release.yaml

name: Release
on:
  push:
    tags:
      - '*'
jobs:
  packages:
    strategy:
      matrix:
        os: [ubuntu-24.04]
        arch: ["", "-arm"]
    runs-on: ${{ matrix.os }}${{ matrix.arch }}
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: build
        env:
          RPM_GPG_KEY: ${{ secrets.RPM_GPG_KEY }}
        run: |
          set -e
          echo "building: {{github.ref_name}}-$(uname -i)"
          printf "%s" "$RPM_GPG_KEY" | base64 -d > /tmp/rpm.priv
          docker build --secret "id=gpg,src=/tmp/rpm.priv" -t t examples/rpms
          rm -f /tmp/rpm.priv
          docker run -i --rm -v /tmp:/tmp t /bin/bash -c 'cp -a /usr/share/nginx/html/packages /tmp'
      - name: Archive artifacts
        uses: actions/upload-artifact@v4
        with:
          name: packages${{ matrix.arch }}
          retention-days: 1
          path: |
            /tmp/packages
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    needs: packages
    permissions:
      id-token: write
      contents: write
      pages: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Download archived artifact
        uses: actions/download-artifact@v4
        with:
          name: packages
          path: /tmp/packages
      - name: Download archived artifact
        uses: actions/download-artifact@v4
        with:
          name: packages-arm
          path: /tmp/packages
      - name: Log in to the Container registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build-state-image
        run: |
          set -e
          sudo apt-get update
          sudo apt-get install -y rsync
          # Fetch previously released packages
          mkdir -p /tmp/oldpackages
          docker run -i --rm -v /tmp:/tmp ghcr.io/spiffe/spire-examples/pages:latest /bin/bash -c 'cp -a /usr/share/nginx/html/RPMS /tmp/oldpackages/ && cp -a /usr/share/nginx/html/DEBS /tmp/oldpackages/'
          # Copy only packages that don't overwrite a previously released package. This prevents rereleasing a package.
          rsync --ignore-existing -rv /tmp/packages/ /tmp/oldpackages/
          rm -rf /tmp/packages
          sudo mv /tmp/oldpackages /tmp/packages
          # Update repos
          docker build -f examples/rpms/Dockerfile.repos -t ghcr.io/spiffe/spire-examples/pages:latest /tmp/packages
          sudo rm -rf /tmp/packages
          mkdir -p /tmp/packages
          docker run -i --rm -v /tmp:/tmp ghcr.io/spiffe/spire-examples/pages:latest /bin/bash -c 'cp -a /usr/share/nginx/html/RPMS /tmp/packages/ && cp -a /usr/share/nginx/html/DEBS /tmp/packages/'
          # Save a copy of packages/pages for next release
          docker push ghcr.io/spiffe/spire-examples/pages:latest
      - name: Release Files
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${GITHUB_REF#refs/tags/}" examples/rpms/rpm.pub /tmp/packages/*/*/*.rpm /tmp/packages/*/*/*.deb
      - name: Setup Pages
        uses: actions/configure-pages@v5
      - name: Upload Artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: /tmp/packages
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4