archvillainetteandClaude Opus 5
f3ca6be698
ci / ci (pull_request) Successful in 3m6s
Gitea has no release-asset retention, so every v* tag kept its full cross-platform binary set forever — 31 tags had accumulated 1.8 GB on the production host disk. Nothing consumes an old asset: CI takes the Crucible binary from the Nix flake, and every deleted file is reproducible from its tag. scripts/prune-release-assets.sh lists every release page, sorts by creation date, skips the newest two published releases, and deletes the remaining releases' attachments. Two rather than one so a release in flight never leaves the previous download broken. Drafts never consume a keep slot. Releases, tags, source archives and release notes are untouched. Nothing is excluded — SHA256SUMS and the wrappers go with the binaries: the checksums are only meaningful next to the files they cover, and the consumer drift-check reads the wrappers from the latest release, which stays complete. The step is best-effort: a stale asset is cheaper than a blocked publish, so API failures warn and the step carries continue-on-error. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
82 lines
3.2 KiB
YAML
82 lines
3.2 KiB
YAML
# Cross-platform Crucible release binaries: a v* tag builds all targets,
|
|
# then uploads them, SHA256SUMS, and the canonical wrappers to its Gitea release.
|
|
# Crucible is pure Go (CGO_ENABLED=0), so cross-compiling is a fast loop.
|
|
name: build-binaries
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
permissions:
|
|
code: read
|
|
releases: write
|
|
|
|
jobs:
|
|
build-binaries:
|
|
runs-on: nix-docker
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with: { fetch-depth: 0 }
|
|
|
|
- name: Cross-build all targets
|
|
run: |
|
|
nix develop --command bash -c '
|
|
set -euo pipefail
|
|
sha="$(git rev-parse --short=12 HEAD)"
|
|
ldflags="-s -w -X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${sha}"
|
|
rm -rf dist && mkdir -p dist
|
|
export CGO_ENABLED=0
|
|
for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
|
|
os="${target%/*}"; arch="${target#*/}"
|
|
ext=""; [ "$os" = windows ] && ext=".exe"
|
|
echo "building crucible-${os}-${arch}${ext}"
|
|
GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags "$ldflags" \
|
|
-o "dist/crucible-${os}-${arch}${ext}" ./cmd/crucible
|
|
done
|
|
# Ship the canonical wrappers as release assets too: consumer
|
|
# drift-check fetches them from the latest release to compare.
|
|
cp wrappers/crucible.sh wrappers/crucible.ps1 dist/
|
|
( cd dist && sha256sum crucible-* > SHA256SUMS )
|
|
cat dist/SHA256SUMS
|
|
'
|
|
|
|
- name: Upload to Gitea release
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
TAG: ${{ github.ref_name }}
|
|
REPO: ${{ github.repository }}
|
|
SERVER: ${{ github.server_url }}
|
|
run: |
|
|
nix develop --command bash -c '
|
|
set -euo pipefail
|
|
api="${SERVER}/api/v1/repos/${REPO}"
|
|
auth="Authorization: token ${TOKEN}"
|
|
# Create the release (ignore "already exists"), then read its id.
|
|
curl -fsS -X POST -H "$auth" -H "Content-Type: application/json" \
|
|
"${api}/releases" \
|
|
-d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\"}" || true
|
|
id="$(curl -fsS -H "$auth" "${api}/releases/tags/${TAG}" \
|
|
| grep -o "\"id\":[0-9]*" | head -1 | cut -d: -f2)"
|
|
for f in dist/*; do
|
|
echo "uploading $(basename "$f")"
|
|
curl -fsS -X POST -H "$auth" \
|
|
-F "attachment=@${f}" \
|
|
"${api}/releases/${id}/assets?name=$(basename "$f")"
|
|
done
|
|
'
|
|
|
|
# Gitea has no asset retention (#52): without this every tag keeps its
|
|
# ~57 MB binary set forever. Best-effort — a stale asset is cheaper than
|
|
# a blocked publish, so a failure here never fails the release.
|
|
- name: Prune assets of older releases
|
|
continue-on-error: true
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
SERVER: ${{ github.server_url }}
|
|
run: |
|
|
nix develop --command bash -c '
|
|
API="${SERVER}/api/v1/repos/${REPO}" scripts/prune-release-assets.sh
|
|
'
|