maggesandClaude Sonnet 5
6cd541de23
All 8 packages built and verified successfully in task 96 — the only remaining failure was the very last step: actions/upload-artifact@v4 errored with GHESNotSupportedError. Gitea Actions' built-in artifact storage doesn't implement the newer v2 upload/download API that upload-artifact@v4/download-artifact@v4 require. Downgraded both (they must match — v3 and v4 artifacts aren't cross-compatible) to v3, which uses the older protocol Gitea does support. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
165 lines
7.3 KiB
YAML
165 lines
7.3 KiB
YAML
name: Build Packages
|
|
|
|
# Builds the seven Slackware .txz packages defined under packages/
|
|
# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
|
|
# inside a Slackware container, verifies + consolidates their checksums, and
|
|
# uploads the result as a workflow artifact.
|
|
#
|
|
# Intentionally does NOT commit any built binary back to the repository —
|
|
# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
|
|
# only ever leave this workflow via the "Upload build artifacts" step below
|
|
# (retained by GitHub Actions, not the repo) or, for tagged releases, via
|
|
# release.yml attaching them to a GitHub Release.
|
|
#
|
|
# See docs/ARCHITECTURE.md section 5 (Paketmanagement).
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "packages/**"
|
|
- "versions.env"
|
|
- "scripts/**"
|
|
- ".github/workflows/build-packages.yml"
|
|
pull_request:
|
|
paths:
|
|
- "packages/**"
|
|
- "versions.env"
|
|
- "scripts/**"
|
|
- ".github/workflows/build-packages.yml"
|
|
workflow_dispatch:
|
|
inputs:
|
|
packages:
|
|
description: >
|
|
Space-separated package names to build (default: all seven).
|
|
Example: "podman conmon"
|
|
required: false
|
|
default: ""
|
|
workflow_call:
|
|
outputs:
|
|
artifact-name:
|
|
description: "Name of the uploaded dist/ artifact"
|
|
value: ${{ jobs.build.outputs.artifact-name }}
|
|
|
|
# Pin the Slackware build image by tag here. vbatts/slackware is a
|
|
# long-standing, widely used Slackware Docker image; swap this (and ideally
|
|
# pin by digest) if the project standardizes on a different/self-hosted
|
|
# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
|
|
# build dependencies are bootstrapped on top of whatever this image ships.
|
|
#
|
|
# vbatts/slackware:15.0 ships tar but NOT git (needed by actions/checkout),
|
|
# nor any of the shared libraries git's HTTPS transport needs. The
|
|
# "Install git" step below uses slackpkg (already present and pre-
|
|
# configured with a mirror in this image) rather than hand-picking package
|
|
# files: git's HTTPS support pulls in nghttp2/brotli/cyrus-sasl, and
|
|
# hand-pinning those separately from the base 15.0 release directory (as
|
|
# an earlier version of this step did) silently drifted out of sync with
|
|
# the newer, patched curl that scripts/ci/setup-slackware-buildenv.sh
|
|
# installs later in the same container — same library, two different
|
|
# builds, resulting in a symbol lookup error at runtime. Letting slackpkg
|
|
# resolve everything from the same prioritized repo set (patches over
|
|
# main, see /etc/slackpkg/slackpkg.conf's PRIORITY) keeps every package on
|
|
# this image on a mutually consistent version set.
|
|
#
|
|
# actions/checkout and actions/upload-artifact are both Node-based actions
|
|
# — Gitea Actions execs their JS bundle with the "node" binary found
|
|
# inside the job's own container, it does not inject a runtime of its
|
|
# own. Slackware has no nodejs package at all (checked: not in any of the
|
|
# main/extra/pasture/testing repos), so the "Install git" step also
|
|
# installs a pinned, checksum-verified Node.js release directly from
|
|
# nodejs.org — the same style already used for Go/Rust in
|
|
# scripts/ci/setup-slackware-buildenv.sh.
|
|
#
|
|
# upload-artifact is pinned to v3, not v4 — Gitea Actions' built-in
|
|
# artifact storage does not implement the newer v2 upload/download API
|
|
# that actions/upload-artifact@v4 and actions/download-artifact@v4
|
|
# require; uploading fails outright with "GHESNotSupportedError". v3 uses
|
|
# the older, still-supported protocol. release.yml's download-artifact
|
|
# must stay on the matching v3 — the two protocols aren't compatible with
|
|
# each other.
|
|
env:
|
|
SLACKWARE_IMAGE: "vbatts/slackware:15.0"
|
|
NODE_VERSION: "20.20.2"
|
|
NODE_SHA256: "df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d"
|
|
|
|
jobs:
|
|
build:
|
|
name: Build .txz packages
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: ${{ env.SLACKWARE_IMAGE }}
|
|
outputs:
|
|
artifact-name: ${{ steps.artifact-name.outputs.value }}
|
|
steps:
|
|
- name: Install git and Node.js (needed before actions/checkout can run)
|
|
run: |
|
|
set -eu
|
|
command -v tar > /dev/null || (echo "!! base image is missing tar — see SLACKWARE_IMAGE in this workflow" && exit 1)
|
|
|
|
# CHECKGPG is turned off: slackpkg's default GPG-key bootstrap
|
|
# fetches Slackware's signing key from www.slackware.com, which
|
|
# is not reachable from every CI network (observed to hang on
|
|
# this project's self-hosted Gitea Actions runner). CHECKMD5
|
|
# (on by default) still verifies every package against the
|
|
# mirror's own CHECKSUMS.md5 as a transit-integrity check.
|
|
sed -i 's/^CHECKGPG=on/CHECKGPG=off/' /etc/slackpkg/slackpkg.conf
|
|
slackpkg -batch=on -default_answer=y update
|
|
# git and curl's HTTPS transport need nghttp2/brotli/cyrus-sasl at
|
|
# runtime, but slackpkg does not resolve shared-library
|
|
# dependencies (Slackware packages carry no such metadata) — list
|
|
# them explicitly so they come from the same slackpkg pass (and
|
|
# therefore the same mutually-consistent build) as git itself.
|
|
slackpkg -batch=on -default_answer=y install \
|
|
git ca-certificates nghttp2 brotli cyrus-sasl
|
|
|
|
# ca-certificates ships individual certs under
|
|
# /usr/share/ca-certificates/ — this builds the combined bundle
|
|
# git (and later, curl) need to actually trust HTTPS remotes.
|
|
update-ca-certificates
|
|
echo "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"
|
|
echo "CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"
|
|
|
|
git --version
|
|
|
|
# curl isn't installed until scripts/ci/setup-slackware-buildenv.sh
|
|
# runs, later — use wget (present in the base image) here instead.
|
|
# wget does not consult the system CA bundle on its own (unlike
|
|
# curl/git, which respect CURL_CA_BUNDLE/GIT_SSL_CAINFO), so pass
|
|
# it explicitly via --ca-certificate.
|
|
node_tarball="node-v${NODE_VERSION}-linux-x64.tar.xz"
|
|
wget -q --tries=3 --ca-certificate=/etc/ssl/certs/ca-certificates.crt \
|
|
-O "/tmp/$node_tarball" "https://nodejs.org/dist/v${NODE_VERSION}/$node_tarball"
|
|
echo "${NODE_SHA256} /tmp/$node_tarball" | sha256sum -c -
|
|
mkdir -p /usr/local/lib/nodejs
|
|
tar -xf "/tmp/$node_tarball" -C /usr/local/lib/nodejs
|
|
echo "/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin" >> "$GITHUB_PATH"
|
|
"/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin/node" --version
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Slackware build environment
|
|
run: scripts/ci/setup-slackware-buildenv.sh
|
|
|
|
- name: Build packages
|
|
run: scripts/build-packages.sh ${{ github.event.inputs.packages }}
|
|
|
|
- name: Verify and consolidate checksums
|
|
run: scripts/checksums.sh
|
|
|
|
- name: Compute artifact name
|
|
id: artifact-name
|
|
run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Upload build artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ${{ steps.artifact-name.outputs.value }}
|
|
path: |
|
|
dist/*.txz
|
|
dist/*.sha256
|
|
dist/*.md5
|
|
dist/CHECKSUMS.sha256
|
|
dist/CHECKSUMS.md5
|
|
if-no-files-found: error
|
|
retention-days: 14
|