archvillainette
4d03085996
Closes #52. Adds `scripts/prune-release-assets.sh` and a best-effort step at the end of `build-binaries.yml`. - Lists every release page, sorts by creation date, skips the newest two published releases, deletes the rest's attachments via `DELETE /releases/{id}/assets/{asset_id}`. - Drafts never consume a keep slot, so a draft cannot strip the newest real release. - Releases, tags, source archives and release notes are never touched. - Nothing is excluded: SHA256SUMS and the wrappers go with the binaries. Checksums are only meaningful next to the files they cover, and the consumer drift-check reads the wrappers from the latest release, which stays complete. - Failures warn and the step has `continue-on-error: true` — a stale asset is cheaper than a blocked publish. `tests/prune-release-assets.sh` drives the script with a stub `curl`: keep window, out-of-order responses, drafts, no non-asset DELETE, short-page pagination stop, and both failure paths. Wired into `make check`. v0.2.0 still needs its 9 assets cleared by hand in the web UI, as the issue notes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #70 Co-authored-by: vickydotbat <vickydotbat@tutamail.com>
82 lines
3.2 KiB
YAML
82 lines
3.2 KiB
YAML
# Cross-platform Crucible release binaries: a v* tag builds all targets,
|
|
# then uploads them, SHA256SUMS, and the canonical wrappers to its Gitea release.
|
|
# Crucible is pure Go (CGO_ENABLED=0), so cross-compiling is a fast loop.
|
|
name: build-binaries
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
permissions:
|
|
code: read
|
|
releases: write
|
|
|
|
jobs:
|
|
build-binaries:
|
|
runs-on: nix-docker
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with: { fetch-depth: 0 }
|
|
|
|
- name: Cross-build all targets
|
|
run: |
|
|
nix develop --command bash -c '
|
|
set -euo pipefail
|
|
sha="$(git rev-parse --short=12 HEAD)"
|
|
ldflags="-s -w -X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${sha}"
|
|
rm -rf dist && mkdir -p dist
|
|
export CGO_ENABLED=0
|
|
for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
|
|
os="${target%/*}"; arch="${target#*/}"
|
|
ext=""; [ "$os" = windows ] && ext=".exe"
|
|
echo "building crucible-${os}-${arch}${ext}"
|
|
GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags "$ldflags" \
|
|
-o "dist/crucible-${os}-${arch}${ext}" ./cmd/crucible
|
|
done
|
|
# Ship the canonical wrappers as release assets too: consumer
|
|
# drift-check fetches them from the latest release to compare.
|
|
cp wrappers/crucible.sh wrappers/crucible.ps1 dist/
|
|
( cd dist && sha256sum crucible-* > SHA256SUMS )
|
|
cat dist/SHA256SUMS
|
|
'
|
|
|
|
- name: Upload to Gitea release
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
TAG: ${{ github.ref_name }}
|
|
REPO: ${{ github.repository }}
|
|
SERVER: ${{ github.server_url }}
|
|
run: |
|
|
nix develop --command bash -c '
|
|
set -euo pipefail
|
|
api="${SERVER}/api/v1/repos/${REPO}"
|
|
auth="Authorization: token ${TOKEN}"
|
|
# Create the release (ignore "already exists"), then read its id.
|
|
curl -fsS -X POST -H "$auth" -H "Content-Type: application/json" \
|
|
"${api}/releases" \
|
|
-d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\"}" || true
|
|
id="$(curl -fsS -H "$auth" "${api}/releases/tags/${TAG}" \
|
|
| grep -o "\"id\":[0-9]*" | head -1 | cut -d: -f2)"
|
|
for f in dist/*; do
|
|
echo "uploading $(basename "$f")"
|
|
curl -fsS -X POST -H "$auth" \
|
|
-F "attachment=@${f}" \
|
|
"${api}/releases/${id}/assets?name=$(basename "$f")"
|
|
done
|
|
'
|
|
|
|
# Gitea has no asset retention (#52): without this every tag keeps its
|
|
# ~57 MB binary set forever. Best-effort — a stale asset is cheaper than
|
|
# a blocked publish, so a failure here never fails the release.
|
|
- name: Prune assets of older releases
|
|
continue-on-error: true
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
SERVER: ${{ github.server_url }}
|
|
run: |
|
|
nix develop --command bash -c '
|
|
API="${SERVER}/api/v1/repos/${REPO}" scripts/prune-release-assets.sh
|
|
'
|