|
| 1 | +# Separated from 01-make-dist.yml to touch untrusted sources |
| 2 | +# in a separate job without particular permissions to anything. |
| 3 | +# Triggered by a step in that job. |
| 4 | +# |
| 5 | +# See also: |
| 6 | +# https://github.com/actions/upload-artifact |
| 7 | +# https://docs.github.com/en/actions/reference/workflows-and-actions/variables |
| 8 | +# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax |
| 9 | + |
| 10 | +name: "GHA-01: Tarballs Build Worker" |
| 11 | + |
| 12 | +on: |
| 13 | + workflow_call: |
| 14 | + inputs: |
| 15 | + ref: |
| 16 | + required: true |
| 17 | + type: string |
| 18 | + artifact_name: |
| 19 | + required: true |
| 20 | + type: string |
| 21 | + workflow_dispatch: |
| 22 | + inputs: |
| 23 | + ref: |
| 24 | + required: true |
| 25 | + type: string |
| 26 | + artifact_name: |
| 27 | + required: true |
| 28 | + type: string |
| 29 | + |
| 30 | +# This untrusted part of the job may only read Git |
| 31 | +# (and upload artifacts, that's allowed by default) |
| 32 | +permissions: |
| 33 | + contents: read |
| 34 | + |
| 35 | +jobs: |
| 36 | + make-dist-tarballs: |
| 37 | + name: "Make Dist and Docs Tarballs, see workflow page for links" |
| 38 | + # FIXME: Prepare/maintain a container image with pre-installed |
| 39 | + # NUT build/tooling prereqs (save about 3 minutes per run!) |
| 40 | + # Maybe https://aschmelyun.com/blog/using-docker-run-inside-of-github-actions/ |
| 41 | + # => https://github.com/addnab/docker-run-action can help |
| 42 | + runs-on: ubuntu-latest |
| 43 | + |
| 44 | + steps: |
| 45 | + - name: Checkout repository |
| 46 | + uses: actions/checkout@v7 |
| 47 | + with: |
| 48 | + # NOTE: This is the unprivileged part of the GHA-01-tarballs ritual, |
| 49 | + # running potentially untrusted shell code from the PR source branch. |
| 50 | + # We are still dealing with the upstream repository (not a forked |
| 51 | + # repo), and in case of pull requests - fetch a separate scheme of |
| 52 | + # ephemerally provided refs for PR "merge" or "head" commits. |
| 53 | + # |
| 54 | + # 0 => all commit history for the PR |
| 55 | + fetch-depth: 0 |
| 56 | + # Get the git tags to construct NUT SEMVER version strings. |
| 57 | + fetch-tags: true |
| 58 | + ref: ${{ inputs.ref }} |
| 59 | + persist-credentials: false |
| 60 | + |
| 61 | + # Make build identification more useful (so we use no fallbacks in script) |
| 62 | + - name: Try to get more Git metadata |
| 63 | + run: | |
| 64 | + git describe || { |
| 65 | + git remote -v || true |
| 66 | + git branch -a || true |
| 67 | + for R in `git remote` ; do git fetch $R master ; done || true |
| 68 | + git fetch --tags |
| 69 | + pwd ; ls -la |
| 70 | + echo "=== Known commits in history:" |
| 71 | + git log --oneline | wc -l |
| 72 | + echo "=== Recent commits in history:" |
| 73 | + git log -2 || true |
| 74 | + echo "=== Known tags:" |
| 75 | + git tag || true |
| 76 | + echo "=== Try to ensure 'git describe' works:" |
| 77 | + git describe || { |
| 78 | + git fetch --all && for R in `git remote` ; do for T in `git tag` ; do git fetch $R $T ; done ; done |
| 79 | + git describe || { |
| 80 | + TEST_REF="`git symbolic-ref --short HEAD 2>/dev/null || cat .git/HEAD`" && [ -n "${TEST_REF}" ] && git checkout master && git pull --all && git checkout "${TEST_REF}" |
| 81 | + git describe || true |
| 82 | + } |
| 83 | + } |
| 84 | + } |
| 85 | +
|
| 86 | + # Using hints from https://askubuntu.com/questions/272248/processing-triggers-for-man-db |
| 87 | + # and our own docs/config-prereqs.txt |
| 88 | + # NOTE: Currently installing the MAX prerequisite footprint, |
| 89 | + # which for building just the docs may be a bit of an overkill. |
| 90 | + - name: NUT CI Prerequisite packages (Ubuntu, GCC) |
| 91 | + run: | |
| 92 | + echo "set man-db/auto-update false" | sudo debconf-communicate |
| 93 | + sudo dpkg-reconfigure man-db |
| 94 | + sudo apt update |
| 95 | + sudo apt install \ |
| 96 | + gcc g++ clang \ |
| 97 | + ccache time \ |
| 98 | + git perl curl \ |
| 99 | + make autoconf automake libltdl-dev libtool binutils \ |
| 100 | + valgrind \ |
| 101 | + cppcheck \ |
| 102 | + pkg-config \ |
| 103 | + libtool-bin \ |
| 104 | + python3 gettext python3-pyqt6 pyqt6-dev-tools \ |
| 105 | + aspell aspell-en \ |
| 106 | + asciidoc source-highlight python3-pygments dblatex \ |
| 107 | + libgd-dev \ |
| 108 | + systemd-dev \ |
| 109 | + libsystemd-dev \ |
| 110 | + libcppunit-dev \ |
| 111 | + libssl-dev libnss3-dev \ |
| 112 | + augeas-tools libaugeas-dev augeas-lenses \ |
| 113 | + libusb-dev libusb-1.0-0-dev \ |
| 114 | + libi2c-dev \ |
| 115 | + libmodbus-dev \ |
| 116 | + libsnmp-dev \ |
| 117 | + libpowerman0-dev \ |
| 118 | + libfreeipmi-dev libipmimonitoring-dev \ |
| 119 | + libavahi-common-dev libavahi-core-dev libavahi-client-dev \ |
| 120 | + libgpiod-dev \ |
| 121 | + libglib2.0-dev \ |
| 122 | + bash dash ksh busybox \ |
| 123 | + libneon27-gnutls-dev \ |
| 124 | + build-essential git-core libi2c-dev i2c-tools lm-sensors \ |
| 125 | + || exit |
| 126 | + date > .timestamp-init |
| 127 | +
|
| 128 | + - name: Prepare ccache |
| 129 | + # Based on https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#example-using-the-cache-action example |
| 130 | + id: cache-ccache |
| 131 | + uses: actions/cache@v6 |
| 132 | + env: |
| 133 | + compiler: 'CC=gcc CXX=g++' |
| 134 | + cache-name: cache-ccache-${{ env.compiler }} |
| 135 | + with: |
| 136 | + path: | |
| 137 | + ~/.ccache |
| 138 | + ~/.cache/ccache |
| 139 | + ~/.config/ccache/ccache.conf |
| 140 | + key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/.timestamp-init') }} |
| 141 | + restore-keys: | |
| 142 | + ${{ runner.os }}-build-${{ env.cache-name }}- |
| 143 | + ${{ runner.os }}-build- |
| 144 | + ${{ runner.os }}- |
| 145 | +
|
| 146 | + - name: CCache stats before build |
| 147 | + run: | |
| 148 | + ccache -sv || ccache -s || echo "FAILED to read ccache info, oh well" |
| 149 | + rm -f .timestamp-init |
| 150 | +
|
| 151 | + - name: Debug gitlog2version processing |
| 152 | + run: bash -x ./tools/gitlog2version.sh || true |
| 153 | + |
| 154 | + - name: NUT CI Build Configuration |
| 155 | + env: |
| 156 | + compiler: 'CC=gcc CXX=g++' |
| 157 | + run: | |
| 158 | + PATH="/usr/lib/ccache:$PATH" ; export PATH |
| 159 | + CCACHE_COMPRESS=true; export CCACHE_COMPRESS |
| 160 | + ccache --version || true |
| 161 | + ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true |
| 162 | + ./autogen.sh && \ |
| 163 | + ./configure --enable-warnings --enable-Werror --enable-Wcolor --with-all --with-dev --with-docs --enable-docs-changelog ${{env.compiler}} |
| 164 | +
|
| 165 | + # NOTE: In this scenario we do not build actually NUT in the main |
| 166 | + # checkout directory, at least not explicitly (recipe may generate |
| 167 | + # some files like man pages to fulfill the "dist" requirements; |
| 168 | + # for now this may generate some libs to figure out their IDs). |
| 169 | + # We do `make docs` to provide them as a separate tarball just |
| 170 | + # in case, later. |
| 171 | + # DO NOT `make dist-files` here as it includes `dist-sig` and |
| 172 | + # needs a GPG keychain with maintainers' secrets deployed locally. |
| 173 | + - name: NUT CI Build to create "dist" tarball and related files |
| 174 | + env: |
| 175 | + compiler: 'CC=gcc CXX=g++' |
| 176 | + run: | |
| 177 | + PATH="/usr/lib/ccache:$PATH" ; export PATH |
| 178 | + CCACHE_COMPRESS=true; export CCACHE_COMPRESS |
| 179 | + ccache --version || true |
| 180 | + ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true |
| 181 | + make -s -j 8 dist dist-hash |
| 182 | +
|
| 183 | + - name: NUT CI Build to verify "dist" tarball build |
| 184 | + env: |
| 185 | + compiler: 'CC=gcc CXX=g++' |
| 186 | + run: | |
| 187 | + PATH="/usr/lib/ccache:$PATH" ; export PATH |
| 188 | + CCACHE_COMPRESS=true; export CCACHE_COMPRESS |
| 189 | + ccache --version || true |
| 190 | + ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true |
| 191 | + make -s -j 8 distcheck |
| 192 | +
|
| 193 | + - name: NUT CI Build to verify "dist" tarball build self-reproducibility |
| 194 | + env: |
| 195 | + compiler: 'CC=gcc CXX=g++' |
| 196 | + run: | |
| 197 | + PATH="/usr/lib/ccache:$PATH" ; export PATH |
| 198 | + CCACHE_COMPRESS=true; export CCACHE_COMPRESS |
| 199 | + ccache --version || true |
| 200 | + ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true |
| 201 | + make -s -j 8 distcheck-completeness |
| 202 | +
|
| 203 | + - name: CCache stats after distcheck |
| 204 | + run: ccache -sv || ccache -s || echo "FAILED to read ccache info, oh well" |
| 205 | + |
| 206 | + - name: NUT CI Build to package complex docs (not part of dist tarball) |
| 207 | + run: | |
| 208 | + make -s -j 8 dist-docs |
| 209 | +
|
| 210 | + # NOTE: A `.zip` is added to the base `$name` automatically |
| 211 | + - name: Upload tarball and its checksum artifacts |
| 212 | + uses: actions/upload-artifact@v7 |
| 213 | + id: upload_artifact |
| 214 | + with: |
| 215 | + name: ${{ inputs.artifact_name }} |
| 216 | + path: | |
| 217 | + nut-*.tar* |
| 218 | + compression-level: 0 |
| 219 | + overwrite: true |
| 220 | + |
| 221 | + # FINISH: Pass control back to the main pipeline |
0 commit comments