Add offline package workflows for Terraform, Pulumi, and Git tools
This commit is contained in:
shenlan
parent
890a93856a
commit
2d0458ab6f
286
.github/workflows/offline-package-argocd-installer.yaml
vendored
Normal file
286
.github/workflows/offline-package-argocd-installer.yaml
vendored
Normal file
@ -0,0 +1,286 @@
|
||||
name: Build Offline Argo CD Installer
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- '.github/workflows/offline-package-argocd-installer.yaml'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Release tag to use/sync (e.g., v2.11.0). Leave empty to use offline-argocd-<run_number>"
|
||||
required: false
|
||||
type: string
|
||||
chart_version:
|
||||
description: "Override Helm chart version for argo/argo-cd. Leave empty to auto-resolve"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: build-offline-argocd
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build-offline-installer:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NERDCTL_VERSION: "2.0.3"
|
||||
outputs:
|
||||
chart_version: ${{ steps.resolve.outputs.chart_version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install deps (curl, jq, helm)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y curl jq
|
||||
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
helm version
|
||||
|
||||
- name: Add helm repo
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm repo add argo https://argoproj.github.io/argo-helm --force-update
|
||||
helm repo update
|
||||
|
||||
- name: Resolve chart version
|
||||
id: resolve
|
||||
env:
|
||||
OVERRIDE_CHART_VERSION: ${{ github.event.inputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${OVERRIDE_CHART_VERSION}" ]; then
|
||||
CHART_VERSION="${OVERRIDE_CHART_VERSION}"
|
||||
else
|
||||
CHART_VERSION=$(helm search repo argo/argo-cd --versions | awk 'NR==2{print $2}')
|
||||
fi
|
||||
echo "chart_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Prepare directories
|
||||
run: |
|
||||
set -euo pipefail
|
||||
rm -rf offline-installer
|
||||
mkdir -p offline-installer/{images,charts,scripts,metadata}
|
||||
|
||||
- name: Stage installer script
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cat <<'SCRIPT' > offline-installer/scripts/install-argocd.sh
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CHART_DIR="${ROOT_DIR}/charts/argo-cd"
|
||||
IMAGES_DIR="${ROOT_DIR}/images"
|
||||
RELEASE_NAME="${RELEASE_NAME:-argo-cd}"
|
||||
NAMESPACE="${NAMESPACE:-argocd}"
|
||||
|
||||
if command -v nerdctl >/dev/null 2>&1; then
|
||||
LOADER="nerdctl"
|
||||
elif command -v docker >/dev/null 2>&1; then
|
||||
LOADER="docker"
|
||||
else
|
||||
echo "Either docker or nerdctl is required to load images." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for tar in "${IMAGES_DIR}"/*.tar; do
|
||||
[ -f "$tar" ] || continue
|
||||
echo "Loading image: $tar"
|
||||
"$LOADER" load -i "$tar"
|
||||
done
|
||||
|
||||
echo "Installing/Upgrading Argo CD release ${RELEASE_NAME} in namespace ${NAMESPACE}"
|
||||
helm upgrade --install "${RELEASE_NAME}" "${CHART_DIR}" \
|
||||
--namespace "${NAMESPACE}" \
|
||||
--create-namespace \
|
||||
"$@"
|
||||
SCRIPT
|
||||
chmod +x offline-installer/scripts/install-argocd.sh
|
||||
cat <<EOFMETA > offline-installer/metadata/INFO
|
||||
chart: argo/argo-cd
|
||||
chart_version: ${CHART_VERSION}
|
||||
created_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
EOFMETA
|
||||
|
||||
- name: Download nerdctl binary for ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
wget https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-${{ matrix.arch }}.tar.gz \
|
||||
-O offline-installer/nerdctl.tar.gz
|
||||
|
||||
- name: Pull & export required images
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
PLATFORM="linux/${{ matrix.arch }}"
|
||||
helm template argo argo/argo-cd --version "${CHART_VERSION}" > manifest.yaml
|
||||
mapfile -t images < <(grep -oP 'image:\s*"?\K([^"\s]+)' manifest.yaml | sort -u || true)
|
||||
rm -f manifest.yaml
|
||||
for img in "${images[@]}"; do
|
||||
[ -n "$img" ] || continue
|
||||
if [[ "$img" == *"{{"* ]]; then
|
||||
continue
|
||||
fi
|
||||
echo "Pulling $img for ${PLATFORM}"
|
||||
if ! docker pull --platform "${PLATFORM}" "$img"; then
|
||||
echo "::warning::Failed to pull $img for ${PLATFORM}, skipping" >&2
|
||||
continue
|
||||
fi
|
||||
safe=$(echo "$img" | tr '/:' '-_')
|
||||
docker save "$img" -o "offline-installer/images/${safe}.tar"
|
||||
done
|
||||
|
||||
- name: Download Helm chart
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm pull argo/argo-cd --version "${CHART_VERSION}" --untar --untardir offline-installer/charts
|
||||
|
||||
- name: Package offline installer
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tar -czf offline-setup-argocd-${{ matrix.arch }}.tar.gz -C offline-installer .
|
||||
ls -lh offline-setup-argocd-${{ matrix.arch }}.tar.gz
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: offline-setup-argocd-${{ matrix.arch }}
|
||||
path: offline-setup-argocd-${{ matrix.arch }}.tar.gz
|
||||
|
||||
test-offline-installer:
|
||||
needs: build-offline-installer
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Download artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-argocd-${{ matrix.arch }}
|
||||
path: offline-test
|
||||
|
||||
- name: Verify offline package integrity
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd offline-test
|
||||
tar -tzf offline-setup-argocd-${{ matrix.arch }}.tar.gz > /dev/null
|
||||
|
||||
publish-release:
|
||||
needs: test-offline-installer
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-argocd-{0}', github.run_number) }}
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/argocd
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
release_name: Build ${{ env.TAG_NAME }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Download amd64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-argocd-amd64
|
||||
path: release-artifacts/amd64
|
||||
|
||||
- name: Download arm64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-argocd-arm64
|
||||
path: release-artifacts/arm64
|
||||
|
||||
- name: Upload offline installers to GitHub Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
files: |
|
||||
release-artifacts/amd64/offline-setup-argocd-amd64.tar.gz
|
||||
release-artifacts/arm64/offline-setup-argocd-arm64.tar.gz
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Ensure deps (rsync, ssh)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Rsync release assets to remote
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REMOTE_DIR="${REMOTE_ROOT}/${TAG_NAME}"
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
||||
echo "Rsync -> ${VPS_HOST}:${REMOTE_DIR}/"
|
||||
rsync -av -e "ssh -i ~/.ssh/id_rsa" \
|
||||
release-artifacts/amd64/offline-setup-argocd-amd64.tar.gz \
|
||||
release-artifacts/arm64/offline-setup-argocd-arm64.tar.gz \
|
||||
"${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
retention:
|
||||
name: Remote retention (keep latest 3)
|
||||
needs: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/argocd
|
||||
steps:
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Prune old versions on remote (keep 3)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
|
||||
set -euo pipefail
|
||||
cd "'"${REMOTE_ROOT}"'" || exit 0
|
||||
keep=3
|
||||
mapfile -t all < <(ls -1 | grep -E "^(offline-argocd-|v[0-9]+\.)" | sort -V -r || true)
|
||||
if [ "${#all[@]}" -le "$keep" ]; then
|
||||
echo "Nothing to prune. Count=${#all[@]}"
|
||||
exit 0
|
||||
fi
|
||||
to_delete=("${all[@]:keep}")
|
||||
echo "Pruning old versions: ${to_delete[*]}"
|
||||
for d in "${to_delete[@]}"; do
|
||||
rm -rf -- "$d"
|
||||
done
|
||||
'
|
||||
286
.github/workflows/offline-package-gitea-installer.yaml
vendored
Normal file
286
.github/workflows/offline-package-gitea-installer.yaml
vendored
Normal file
@ -0,0 +1,286 @@
|
||||
name: Build Offline Gitea Installer
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- '.github/workflows/offline-package-gitea-installer.yaml'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Release tag to use/sync (e.g., v1.21.10). Leave empty to use offline-gitea-<run_number>"
|
||||
required: false
|
||||
type: string
|
||||
chart_version:
|
||||
description: "Override Helm chart version for gitea-charts/gitea. Leave empty to auto-resolve"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: build-offline-gitea
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build-offline-installer:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NERDCTL_VERSION: "2.0.3"
|
||||
outputs:
|
||||
chart_version: ${{ steps.resolve.outputs.chart_version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install deps (curl, jq, helm)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y curl jq
|
||||
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
helm version
|
||||
|
||||
- name: Add helm repo
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm repo add gitea-charts https://dl.gitea.io/charts/ --force-update
|
||||
helm repo update
|
||||
|
||||
- name: Resolve chart version
|
||||
id: resolve
|
||||
env:
|
||||
OVERRIDE_CHART_VERSION: ${{ github.event.inputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${OVERRIDE_CHART_VERSION}" ]; then
|
||||
CHART_VERSION="${OVERRIDE_CHART_VERSION}"
|
||||
else
|
||||
CHART_VERSION=$(helm search repo gitea-charts/gitea --versions | awk 'NR==2{print $2}')
|
||||
fi
|
||||
echo "chart_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Prepare directories
|
||||
run: |
|
||||
set -euo pipefail
|
||||
rm -rf offline-installer
|
||||
mkdir -p offline-installer/{images,charts,scripts,metadata}
|
||||
|
||||
- name: Stage installer script
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cat <<'SCRIPT' > offline-installer/scripts/install-gitea.sh
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CHART_DIR="${ROOT_DIR}/charts/gitea"
|
||||
IMAGES_DIR="${ROOT_DIR}/images"
|
||||
RELEASE_NAME="${RELEASE_NAME:-gitea}"
|
||||
NAMESPACE="${NAMESPACE:-gitea}"
|
||||
|
||||
if command -v nerdctl >/dev/null 2>&1; then
|
||||
LOADER="nerdctl"
|
||||
elif command -v docker >/dev/null 2>&1; then
|
||||
LOADER="docker"
|
||||
else
|
||||
echo "Either docker or nerdctl is required to load images." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for tar in "${IMAGES_DIR}"/*.tar; do
|
||||
[ -f "$tar" ] || continue
|
||||
echo "Loading image: $tar"
|
||||
"$LOADER" load -i "$tar"
|
||||
done
|
||||
|
||||
echo "Installing/Upgrading Gitea release ${RELEASE_NAME} in namespace ${NAMESPACE}"
|
||||
helm upgrade --install "${RELEASE_NAME}" "${CHART_DIR}" \
|
||||
--namespace "${NAMESPACE}" \
|
||||
--create-namespace \
|
||||
"$@"
|
||||
SCRIPT
|
||||
chmod +x offline-installer/scripts/install-gitea.sh
|
||||
cat <<EOFMETA > offline-installer/metadata/INFO
|
||||
chart: gitea-charts/gitea
|
||||
chart_version: ${CHART_VERSION}
|
||||
created_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
EOFMETA
|
||||
|
||||
- name: Download nerdctl binary for ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
wget https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-${{ matrix.arch }}.tar.gz \
|
||||
-O offline-installer/nerdctl.tar.gz
|
||||
|
||||
- name: Pull & export required images
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
PLATFORM="linux/${{ matrix.arch }}"
|
||||
helm template gitea gitea-charts/gitea --version "${CHART_VERSION}" > manifest.yaml
|
||||
mapfile -t images < <(grep -oP 'image:\s*"?\K([^"\s]+)' manifest.yaml | sort -u || true)
|
||||
rm -f manifest.yaml
|
||||
for img in "${images[@]}"; do
|
||||
[ -n "$img" ] || continue
|
||||
if [[ "$img" == *"{{"* ]]; then
|
||||
continue
|
||||
fi
|
||||
echo "Pulling $img for ${PLATFORM}"
|
||||
if ! docker pull --platform "${PLATFORM}" "$img"; then
|
||||
echo "::warning::Failed to pull $img for ${PLATFORM}, skipping" >&2
|
||||
continue
|
||||
fi
|
||||
safe=$(echo "$img" | tr '/:' '-_')
|
||||
docker save "$img" -o "offline-installer/images/${safe}.tar"
|
||||
done
|
||||
|
||||
- name: Download Helm chart
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm pull gitea-charts/gitea --version "${CHART_VERSION}" --untar --untardir offline-installer/charts
|
||||
|
||||
- name: Package offline installer
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tar -czf offline-setup-gitea-${{ matrix.arch }}.tar.gz -C offline-installer .
|
||||
ls -lh offline-setup-gitea-${{ matrix.arch }}.tar.gz
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitea-${{ matrix.arch }}
|
||||
path: offline-setup-gitea-${{ matrix.arch }}.tar.gz
|
||||
|
||||
test-offline-installer:
|
||||
needs: build-offline-installer
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Download artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitea-${{ matrix.arch }}
|
||||
path: offline-test
|
||||
|
||||
- name: Verify offline package integrity
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd offline-test
|
||||
tar -tzf offline-setup-gitea-${{ matrix.arch }}.tar.gz > /dev/null
|
||||
|
||||
publish-release:
|
||||
needs: test-offline-installer
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-gitea-{0}', github.run_number) }}
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/gitea
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
release_name: Build ${{ env.TAG_NAME }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Download amd64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitea-amd64
|
||||
path: release-artifacts/amd64
|
||||
|
||||
- name: Download arm64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitea-arm64
|
||||
path: release-artifacts/arm64
|
||||
|
||||
- name: Upload offline installers to GitHub Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
files: |
|
||||
release-artifacts/amd64/offline-setup-gitea-amd64.tar.gz
|
||||
release-artifacts/arm64/offline-setup-gitea-arm64.tar.gz
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Ensure deps (rsync, ssh)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Rsync release assets to remote
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REMOTE_DIR="${REMOTE_ROOT}/${TAG_NAME}"
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
||||
echo "Rsync -> ${VPS_HOST}:${REMOTE_DIR}/"
|
||||
rsync -av -e "ssh -i ~/.ssh/id_rsa" \
|
||||
release-artifacts/amd64/offline-setup-gitea-amd64.tar.gz \
|
||||
release-artifacts/arm64/offline-setup-gitea-arm64.tar.gz \
|
||||
"${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
retention:
|
||||
name: Remote retention (keep latest 3)
|
||||
needs: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/gitea
|
||||
steps:
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Prune old versions on remote (keep 3)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
|
||||
set -euo pipefail
|
||||
cd "'"${REMOTE_ROOT}"'" || exit 0
|
||||
keep=3
|
||||
mapfile -t all < <(ls -1 | grep -E "^(offline-gitea-|v[0-9]+\.)" | sort -V -r || true)
|
||||
if [ "${#all[@]}" -le "$keep" ]; then
|
||||
echo "Nothing to prune. Count=${#all[@]}"
|
||||
exit 0
|
||||
fi
|
||||
to_delete=("${all[@]:keep}")
|
||||
echo "Pruning old versions: ${to_delete[*]}"
|
||||
for d in "${to_delete[@]}"; do
|
||||
rm -rf -- "$d"
|
||||
done
|
||||
'
|
||||
286
.github/workflows/offline-package-gitlab-installer.yaml
vendored
Normal file
286
.github/workflows/offline-package-gitlab-installer.yaml
vendored
Normal file
@ -0,0 +1,286 @@
|
||||
name: Build Offline GitLab Installer
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- '.github/workflows/offline-package-gitlab-installer.yaml'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Release tag to use/sync (e.g., v16.11.0). Leave empty to use offline-gitlab-<run_number>"
|
||||
required: false
|
||||
type: string
|
||||
chart_version:
|
||||
description: "Override Helm chart version for gitlab/gitlab. Leave empty to auto-resolve"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: build-offline-gitlab
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build-offline-installer:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NERDCTL_VERSION: "2.0.3"
|
||||
outputs:
|
||||
chart_version: ${{ steps.resolve.outputs.chart_version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install deps (curl, jq, helm)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y curl jq
|
||||
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
helm version
|
||||
|
||||
- name: Add helm repo
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm repo add gitlab https://charts.gitlab.io --force-update
|
||||
helm repo update
|
||||
|
||||
- name: Resolve chart version
|
||||
id: resolve
|
||||
env:
|
||||
OVERRIDE_CHART_VERSION: ${{ github.event.inputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${OVERRIDE_CHART_VERSION}" ]; then
|
||||
CHART_VERSION="${OVERRIDE_CHART_VERSION}"
|
||||
else
|
||||
CHART_VERSION=$(helm search repo gitlab/gitlab --versions | awk 'NR==2{print $2}')
|
||||
fi
|
||||
echo "chart_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Prepare directories
|
||||
run: |
|
||||
set -euo pipefail
|
||||
rm -rf offline-installer
|
||||
mkdir -p offline-installer/{images,charts,scripts,metadata}
|
||||
|
||||
- name: Stage installer script
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cat <<'SCRIPT' > offline-installer/scripts/install-gitlab.sh
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CHART_DIR="${ROOT_DIR}/charts/gitlab"
|
||||
IMAGES_DIR="${ROOT_DIR}/images"
|
||||
RELEASE_NAME="${RELEASE_NAME:-gitlab}"
|
||||
NAMESPACE="${NAMESPACE:-gitlab}"
|
||||
|
||||
if command -v nerdctl >/dev/null 2>&1; then
|
||||
LOADER="nerdctl"
|
||||
elif command -v docker >/dev/null 2>&1; then
|
||||
LOADER="docker"
|
||||
else
|
||||
echo "Either docker or nerdctl is required to load images." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for tar in "${IMAGES_DIR}"/*.tar; do
|
||||
[ -f "$tar" ] || continue
|
||||
echo "Loading image: $tar"
|
||||
"$LOADER" load -i "$tar"
|
||||
done
|
||||
|
||||
echo "Installing/Upgrading GitLab release ${RELEASE_NAME} in namespace ${NAMESPACE}"
|
||||
helm upgrade --install "${RELEASE_NAME}" "${CHART_DIR}" \
|
||||
--namespace "${NAMESPACE}" \
|
||||
--create-namespace \
|
||||
"$@"
|
||||
SCRIPT
|
||||
chmod +x offline-installer/scripts/install-gitlab.sh
|
||||
cat <<EOFMETA > offline-installer/metadata/INFO
|
||||
chart: gitlab/gitlab
|
||||
chart_version: ${CHART_VERSION}
|
||||
created_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
EOFMETA
|
||||
|
||||
- name: Download nerdctl binary for ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
wget https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-${{ matrix.arch }}.tar.gz \
|
||||
-O offline-installer/nerdctl.tar.gz
|
||||
|
||||
- name: Pull & export required images
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
PLATFORM="linux/${{ matrix.arch }}"
|
||||
helm template gitlab gitlab/gitlab --version "${CHART_VERSION}" > manifest.yaml
|
||||
mapfile -t images < <(grep -oP 'image:\s*"?\K([^"\s]+)' manifest.yaml | sort -u || true)
|
||||
rm -f manifest.yaml
|
||||
for img in "${images[@]}"; do
|
||||
[ -n "$img" ] || continue
|
||||
if [[ "$img" == *"{{"* ]]; then
|
||||
continue
|
||||
fi
|
||||
echo "Pulling $img for ${PLATFORM}"
|
||||
if ! docker pull --platform "${PLATFORM}" "$img"; then
|
||||
echo "::warning::Failed to pull $img for ${PLATFORM}, skipping" >&2
|
||||
continue
|
||||
fi
|
||||
safe=$(echo "$img" | tr '/:' '-_')
|
||||
docker save "$img" -o "offline-installer/images/${safe}.tar"
|
||||
done
|
||||
|
||||
- name: Download Helm chart
|
||||
env:
|
||||
CHART_VERSION: ${{ steps.resolve.outputs.chart_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm pull gitlab/gitlab --version "${CHART_VERSION}" --untar --untardir offline-installer/charts
|
||||
|
||||
- name: Package offline installer
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tar -czf offline-setup-gitlab-${{ matrix.arch }}.tar.gz -C offline-installer .
|
||||
ls -lh offline-setup-gitlab-${{ matrix.arch }}.tar.gz
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitlab-${{ matrix.arch }}
|
||||
path: offline-setup-gitlab-${{ matrix.arch }}.tar.gz
|
||||
|
||||
test-offline-installer:
|
||||
needs: build-offline-installer
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Download artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitlab-${{ matrix.arch }}
|
||||
path: offline-test
|
||||
|
||||
- name: Verify offline package integrity
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd offline-test
|
||||
tar -tzf offline-setup-gitlab-${{ matrix.arch }}.tar.gz > /dev/null
|
||||
|
||||
publish-release:
|
||||
needs: test-offline-installer
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-gitlab-{0}', github.run_number) }}
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/gitlab
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
release_name: Build ${{ env.TAG_NAME }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Download amd64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitlab-amd64
|
||||
path: release-artifacts/amd64
|
||||
|
||||
- name: Download arm64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: offline-setup-gitlab-arm64
|
||||
path: release-artifacts/arm64
|
||||
|
||||
- name: Upload offline installers to GitHub Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
files: |
|
||||
release-artifacts/amd64/offline-setup-gitlab-amd64.tar.gz
|
||||
release-artifacts/arm64/offline-setup-gitlab-arm64.tar.gz
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Ensure deps (rsync, ssh)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Rsync release assets to remote
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REMOTE_DIR="${REMOTE_ROOT}/${TAG_NAME}"
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
||||
echo "Rsync -> ${VPS_HOST}:${REMOTE_DIR}/"
|
||||
rsync -av -e "ssh -i ~/.ssh/id_rsa" \
|
||||
release-artifacts/amd64/offline-setup-gitlab-amd64.tar.gz \
|
||||
release-artifacts/arm64/offline-setup-gitlab-arm64.tar.gz \
|
||||
"${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
retention:
|
||||
name: Remote retention (keep latest 3)
|
||||
needs: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/gitlab
|
||||
steps:
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Prune old versions on remote (keep 3)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
|
||||
set -euo pipefail
|
||||
cd "'"${REMOTE_ROOT}"'" || exit 0
|
||||
keep=3
|
||||
mapfile -t all < <(ls -1 | grep -E "^(offline-gitlab-|v[0-9]+\.)" | sort -V -r || true)
|
||||
if [ "${#all[@]}" -le "$keep" ]; then
|
||||
echo "Nothing to prune. Count=${#all[@]}"
|
||||
exit 0
|
||||
fi
|
||||
to_delete=("${all[@]:keep}")
|
||||
echo "Pruning old versions: ${to_delete[*]}"
|
||||
for d in "${to_delete[@]}"; do
|
||||
rm -rf -- "$d"
|
||||
done
|
||||
'
|
||||
258
.github/workflows/offline-package-pulumi-installer.yaml
vendored
Normal file
258
.github/workflows/offline-package-pulumi-installer.yaml
vendored
Normal file
@ -0,0 +1,258 @@
|
||||
name: Build Offline Pulumi Installer
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- '.github/workflows/offline-package-pulumi-installer.yaml'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Release tag to use/sync (e.g., v3.127.0). Leave empty to use offline-pulumi-<run_number>"
|
||||
required: false
|
||||
type: string
|
||||
pulumi_version:
|
||||
description: "Override Pulumi version (e.g., 3.127.0). Leave empty to auto-resolve"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: build-offline-pulumi
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build-offline-installer:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
version: ${{ steps.resolve.outputs.version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install deps (curl, jq, tar)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y curl jq tar
|
||||
|
||||
- name: Resolve Pulumi version
|
||||
id: resolve
|
||||
env:
|
||||
OVERRIDE_VERSION: ${{ github.event.inputs.pulumi_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${OVERRIDE_VERSION}" ]; then
|
||||
VERSION="${OVERRIDE_VERSION}"
|
||||
else
|
||||
VERSION=$(curl -fsSL https://api.github.com/repos/pulumi/pulumi/releases?per_page=100 \
|
||||
| jq -r '.[].tag_name' \
|
||||
| grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
|
||||
| sed 's/^v//' \
|
||||
| sort -V \
|
||||
| tail -n 1)
|
||||
fi
|
||||
if [ -z "${VERSION}" ]; then
|
||||
echo "Failed to resolve Pulumi version" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Resolved Pulumi version: ${VERSION}"
|
||||
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Build offline Pulumi package
|
||||
env:
|
||||
PULUMI_VERSION: ${{ steps.resolve.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ARCH="${{ matrix.arch }}"
|
||||
case "$ARCH" in
|
||||
amd64) ASSET_ARCH="x64" ;;
|
||||
arm64) ASSET_ARCH="arm64" ;;
|
||||
*) echo "Unsupported arch: $ARCH" >&2; exit 1 ;;
|
||||
esac
|
||||
WORKDIR="pulumi-offline-package"
|
||||
rm -rf "${WORKDIR}"
|
||||
mkdir -p "${WORKDIR}" "${WORKDIR}/scripts"
|
||||
|
||||
ARCHIVE="pulumi-v${PULUMI_VERSION}-linux-${ASSET_ARCH}.tar.gz"
|
||||
URL="https://get.pulumi.com/releases/sdk/${ARCHIVE}"
|
||||
echo "Downloading ${URL}"
|
||||
curl -fSL "${URL}" -o "${ARCHIVE}"
|
||||
|
||||
tar -xzvf "${ARCHIVE}" -C "${WORKDIR}" --strip-components=1
|
||||
rm -f "${ARCHIVE}"
|
||||
|
||||
echo "${PULUMI_VERSION}" > "${WORKDIR}/VERSION"
|
||||
|
||||
cat <<'SCRIPT' > "${WORKDIR}/scripts/install-pulumi.sh"
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
BIN_DIR="${ROOT_DIR}/bin"
|
||||
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
|
||||
|
||||
if [[ "${1:-}" == "--install" ]]; then
|
||||
sudo install -m 0755 "${BIN_DIR}"/* "${INSTALL_DIR}/"
|
||||
echo "Pulumi binaries installed to ${INSTALL_DIR}"
|
||||
else
|
||||
cat <<USAGE
|
||||
Usage: $(basename "$0") --install
|
||||
--install Copy Pulumi CLI binaries into ${INSTALL_DIR}
|
||||
USAGE
|
||||
fi
|
||||
SCRIPT
|
||||
chmod +x "${WORKDIR}/scripts/install-pulumi.sh"
|
||||
|
||||
tar -czf "pulumi-offline-package-${ARCH}.tar.gz" "${WORKDIR}"
|
||||
ls -lh "pulumi-offline-package-${ARCH}.tar.gz"
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: pulumi-offline-package-${{ matrix.arch }}
|
||||
path: pulumi-offline-package-${{ matrix.arch }}.tar.gz
|
||||
if-no-files-found: error
|
||||
|
||||
test-offline-installer:
|
||||
needs: build-offline-installer
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Download artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: pulumi-offline-package-${{ matrix.arch }}
|
||||
path: ./test-dir
|
||||
|
||||
- name: Extract package
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd test-dir
|
||||
tar -xzvf pulumi-offline-package-${{ matrix.arch }}.tar.gz
|
||||
|
||||
- name: Verify Pulumi bundle
|
||||
env:
|
||||
PULUMI_VERSION: ${{ needs.build-offline-installer.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd test-dir/pulumi-offline-package
|
||||
test -f VERSION
|
||||
if [ "${{ matrix.arch }}" = "amd64" ]; then
|
||||
./bin/pulumi version
|
||||
./bin/pulumi version | grep "v${PULUMI_VERSION}"
|
||||
else
|
||||
file ./bin/pulumi | grep -E "ARM|aarch64"
|
||||
fi
|
||||
|
||||
publish-release:
|
||||
needs: test-offline-installer
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-pulumi-{0}', github.run_number) }}
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/pulumi
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Create GitHub Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
release_name: Build ${{ env.TAG_NAME }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Download amd64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: pulumi-offline-package-amd64
|
||||
path: release-artifacts/amd64
|
||||
|
||||
- name: Download arm64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: pulumi-offline-package-arm64
|
||||
path: release-artifacts/arm64
|
||||
|
||||
- name: Upload offline installers to GitHub Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
files: |
|
||||
release-artifacts/amd64/pulumi-offline-package-amd64.tar.gz
|
||||
release-artifacts/arm64/pulumi-offline-package-arm64.tar.gz
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Ensure deps (rsync, ssh)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Rsync release assets to remote
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REMOTE_DIR="${REMOTE_ROOT}/${TAG_NAME}"
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
||||
echo "Rsync -> ${VPS_HOST}:${REMOTE_DIR}/"
|
||||
rsync -av -e "ssh -i ~/.ssh/id_rsa" \
|
||||
release-artifacts/amd64/pulumi-offline-package-amd64.tar.gz \
|
||||
release-artifacts/arm64/pulumi-offline-package-arm64.tar.gz \
|
||||
"${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
retention:
|
||||
name: Remote retention (keep latest 3)
|
||||
needs: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/pulumi
|
||||
steps:
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Prune old versions on remote (keep 3)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
|
||||
set -euo pipefail
|
||||
cd "'"${REMOTE_ROOT}"'" || exit 0
|
||||
keep=3
|
||||
mapfile -t all < <(ls -1 | grep -E "^(offline-pulumi-|v[0-9]+\.)" | sort -V -r || true)
|
||||
if [ "${#all[@]}" -le "$keep" ]; then
|
||||
echo "Nothing to prune. Count=${#all[@]}"
|
||||
exit 0
|
||||
fi
|
||||
to_delete=("${all[@]:keep}")
|
||||
echo "Pruning old versions: ${to_delete[*]}"
|
||||
for d in "${to_delete[@]}"; do
|
||||
rm -rf -- "$d"
|
||||
done
|
||||
'
|
||||
248
.github/workflows/offline-package-terraform-installer.yaml
vendored
Normal file
248
.github/workflows/offline-package-terraform-installer.yaml
vendored
Normal file
@ -0,0 +1,248 @@
|
||||
name: Build Offline Terraform Installer
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- '.github/workflows/offline-package-terraform-installer.yaml'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Release tag to use/sync (e.g., v1.8.5). Leave empty to use offline-terraform-<run_number>"
|
||||
required: false
|
||||
type: string
|
||||
terraform_version:
|
||||
description: "Override Terraform version (e.g., 1.8.5). Leave empty to auto-resolve"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: build-offline-terraform
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build-offline-installer:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
version: ${{ steps.resolve.outputs.version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install deps (curl, jq, unzip)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y curl jq unzip
|
||||
|
||||
- name: Resolve Terraform version
|
||||
id: resolve
|
||||
env:
|
||||
OVERRIDE_VERSION: ${{ github.event.inputs.terraform_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${OVERRIDE_VERSION}" ]; then
|
||||
VERSION="${OVERRIDE_VERSION}"
|
||||
else
|
||||
VERSION=$(curl -fsSL https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r '.current_version')
|
||||
fi
|
||||
echo "Resolved Terraform version: ${VERSION}"
|
||||
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Build offline Terraform package
|
||||
env:
|
||||
TERRAFORM_VERSION: ${{ steps.resolve.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ARCH="${{ matrix.arch }}"
|
||||
WORKDIR="terraform-offline-package"
|
||||
rm -rf "${WORKDIR}"
|
||||
mkdir -p "${WORKDIR}/"{bin,scripts,docs}
|
||||
|
||||
BASE_URL="https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}"
|
||||
ARCHIVE="terraform_${TERRAFORM_VERSION}_linux_${ARCH}.zip"
|
||||
echo "Downloading ${BASE_URL}/${ARCHIVE}"
|
||||
curl -fSL "${BASE_URL}/${ARCHIVE}" -o "${ARCHIVE}"
|
||||
|
||||
unzip -d "${WORKDIR}/bin" "${ARCHIVE}"
|
||||
rm -f "${ARCHIVE}"
|
||||
|
||||
echo "${TERRAFORM_VERSION}" > "${WORKDIR}/VERSION"
|
||||
|
||||
cat <<'SCRIPT' > "${WORKDIR}/scripts/install-terraform.sh"
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
BIN="${ROOT_DIR}/bin/terraform"
|
||||
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
|
||||
|
||||
usage() {
|
||||
cat <<USAGE
|
||||
Usage: $(basename "$0") [--install]
|
||||
--install Copy terraform binary into ${INSTALL_DIR}
|
||||
USAGE
|
||||
}
|
||||
|
||||
if [[ "${1:-}" == "--install" ]]; then
|
||||
sudo install -m 0755 "$BIN" "${INSTALL_DIR}/terraform"
|
||||
echo "Terraform installed to ${INSTALL_DIR}/terraform"
|
||||
else
|
||||
usage
|
||||
fi
|
||||
SCRIPT
|
||||
chmod +x "${WORKDIR}/scripts/install-terraform.sh"
|
||||
|
||||
tar -czf "terraform-offline-package-${ARCH}.tar.gz" "${WORKDIR}"
|
||||
ls -lh "terraform-offline-package-${ARCH}.tar.gz"
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: terraform-offline-package-${{ matrix.arch }}
|
||||
path: terraform-offline-package-${{ matrix.arch }}.tar.gz
|
||||
if-no-files-found: error
|
||||
|
||||
test-offline-installer:
|
||||
needs: build-offline-installer
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Download artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: terraform-offline-package-${{ matrix.arch }}
|
||||
path: ./test-dir
|
||||
|
||||
- name: Extract package
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd test-dir
|
||||
tar -xzvf terraform-offline-package-${{ matrix.arch }}.tar.gz
|
||||
|
||||
- name: Verify Terraform bundle
|
||||
env:
|
||||
TERRAFORM_VERSION: ${{ needs.build-offline-installer.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd test-dir/terraform-offline-package
|
||||
test -f VERSION
|
||||
if [ "${{ matrix.arch }}" = "amd64" ]; then
|
||||
./bin/terraform version
|
||||
./bin/terraform version | grep "Terraform v${TERRAFORM_VERSION}"
|
||||
else
|
||||
file ./bin/terraform | grep -E "ARM|aarch64"
|
||||
fi
|
||||
|
||||
publish-release:
|
||||
needs: test-offline-installer
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-terraform-{0}', github.run_number) }}
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/terraform
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Create GitHub Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
release_name: Build ${{ env.TAG_NAME }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Download amd64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: terraform-offline-package-amd64
|
||||
path: release-artifacts/amd64
|
||||
|
||||
- name: Download arm64 artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: terraform-offline-package-arm64
|
||||
path: release-artifacts/arm64
|
||||
|
||||
- name: Upload offline installers to GitHub Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ env.TAG_NAME }}
|
||||
files: |
|
||||
release-artifacts/amd64/terraform-offline-package-amd64.tar.gz
|
||||
release-artifacts/arm64/terraform-offline-package-arm64.tar.gz
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Ensure deps (rsync, ssh)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo apt-get update -y
|
||||
sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Rsync release assets to remote
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REMOTE_DIR="${REMOTE_ROOT}/${TAG_NAME}"
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
||||
echo "Rsync -> ${VPS_HOST}:${REMOTE_DIR}/"
|
||||
rsync -av -e "ssh -i ~/.ssh/id_rsa" \
|
||||
release-artifacts/amd64/terraform-offline-package-amd64.tar.gz \
|
||||
release-artifacts/arm64/terraform-offline-package-arm64.tar.gz \
|
||||
"${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
retention:
|
||||
name: Remote retention (keep latest 3)
|
||||
needs: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
|
||||
RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
REMOTE_ROOT: /data/update-server/terraform
|
||||
steps:
|
||||
- name: Init SSH
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
|
||||
|
||||
- name: Prune old versions on remote (keep 3)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
|
||||
set -euo pipefail
|
||||
cd "'"${REMOTE_ROOT}"'" || exit 0
|
||||
keep=3
|
||||
mapfile -t all < <(ls -1 | grep -E "^(offline-terraform-|v[0-9]+\.)" | sort -V -r || true)
|
||||
if [ "${#all[@]}" -le "$keep" ]; then
|
||||
echo "Nothing to prune. Count=${#all[@]}"
|
||||
exit 0
|
||||
fi
|
||||
to_delete=("${all[@]:keep}")
|
||||
echo "Pruning old versions: ${to_delete[*]}"
|
||||
for d in "${to_delete[@]}"; do
|
||||
rm -rf -- "$d"
|
||||
done
|
||||
'
|
||||
Loading…
Reference in New Issue
Block a user