From 567f0c4e4b1fa8dd820226dacc1152bae66ad61d Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Tue, 15 Sep 2026 17:40:33 +0000 Subject: [PATCH] feat(ci): Replace S3 upload with a rolling nightly pre-release Instead of pushing the urunc binaries to the nubificus S3, use a pre-release in GitHUb which will store all the binaries built in the main branch. Signed-off-by: Charalampos Mainas --- .github/workflows/ci_main.yml | 29 +++---- .github/workflows/rolling_release.yml | 84 +++++++++++++++++++++ .github/workflows/upload_s3.yml | 105 -------------------------- docs/installation.md | 10 ++- 4 files changed, 106 insertions(+), 122 deletions(-) create mode 100644 .github/workflows/rolling_release.yml delete mode 100644 .github/workflows/upload_s3.yml diff --git a/.github/workflows/ci_main.yml b/.github/workflows/ci_main.yml index 61d81dd..7805201 100644 --- a/.github/workflows/ci_main.yml +++ b/.github/workflows/ci_main.yml @@ -1,13 +1,8 @@ -name: Build & Upload +name: Build and push binaries for rolling release on: push: branches: ["main"] - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true permissions: contents: read @@ -19,18 +14,26 @@ permissions: jobs: build: name: Build + # A newer push supersedes an in-flight build of the same ref. + concurrency: + group: ${{ github.workflow }}-build-${{ github.ref }} + cancel-in-progress: true uses: ./.github/workflows/build.yml with: ref: ${{ github.sha }} go_version: "1.26.4" - upload: - name: Upload + release: + name: Rolling release needs: build - uses: ./.github/workflows/upload_s3.yml + # Publishing is not atomic (tag move + asset delete/re-upload), so never + # cancel a publish in progress; queue the next one behind it instead. + concurrency: + group: ${{ github.workflow }}-release + cancel-in-progress: false + permissions: + contents: write + uses: ./.github/workflows/rolling_release.yml with: ref: ${{ github.sha }} - secrets: - AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - + tag: nightly diff --git a/.github/workflows/rolling_release.yml b/.github/workflows/rolling_release.yml new file mode 100644 index 0000000..73a91fb --- /dev/null +++ b/.github/workflows/rolling_release.yml @@ -0,0 +1,84 @@ +name: Rolling release + +on: + workflow_call: + inputs: + ref: + description: 'Commit SHA the binaries were built from' + required: true + type: string + tag: + description: 'Rolling release tag to (re)point at the commit' + required: true + type: string + +jobs: + publish: + name: Publish ${{ inputs.tag }} pre-release + runs-on: ubuntu-22.04 + permissions: + contents: write + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + egress-policy: audit + + # A re-run of an old run keeps its original github.sha, and a slow build can + # finish after a newer push has already published. Either would rewind the + # rolling release, so only the current tip of the branch may publish. + - name: Check that ${{ inputs.ref }} is still the tip of ${{ github.ref_name }} + id: tip + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + BRANCH: ${{ github.ref_name }} + SHA: ${{ inputs.ref }} + run: | + tip=$(gh api "repos/${REPO}/git/ref/heads/${BRANCH}" --jq .object.sha) + if [ "${tip}" = "${SHA}" ]; then + echo "current=true" >> "$GITHUB_OUTPUT" + else + echo "::notice::${BRANCH} has moved on to ${tip}; not publishing ${SHA}. The run for ${tip} publishes it." + echo "current=false" >> "$GITHUB_OUTPUT" + fi + + - name: Download build artifacts + if: steps.tip.outputs.current == 'true' + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: '*_static_*-${{ github.run_id }}' + path: dist + merge-multiple: true + + - name: Publish pre-release + if: steps.tip.outputs.current == 'true' + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + with: + tag_name: ${{ inputs.tag }} + target_commitish: ${{ inputs.ref }} + name: ${{ inputs.tag }} (${{ github.ref_name }} @ ${{ inputs.ref }}) + body: | + Rolling build of `${{ github.ref_name }}` at commit ${{ inputs.ref }}. + + prerelease: true + make_latest: false + draft: false + generate_release_notes: false + overwrite_files: true + preserve_order: true + fail_on_unmatched_files: true + files: | + dist/*_static_* + + - name: Move ${{ inputs.tag }} tag to ${{ inputs.ref }} + if: steps.tip.outputs.current == 'true' + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + TAG: ${{ inputs.tag }} + SHA: ${{ inputs.ref }} + run: | + gh api --method PATCH "repos/${REPO}/git/refs/tags/${TAG}" \ + -f sha="${SHA}" -F force=true diff --git a/.github/workflows/upload_s3.yml b/.github/workflows/upload_s3.yml deleted file mode 100644 index b5ef1cd..0000000 --- a/.github/workflows/upload_s3.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: Upload to S3 - -on: - workflow_call: - inputs: - ref: - required: true - type: string - default: '' - secrets: - AWS_ACCESS_KEY: - required: true - AWS_SECRET_ACCESS_KEY: - required: true - - - workflow_dispatch: - inputs: - ref: - required: true - type: string - default: '' - -permissions: - contents: read - -jobs: - build: - runs-on: ${{ matrix.runner }} - strategy: - matrix: - include: - - arch: amd64 - runner: ubuntu-22.04 - - arch: arm64 - runner: ubuntu-22.04-arm - continue-on-error: true - - steps: - - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 - with: - egress-policy: audit - - - name: Get revision SHA and branch (safe) - id: get-rev - env: - EVENT_NAME: ${{ github.event_name }} - IS_MERGED: ${{ github.event.pull_request.merged }} - GITHUB_SHA: ${{ github.sha }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - REF_NAME: ${{ github.ref_name }} - run: | - if [ "$EVENT_NAME" == "pull_request" ]; then - if [ "$IS_MERGED" == "true" ]; then - sha="$GITHUB_SHA" - branch="$PR_BASE_REF" - echo "PR merged. SHA: ${sha}, Branch: ${branch}" - else - sha="$PR_HEAD_SHA" - branch="$PR_HEAD_REF" - echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}" - fi - else - sha="$GITHUB_SHA" - branch="$REF_NAME" - echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}" - fi - - echo "sha=${sha}" >> "$GITHUB_ENV" - echo "branch=${branch}" >> "$GITHUB_ENV" - - - name: Download urunc artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: urunc_static_${{ matrix.arch }}-${{ github.run_id }} - path: ./ - - - name: Download containerd-shim-urunc-v2 artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: containerd-shim-urunc-v2_static_${{ matrix.arch }}-${{ github.run_id }} - path: ./ - - - name: Upload urunc to S3 - uses: cloudkernels/minio-upload@fce268686576f31a8ad0cdecedba954b58e87aee - with: - url: https://s3.nbfc.io - access-key: ${{ secrets.AWS_ACCESS_KEY }} - secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - local-path: urunc_static_${{ matrix.arch }} - remote-path: nbfc-assets/github/urunc/dist/${{ env.branch }}/${{ matrix.arch }}/ - policy: 1 - - - name: Upload containerd-shim-urunc-v2 to S3 - uses: cloudkernels/minio-upload@fce268686576f31a8ad0cdecedba954b58e87aee - with: - url: https://s3.nbfc.io - access-key: ${{ secrets.AWS_ACCESS_KEY }} - secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - local-path: containerd-shim-urunc-v2_static_${{ matrix.arch }} - remote-path: nbfc-assets/github/urunc/dist/${{ env.branch }}/${{ matrix.arch }}/ - policy: 1 diff --git a/docs/installation.md b/docs/installation.md index f0bd9ec..dbf0b73 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -527,12 +527,14 @@ sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2 #### Option 3: Install from latest artifacts (tip of the main branch) -Alternatively, to get a `urunc` binary based on the main branch: +Alternatively, to get a `urunc` binary based on the main branch, use the +rolling [`nightly`](https://github.com/urunc-dev/urunc/releases/tag/nightly) +pre-release. ```bash -URUNC_VERSION=main +URUNC_VERSION=nightly URUNC_BINARY_FILENAME="urunc_static_$(dpkg --print-architecture)" -wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$URUNC_BINARY_FILENAME +wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$URUNC_BINARY_FILENAME chmod +x $URUNC_BINARY_FILENAME sudo mv $URUNC_BINARY_FILENAME /usr/local/bin/urunc ``` @@ -541,7 +543,7 @@ And for `containerd-shim-urunc-v2`: ```bash CONTAINERD_BINARY_FILENAME="containerd-shim-urunc-v2_static_$(dpkg --print-architecture)" -wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$CONTAINERD_BINARY_FILENAME +wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$CONTAINERD_BINARY_FILENAME chmod +x $CONTAINERD_BINARY_FILENAME sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2 ```