v23.12.13: auto-block at 3 strikes, federation propagation, FORWARD-c… #558
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Release Binaries | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'Cargo.toml' | |
| - 'src/**' | |
| - '.github/workflows/release.yml' | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| strategy: | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-musl | |
| arch: x86_64 | |
| runner: ubuntu-latest | |
| - target: aarch64-unknown-linux-musl | |
| arch: aarch64 | |
| runner: ubuntu-latest | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Install cross | |
| run: cargo install cross --git https://github.com/cross-rs/cross | |
| - name: Pin libz-sys to working version | |
| run: | | |
| cargo update -p libz-sys --precise 1.1.25 | |
| - name: Build static binary | |
| run: cross build --release --target ${{ matrix.target }} | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Package binary | |
| run: | | |
| mkdir -p dist | |
| cp target/${{ matrix.target }}/release/wolfstack dist/wolfstack-${{ matrix.arch }} | |
| chmod +x dist/wolfstack-${{ matrix.arch }} | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: wolfstack-${{ matrix.arch }} | |
| path: dist/wolfstack-${{ matrix.arch }} | |
| release: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # gh release create | |
| id-token: write # cosign keyless OIDC + attest provenance | |
| attestations: write # actions/attest-build-provenance | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Need full history so we can extract the release commit body | |
| # for release notes, and regenerate CHANGELOG.md. | |
| fetch-depth: 0 | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Compute SHA-256 checksums | |
| run: | | |
| cd dist | |
| sha256sum wolfstack-x86_64 wolfstack-aarch64 > SHA256SUMS | |
| - name: Generate build-provenance attestation | |
| # Run BEFORE cosign signing so subject-path matches just the | |
| # binaries (not the .cosign.bundle files that signing produces). | |
| # Provenance covers both x86_64 and aarch64 in one attestation. | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-path: | | |
| dist/wolfstack-x86_64 | |
| dist/wolfstack-aarch64 | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| with: | |
| cosign-release: 'v2.4.1' | |
| - name: Sign binaries with cosign (keyless) | |
| # Keyless OIDC: no private key to manage. The signing identity | |
| # is the workflow itself, anchored to the GitHub Actions OIDC | |
| # token. Verifiers check the cert chain back to Sigstore's | |
| # Fulcio CA + Rekor transparency log. Verification command is | |
| # in the release notes. | |
| run: | | |
| cd dist | |
| for f in wolfstack-x86_64 wolfstack-aarch64; do | |
| cosign sign-blob --yes \ | |
| --bundle "${f}.cosign.bundle" \ | |
| "$f" | |
| done | |
| - name: Generate release notes from release-commit body | |
| id: notes | |
| run: | | |
| # Find the most recent release commit (subject starts "v<version>:") | |
| # — that's the commit being released. Its body is the release notes. | |
| # Fallback to a generic note if no v* commit found in last 50. | |
| BODY=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%b' || echo "") | |
| SUBJECT=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%s' || echo "Release") | |
| { | |
| echo "## $SUBJECT" | |
| echo | |
| if [ -n "$BODY" ]; then | |
| echo "$BODY" | |
| echo | |
| fi | |
| cat <<'EOF' | |
| --- | |
| ## Verifying this release | |
| Each binary is signed via [cosign](https://docs.sigstore.dev/) keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) attestation. | |
| **Verify the cosign signature:** | |
| ``` | |
| cosign verify-blob \ | |
| --bundle wolfstack-x86_64.cosign.bundle \ | |
| --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \ | |
| --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ | |
| wolfstack-x86_64 | |
| ``` | |
| **Verify the build provenance:** | |
| ``` | |
| gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack | |
| ``` | |
| **Verify the SHA-256 checksum:** | |
| ``` | |
| sha256sum -c SHA256SUMS | |
| ``` | |
| ## Artifacts | |
| - `wolfstack-x86_64` / `wolfstack-aarch64` — static musl binaries (Linux x86_64 and ARM64 / Raspberry Pi 4+). | |
| - `wolfstack-<arch>.cosign.bundle` — cosign signature bundle (cert + signature + Rekor entry). | |
| - `SHA256SUMS` — checksums for both binaries. | |
| For per-version history see [CHANGELOG.md](https://github.com/wolfsoftwaresystemsltd/WolfStack/blob/master/CHANGELOG.md). | |
| EOF | |
| } > release-notes.md | |
| - name: Create or update release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION="v${{ steps.version.outputs.version }}" | |
| # Delete existing release if it exists (update scenario) | |
| gh release delete "$VERSION" --yes 2>/dev/null || true | |
| git push --delete origin "$VERSION" 2>/dev/null || true | |
| # Drop local tag too — with fetch-depth: 0 the checkout pulls | |
| # all tags, so a stale local v* tag disagrees with the just- | |
| # deleted remote one. `gh release create` refuses in that | |
| # state ("tag exists locally but has not been pushed"). The | |
| # next step's `--target master` re-creates the tag fresh. | |
| git tag -d "$VERSION" 2>/dev/null || true | |
| # Create release with binaries, signatures, and checksums | |
| gh release create "$VERSION" \ | |
| --target master \ | |
| --title "WolfStack $VERSION" \ | |
| --notes-file release-notes.md \ | |
| dist/wolfstack-x86_64 \ | |
| dist/wolfstack-x86_64.cosign.bundle \ | |
| dist/wolfstack-aarch64 \ | |
| dist/wolfstack-aarch64.cosign.bundle \ | |
| dist/SHA256SUMS | |
| - name: Regenerate CHANGELOG.md and push back to master | |
| # Best-effort: CHANGELOG.md is regenerated from `git log` after | |
| # each release so the file always reflects the latest tagged | |
| # version. The workflow's path filter excludes CHANGELOG.md, so | |
| # this push doesn't re-trigger the workflow (no loop). | |
| # If push fails (branch protection, race) the release is still | |
| # cut — operator runs `scripts/gen-changelog.sh` locally and | |
| # commits manually. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| bash scripts/gen-changelog.sh CHANGELOG.md | |
| if git diff --quiet CHANGELOG.md; then | |
| echo "CHANGELOG.md already up to date" | |
| exit 0 | |
| fi | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| git add CHANGELOG.md | |
| git commit -m "chore: regenerate CHANGELOG.md for v${{ steps.version.outputs.version }}" | |
| git push origin master || { | |
| echo "::warning::Failed to push CHANGELOG.md update — release was cut, but the file is now stale. Run scripts/gen-changelog.sh locally and commit." >&2 | |
| exit 0 | |
| } |