Zane Walker
faf5b27328
Replace the legacy Go implementation as the production path, quarantine the reference tree, add deterministic release packaging and version metadata, and run verification through GitLab CI.
128 lines
3.1 KiB
YAML
128 lines
3.1 KiB
YAML
stages:
|
|
- verify
|
|
- container
|
|
- package
|
|
- release
|
|
|
|
workflow:
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG'
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
|
- if: '$CI_COMMIT_BRANCH'
|
|
|
|
variables:
|
|
CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
|
|
CARGO_TERM_COLOR: never
|
|
RUST_BACKTRACE: "1"
|
|
|
|
.rust-job:
|
|
image: rust:1.88.0-bookworm
|
|
before_script:
|
|
- apt-get update
|
|
- >-
|
|
apt-get install --no-install-recommends -y
|
|
libpam0g-dev libpam-modules pkg-config xauth xvfb util-linux
|
|
- rustup component add rustfmt clippy
|
|
cache:
|
|
key:
|
|
files:
|
|
- Cargo.lock
|
|
- rust-toolchain.toml
|
|
paths:
|
|
- .cargo/registry/index/
|
|
- .cargo/registry/cache/
|
|
- .cargo/git/db/
|
|
- .cargo/bin/
|
|
- target/
|
|
|
|
rust-verify:
|
|
extends: .rust-job
|
|
stage: verify
|
|
script:
|
|
- make check COLOR=0
|
|
- make version COLOR=0
|
|
artifacts:
|
|
when: always
|
|
expire_in: 7 days
|
|
paths:
|
|
- target/debug/deps/
|
|
|
|
security-audit:
|
|
image: rust:1.88.0-bookworm
|
|
stage: verify
|
|
cache:
|
|
key: cargo-audit-0.22.2
|
|
paths:
|
|
- .cargo/bin/
|
|
- .cargo/registry/index/
|
|
- .cargo/registry/cache/
|
|
before_script:
|
|
- command -v cargo-audit >/dev/null || cargo install cargo-audit --locked --version 0.22.2
|
|
script:
|
|
- cargo audit
|
|
|
|
docker-verify:
|
|
image: docker:27.5.1-cli
|
|
stage: container
|
|
services:
|
|
- name: docker:27.5.1-dind
|
|
alias: docker
|
|
variables:
|
|
DOCKER_HOST: tcp://docker:2376
|
|
DOCKER_TLS_CERTDIR: "/certs"
|
|
DOCKER_TLS_VERIFY: "1"
|
|
DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
|
|
before_script:
|
|
- until docker info >/dev/null 2>&1; do sleep 1; done
|
|
script:
|
|
- ./scripts/test-docker.sh
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH'
|
|
- if: '$CI_COMMIT_TAG'
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
|
|
|
package:
|
|
extends: .rust-job
|
|
stage: package
|
|
needs:
|
|
- job: rust-verify
|
|
artifacts: false
|
|
- job: docker-verify
|
|
artifacts: false
|
|
- job: security-audit
|
|
artifacts: false
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
|
|
script:
|
|
- VERSION="${CI_COMMIT_TAG#v}" make package COLOR=0 TAG="$CI_COMMIT_TAG"
|
|
- (cd dist && sha256sum --check "$(basename "$(ls *.tar.gz)").sha256")
|
|
- printf 'PACKAGE_JOB_ID=%s\n' "$CI_JOB_ID" >> dist/release.env
|
|
artifacts:
|
|
name: "latchd-${CI_COMMIT_TAG}"
|
|
expire_in: 30 days
|
|
paths:
|
|
- dist/
|
|
reports:
|
|
dotenv: dist/release.env
|
|
|
|
release:
|
|
image: registry.gitlab.com/gitlab-org/cli:v1.103.0
|
|
stage: release
|
|
needs:
|
|
- job: package
|
|
artifacts: true
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
|
|
script:
|
|
- test -n "$PACKAGE_JOB_ID"
|
|
- test -f dist/release.env
|
|
release:
|
|
tag_name: "$CI_COMMIT_TAG"
|
|
name: "latchd ${CI_COMMIT_TAG}"
|
|
description: "Production artifacts and checksums are attached from the reproducible package job."
|
|
assets:
|
|
links:
|
|
- name: "latchd package and SHA-256"
|
|
url: "${CI_PROJECT_URL}/-/jobs/${PACKAGE_JOB_ID}/artifacts/download?file_type=archive"
|
|
link_type: package
|