Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt, and fuse-overlayfs to verified upstream source checksums; SlackBuild recipes, scripts/build-packages.sh, checksums.sh, release.sh, and update-versions.sh implement the reproducible pipeline; GitHub Actions workflows build in a Slackware container and publish releases without committing any binaries. - plugin/podman.plg installs/updates/removes all eight packages (the seven components plus the plugin's own unraid-podman scaffolding package) via upgradepkg, using the official Unraid array-event hook mechanism (event/disks_mounted, event/stopping) instead of editing /boot/config/go. rc.podman and the sbin/ helper scripts implement storage creation, config seeding/sync, preflight checks, autostart with per-container Safe-Mode, and package verify/update/rollback. - webui/plugins/podman implements the Dashboard, Containers, Pods, Images, Volumes, Networks, Logs, Terminal, Compose, and Settings panels against the approved mockup (webui/mockups/prototype.html), talking to podman system service exclusively via PodmanClient.php (libpod REST API over the Unix socket), with two documented exceptions: Terminal's one-shot exec model and Compose's use of the podman compose CLI, since libpod has no REST equivalent for either. - docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions and honest current status (syntax-checked, unit- and integration-tested against fake sockets/servers; not yet run against a real Unraid/Podman/Slackware system). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-11 10:51:14 +00:00
parent 58ffc0c226
commit e2fefcdf9c
124 changed files with 9611 additions and 0 deletions
@@ -0,0 +1,96 @@
+name: Release
+
+# Publishes a GitHub Release for a version tag (vX.Y.Z).
+#
+# By design, this workflow does NOT bump versions or modify podman.plg
+# itself — that happens locally via `scripts/release.sh <version>`, which a
+# maintainer reviews, commits, and tags *before* pushing the tag (see that
+# script's own printed instructions). This workflow's only job is to:
+#   1. Rebuild all packages from the tagged commit in a clean Slackware
+#      container (reproducibility check + provenance — we don't trust
+#      whatever a maintainer happened to have in their local dist/).
+#   2. Verify checksums match what's already committed in plugin/podman.plg
+#      at this tag (catches a release.sh run that wasn't followed by a
+#      matching commit — see the "Verify plg matches build" step).
+#   3. Create the GitHub Release and attach the .txz packages, checksum
+#      manifests, and podman.plg.
+#
+# See docs/ARCHITECTURE.md section 13 (Updates).
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build release packages
+    uses: ./.github/workflows/build-packages.yml
+
+  publish:
+    name: Publish GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download built packages
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build.outputs.artifact-name }}
+          path: dist
+
+      - name: Re-verify checksums
+        run: scripts/checksums.sh dist
+
+      - name: Verify plugin/podman.plg matches these artifacts
+        # scripts/release.sh should already have been run locally, and its
+        # resulting podman.plg changes committed as part of this tag, before
+        # the tag was pushed. This step fails the release loudly if that
+        # didn't happen, instead of publishing a release whose plg points at
+        # MD5s that don't match the .txz files actually attached below.
+        run: |
+          set -eu
+          for f in dist/*.txz.md5; do
+            expected_md5=$(awk '{print $1}' "$f")
+            txz_name=$(basename "${f%.md5}")
+            if ! grep -qF "$expected_md5" plugin/podman.plg; then
+              echo "!! $txz_name's checksum ($expected_md5) is not referenced in plugin/podman.plg." >&2
+              echo "!! Did you forget to run scripts/release.sh and commit its changes before tagging?" >&2
+              exit 1
+            fi
+          done
+          echo "All package checksums are referenced in plugin/podman.plg — OK."
+
+      - name: Extract version from tag
+        id: version
+        run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Extract changelog section for this version
+        id: changelog
+        run: |
+          awk -v ver="${{ steps.version.outputs.value }}" '
+            $0 ~ "^## \\[" ver "\\]" { found=1; print; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md > /tmp/release-notes.md
+          echo "path=/tmp/release-notes.md" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: "unraid-podman v${{ steps.version.outputs.value }}"
+          body_path: ${{ steps.changelog.outputs.path }}
+          # v0.x tags are treated as pre-releases until the plugin reaches a
+          # first stable 1.0.0 — see docs/ROADMAP.md.
+          prerelease: ${{ startsWith(steps.version.outputs.value, '0.') }}
+          files: |
+            dist/*.txz
+            dist/*.sha256
+            dist/*.md5
+            dist/CHECKSUMS.sha256
+            dist/CHECKSUMS.md5
+            plugin/podman.plg