Skip to content

Release

Release #169

Workflow file for this run

---
name: "Release"
on:
push:
tags:
- "v[0-9]+.[0-9]+.[0-9]+*"
jobs:
goreleaser:
name: "Build and release packages via GoReleaser"
runs-on: ubuntu-24.04
permissions:
id-token: write # For cosign
packages: write # For GHCR
contents: read # Not required for public repositories, but for clarity
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # ratchet:docker/setup-qemu-action@v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # ratchet:docker/setup-buildx-action@v4.0.0
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v5
with:
go-version-file: "go.mod"
- name: Install Cosign
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # ratchet:sigstore/cosign-installer@v4.1.1
with:
cosign-release: "v2.6.1"
- name: Import GPG key
id: gpg
run: |
echo "${GPG_PRIVATE_KEY}" | gpg --import --passphrase "${GPG_PASSPHRASE}" --batch --allow-secret-key-import
GPG_KEY_FILE=/tmp/signing-key.gpg
echo "${GPG_PRIVATE_KEY}" > "${GPG_KEY_FILE}"
echo "GPG_KEY_FILE=${GPG_KEY_FILE}" >> "${GITHUB_ENV}"
env:
GPG_TTY: /dev/ttys000 # Set the GPG_TTY to avoid issues with pinentry
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
- name: Setup snapcraft
run: |
sudo snap install snapcraft --classic --channel=7.x/stable
# See https://github.com/goreleaser/goreleaser/issues/1715
mkdir -p "$HOME/.cache/snapcraft/download"
mkdir -p "$HOME/.cache/snapcraft/stage-packages"
env:
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_TOKEN }}
- name: Prepare goreleaser file
run: |
set -x
TAG=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
yq eval-all '. as $item ireduce ({}; . * $item)' .goreleaser.yml .goreleaser_release_only.yml > .goreleaser_ci.yml
else
cp .goreleaser.yml .goreleaser_ci.yml
fi
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8
with:
distribution: goreleaser-pro
version: "~> v2"
args: release --clean -f .goreleaser_ci.yml
env:
AUR_KEY: ${{ secrets.AUR_KEY }}
DISABLE_CHANGELOG: ${{ vars.DISABLE_CHANGELOG}}
GITHUB_TOKEN: ${{ secrets.TENV_GITHUB_TOKEN }}
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_TOKEN }}
GPG_KEY_FILE: ${{ steps.gpg.outputs.GPG_KEY_FILE }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
CLOUDSMITH_TOKEN: ${{ secrets.CLOUDSMITH_TOKEN }}
TOFUUTILS_PR_TOKEN: ${{ secrets.TOFUUTILS_PR_TOKEN }}
- name: Login to GitHub Container Registry
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # ratchet:docker/login-action@v4.1.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Push docker image to GitHub Container Registry
env:
docker_registry: "ghcr.io"
run: |
version=${GITHUB_REF#refs/*/v}
IFS='.' read -ra version_arr <<< "${version}"
architectures=("amd64" "arm64" "arm" "386")
versions=("latest" "${version_arr[0]}.${version_arr[1]}" "${version}")
for version in "${versions[@]}"; do
manifest="${docker_registry}/tofuutils/tenv:${version}"
images=""
for arch in "${architectures[@]}"; do
image="${docker_registry}/tofuutils/tenv:${version}-${arch}"
echo "Pushing image ${image} ..."
docker push ${image}
if [ ${?} -ne 0 ]; then
echo "Failed to push image ${image}"
exit 1
fi
images="${image} ${images}"
done
docker manifest create "${manifest}" ${images}
docker manifest push "${manifest}"
done
echo "All images and manifests pushed successfully to ${docker_registry}!"
- name: Login to GitHub Container Registry
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # ratchet:docker/login-action@v4.1.0
with:
registry: registry.hub.docker.com
username: ${{ secrets.REGISTRY_USER }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Push docker image to DockerHub
env:
docker_registry: "registry.hub.docker.com"
run: |
version=${GITHUB_REF#refs/*/v}
IFS='.' read -ra version_arr <<< "${version}"
architectures=("amd64" "arm64" "arm" "386")
versions=("latest" "${version_arr[0]}.${version_arr[1]}" "${version}")
for version in "${versions[@]}"; do
manifest="${docker_registry}/tofuutils/tenv:${version}"
images=""
for arch in "${architectures[@]}"; do
image="${docker_registry}/tofuutils/tenv:${version}-${arch}"
echo "Pushing image ${image} ..."
docker push ${image}
if [ ${?} -ne 0 ]; then
echo "Failed to push image ${image}"
exit 1
fi
images="${image} ${images}"
done
docker manifest create "${manifest}" ${images}
docker manifest push "${manifest}"
done
echo "All images and manifests pushed successfully to ${docker_registry}!"
publish-chocolatey:
name: "Publish Chocolatey package"
runs-on: ubuntu-24.04
needs:
- goreleaser
steps:
- name: "Checkout tofuutils/chocolatey-packages"
uses: actions/checkout@v6.0.2
with:
repository: tofuutils/chocolatey-packages
ssh-key: ${{ secrets.CHOCOLATEY_SSH_KEY }}
- name: Update chocolatey checksums
run: |
release_tag=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
release_version="${release_tag#v}"
echo "[INFO] Download release's checksums"
curl \
-SsL \
-o /tmp/checksums.txt \
https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_checksums.txt
echo "[INFO] Update chocolateyinstall.ps1"
choco_url="https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Windows_i386.zip"
choco_url64="https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Windows_x86_64.zip"
choco_sum="$(grep "tenv_${release_tag}_Windows_i386.zip" /tmp/checksums.txt | cut -d ' ' -f 1 | tr -d '\n')"
choco_sum64="$(grep "tenv_${release_tag}_Windows_x86_64.zip" /tmp/checksums.txt | cut -d ' ' -f 1 | tr -d '\n')"
rm /tmp/checksums.txt
sed -i "s~\$url = '.*'~\$url = '${choco_url}'~g" tenv/tools/chocolateyinstall.ps1
sed -i "s~\$url64 = '.*'~\$url64 = '${choco_url64}'~g" tenv/tools/chocolateyinstall.ps1
sed -i "s~\$checksum = '.*'~\$checksum = '${choco_sum}'~g" tenv/tools/chocolateyinstall.ps1
sed -i "s~\$checksum64 = '.*'~\$checksum64 = '${choco_sum64}'~g" tenv/tools/chocolateyinstall.ps1
echo "[INFO] Push changes back to git"
git config user.name tofuutils
git config user.email tofuutils@github.com
git add -A
git commit -m "Chocolatey scripts update for tenv version ${release_tag}"
git tag -a ${release_version} -m "${release_version}"
git push origin --tags main
publish-ppa:
name: "Publish PPA package"
runs-on: ubuntu-24.04
needs:
- goreleaser
steps:
- name: Download tenv tarballs
run: |
release_tag=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
release_version="${release_tag#v}"
mkdir -p ${{ github.workspace }}/tenv-tarball
echo "[INFO] Download release's tarballs"
curl \
-SsL \
-o ${{ github.workspace }}/tenv-tarball/tenv_${release_tag}_Linux_x86_64.tar.gz \
https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Linux_x86_64.tar.gz
- name: Publish PPA
uses: yuezk/publish-ppa-package@aef2cd26952551ca7d7f7ed15d75d067364cfa45 # ratchet:yuezk/publish-ppa-package@v2
with:
repository: "kvendingoldo/tenv"
gpg_private_key: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
gpg_passphrase: ${{ secrets.PPA_GPG_PASSPHRASE }}
tarball: ${{ github.workspace }}/tenv-tarball/tenv*.tar.gz
deb_email: "kvendingoldo@gmail.com"
deb_fullname: "tenv"