From c08d5d647236d3b097436dc99701aa07380d2b5c Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Fri, 8 May 2026 13:31:46 +0800 Subject: [PATCH] fix: deploy native bridge binary --- .github/workflows/pipeline.yml | 25 ++++++ .../github-actions/deploy-native-binary.sh | 80 +++++++++++++++++++ 2 files changed, 105 insertions(+) create mode 100755 scripts/github-actions/deploy-native-binary.sh diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index d34480e..33980de 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -100,6 +100,7 @@ jobs: SERVICE_IMAGE_NAME: xworkmate-bridge outputs: artifact_name: ${{ steps.artifact_meta.outputs.artifact_name }} + binary_artifact_name: ${{ steps.binary_artifact_meta.outputs.binary_artifact_name }} service_image_ref: ${{ steps.service_ref.outputs.image_ref }} steps: - name: Checkout @@ -136,6 +137,9 @@ jobs: BUILD_DATE=${{ github.event.head_commit.timestamp || github.event.repository.pushed_at }} BUILD_VERSION=v1.0-beta2 + - name: Build native linux service binary + run: bash ./scripts/github-actions/build-artifact.sh dist/native-binary + - name: Write image ref artifact run: | set -euo pipefail @@ -146,12 +150,22 @@ jobs: id: artifact_meta run: bash ./scripts/github-actions/resolve-artifact-name.sh + - name: Record native binary artifact metadata + id: binary_artifact_meta + run: printf 'binary_artifact_name=xworkmate-bridge-linux-amd64-%s\n' "${GITHUB_SHA}" >> "$GITHUB_OUTPUT" + - name: Upload image ref artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ steps.artifact_meta.outputs.artifact_name }} path: dist/service-image-ref.txt + - name: Upload native linux service binary + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: ${{ steps.binary_artifact_meta.outputs.binary_artifact_name }} + path: dist/native-binary/xworkmate-bridge + deploy: name: Deploy needs: build @@ -182,6 +196,12 @@ jobs: name: ${{ needs.build.outputs.artifact_name }} path: xworkmate-bridge/dist/image-artifact + - name: Download native linux service binary + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + with: + name: ${{ needs.build.outputs.binary_artifact_name }} + path: xworkmate-bridge/dist/native-binary + - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: @@ -217,6 +237,11 @@ jobs: SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }} run: bash ./scripts/github-actions/prepare-ssh.sh "${{ steps.deploy_meta.outputs.target_host }}" "${SSH_KNOWN_HOSTS}" + - name: Install native bridge binary on target + if: ${{ steps.deploy_meta.outputs.run_apply == 'true' }} + working-directory: xworkmate-bridge + run: bash ./scripts/github-actions/deploy-native-binary.sh "${{ steps.deploy_meta.outputs.target_host }}" "dist/native-binary/xworkmate-bridge" "$(git rev-parse --short HEAD)" + - name: Run Ansible deploy playbook working-directory: playbooks env: diff --git a/scripts/github-actions/deploy-native-binary.sh b/scripts/github-actions/deploy-native-binary.sh new file mode 100755 index 0000000..706ad12 --- /dev/null +++ b/scripts/github-actions/deploy-native-binary.sh @@ -0,0 +1,80 @@ +#!/usr/bin/env bash +set -euo pipefail + +TARGET_HOST="${1:?target host is required}" +BINARY_PATH="${2:?binary path is required}" +EXPECTED_COMMIT="${3:?expected short commit is required}" +REMOTE_TMP="/tmp/xworkmate-bridge-${EXPECTED_COMMIT}" +REMOTE_BINARY="/usr/local/bin/xworkmate-go-core" +STALE_DROPIN="/etc/systemd/system/xworkmate-bridge.service.d/10-hotfix-openclaw-artifacts.conf" +SERVICE_NAME="xworkmate-bridge.service" + +if [[ ! "${TARGET_HOST}" =~ ^[A-Za-z0-9._-]+$ ]]; then + echo "invalid target host: ${TARGET_HOST}" >&2 + exit 1 +fi + +if [[ ! "${EXPECTED_COMMIT}" =~ ^[0-9a-f]{7,40}$ ]]; then + echo "invalid expected commit: ${EXPECTED_COMMIT}" >&2 + exit 1 +fi + +if [[ ! -f "${BINARY_PATH}" ]]; then + echo "native bridge binary not found: ${BINARY_PATH}" >&2 + exit 1 +fi + +chmod +x "${BINARY_PATH}" +scp -q "${BINARY_PATH}" "root@${TARGET_HOST}:${REMOTE_TMP}" + +ssh "root@${TARGET_HOST}" "EXPECTED_COMMIT='${EXPECTED_COMMIT}' REMOTE_TMP='${REMOTE_TMP}' REMOTE_BINARY='${REMOTE_BINARY}' STALE_DROPIN='${STALE_DROPIN}' SERVICE_NAME='${SERVICE_NAME}' bash -s" <<'REMOTE' +set -euo pipefail + +had_immutable=0 +restore_immutable() { + if [[ "${had_immutable}" == "1" ]] && command -v chattr >/dev/null 2>&1 && [[ -e "${REMOTE_BINARY}" ]]; then + chattr +i "${REMOTE_BINARY}" 2>/dev/null || true + fi +} +trap restore_immutable EXIT + +if command -v lsattr >/dev/null 2>&1 && [[ -e "${REMOTE_BINARY}" ]]; then + attrs="$(lsattr "${REMOTE_BINARY}" 2>/dev/null || true)" + if [[ "${attrs}" == *i* ]]; then + had_immutable=1 + chattr -i "${REMOTE_BINARY}" + fi +fi + +install -o root -g root -m 0755 "${REMOTE_TMP}" "${REMOTE_BINARY}" + +restore_immutable + +rm -f "${STALE_DROPIN}" +rmdir --ignore-fail-on-non-empty "$(dirname "${STALE_DROPIN}")" 2>/dev/null || true + +version_json="$("${REMOTE_BINARY}" version)" +actual_commit="$(VERSION_JSON="${version_json}" python3 - <<'PY' +import json +import os +payload = json.loads(os.environ["VERSION_JSON"]) +print(str(payload.get("commit", ""))) +PY +)" +if [[ "${actual_commit}" != "${EXPECTED_COMMIT}" ]]; then + echo "deployed binary commit mismatch: expected ${EXPECTED_COMMIT}, got ${actual_commit}" >&2 + exit 1 +fi + +systemctl daemon-reload +systemctl restart "${SERVICE_NAME}" +pid="$(systemctl show -p MainPID --value "${SERVICE_NAME}")" +if [[ -z "${pid}" || "${pid}" == "0" ]]; then + echo "${SERVICE_NAME} did not start" >&2 + exit 1 +fi +if [[ "$(readlink -f "/proc/${pid}/exe")" != "${REMOTE_BINARY}" ]]; then + echo "${SERVICE_NAME} is not running ${REMOTE_BINARY}" >&2 + exit 1 +fi +REMOTE