite capabilities.
|
||||||
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
||||||
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
Executable
+43
@@ -0,0 +1,43 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# Package the (already built) tomswall binary into an RPM with nfpm, bundling
|
||||||
|
# generated bash/zsh shell completions and the systemd agent unit.
|
||||||
|
# Usage: scripts/build-rpm.sh [version] (version defaults to $CI_COMMIT_TAG)
|
||||||
|
#
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
cd "${ROOT_DIR}"
|
||||||
|
|
||||||
|
VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
|
||||||
|
VERSION="${VERSION#v}" # strip a leading v
|
||||||
|
BINARY="tomswall"
|
||||||
|
DIST="dist"
|
||||||
|
|
||||||
|
if [ ! -f "${DIST}/${BINARY}" ]; then
|
||||||
|
echo "ERROR: ${DIST}/${BINARY} not found; run 'make dist-build' first" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Generate shell completions from the freshly built binary so they always match
|
||||||
|
# the shipped flags/subcommands.
|
||||||
|
COMP_DIR="${DIST}/completions"
|
||||||
|
mkdir -p "${COMP_DIR}"
|
||||||
|
"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
|
||||||
|
"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
|
||||||
|
|
||||||
|
export PACKAGE_NAME="${BINARY}"
|
||||||
|
export PACKAGE_VERSION="${VERSION}"
|
||||||
|
export PACKAGE_RELEASE="1"
|
||||||
|
export PACKAGE_ARCH="amd64"
|
||||||
|
export PACKAGE_PLATFORM="linux"
|
||||||
|
export PACKAGE_DESCRIPTION="Spiritual successor to shorewall — nftables firewall manager, with a control-plane agent that pulls compiled config from tomswallapi"
|
||||||
|
export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
|
||||||
|
export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/tomswall"
|
||||||
|
export PACKAGE_LICENSE="MIT"
|
||||||
|
|
||||||
|
envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
|
||||||
|
nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
|
||||||
|
|
||||||
|
echo "Built:"
|
||||||
|
ls -1 "${DIST}"/*.rpm
|
||||||
Reference in New Issue
Block a user