1Helm/.github/workflows/release-linux-build.yml at main · gitcommit90/1Helm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
name: Release 2 - Linux build

on:
  workflow_dispatch:
    inputs:
      source_ref:
        description: Exact product commit previously admitted to main
        required: true
        type: string
      ci_run_id:
        description: Successful Source CI run ID for this commit
        required: true
        type: string

permissions:
  actions: read
  contents: read

concurrency:
  group: release-linux-${{ inputs.source_ref }}
  cancel-in-progress: false

env:
  PUPPETEER_SKIP_DOWNLOAD: "1"

jobs:
  build:
    name: Build and retain exact Linux package
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ inputs.source_ref }}
          fetch-depth: 0
          persist-credentials: false
      - id: identity
        shell: bash
        run: |
          set -euo pipefail
          commit="$(git rev-parse HEAD)"; version="$(node -p 'require("./package.json").version')"
          [[ "${{ inputs.source_ref }}" =~ ^[a-f0-9]{40}$ ]]
          test "$commit" = "${{ inputs.source_ref }}"
          git fetch origin main --no-tags
          git merge-base --is-ancestor "$commit" origin/main
          echo "commit=$commit" >> "$GITHUB_OUTPUT"; echo "version=$version" >> "$GITHUB_OUTPUT"
      - name: Download successful CI proof
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: source-ci-${{ steps.identity.outputs.commit }}
          path: dist/source-ci
          run-id: ${{ inputs.ci_run_id }}
          github-token: ${{ github.token }}
      - name: Verify CI proof
        run: node scripts/release-stage-evidence.mjs verify dist/source-ci/source-ci-evidence.json source-ci "${{ steps.identity.outputs.version }}" "${{ steps.identity.outputs.commit }}" dist/source-ci
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "22"
          cache: npm
      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y podman
          npm ci
      - name: Build sealed channel image and Linux archive
        run: |
          npm run package:channel-image
          npm run package:linux
          (cd dist && sha256sum -c "1Helm-${{ steps.identity.outputs.version }}-linux-node.tgz.sha256")
      - name: Record immutable build evidence
        run: |
          node scripts/release-stage-evidence.mjs create linux-build "${{ steps.identity.outputs.version }}" "${{ steps.identity.outputs.commit }}" \
            dist/linux-build-evidence.json \
            "dist/1Helm-${{ steps.identity.outputs.version }}-linux-node.tgz" \
            "dist/1Helm-${{ steps.identity.outputs.version }}-linux-node.tgz.sha256"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: linux-build-${{ steps.identity.outputs.commit }}
          path: |
            dist/1Helm-${{ steps.identity.outputs.version }}-linux-node.tgz
            dist/1Helm-${{ steps.identity.outputs.version }}-linux-node.tgz.sha256
            dist/linux-build-evidence.json
          if-no-files-found: error
          retention-days: 90