Merge beta: v25.3.2 — wolfdisk UI cluster-scan caching + UniFi creden… #955
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Release Binaries | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' # a lock-only version sync must still trigger a build, or `cargo check --locked` fails on the next real change | |
| - 'src/**' | |
| - '.github/workflows/release.yml' | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| strategy: | |
| # Don't cancel the other arch if one fails — we want partial | |
| # builds (e.g. x86_64 succeeds, aarch64 hits a transient GHCR | |
| # flake) to still produce artifacts we can release manually. | |
| # Without this, the v23.12.15 build had x86_64 marked as | |
| # "cancelled" because aarch64 timed out fetching the cross-rs | |
| # docker image. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # image_digest pins the cross-rs build container by content digest. | |
| # cross built from git always defaults to the mutable ":main" tag | |
| # (cross src/docker/shared.rs DEFAULT_IMAGE_VERSION), so without | |
| # this pin the toolchain container could change under us between | |
| # releases. To bump: docker manifest inspect ghcr.io/cross-rs/<target>:main | |
| - target: x86_64-unknown-linux-musl | |
| arch: x86_64 | |
| runner: ubuntu-latest | |
| image_digest: sha256:f084277a81b3cdf05526f6cb2756b8d2a185e18f7f74a7aa90df9ee4b79855e2 | |
| - target: aarch64-unknown-linux-musl | |
| arch: aarch64 | |
| runner: ubuntu-latest | |
| image_digest: sha256:d4eea544818d42a15c090b2102b03c1a63a282505c9ab4b6bb7abb76b028a706 | |
| runs-on: ${{ matrix.runner }} | |
| # Bound the wall-clock so a stuck network call doesn't hold a | |
| # runner for the full 6-hour GitHub default. | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Install Rust | |
| # SHA-pinned to master per the action's README: when the toolchain | |
| # is passed as an explicit input (instead of encoded in the @rev), | |
| # the pinned rev should be master. | |
| uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master | |
| with: | |
| toolchain: stable | |
| targets: ${{ matrix.target }} | |
| - name: Warnings are errors | |
| # Operator rule (2026-06-11): a compiler warning fails the release. | |
| # Runs natively on the runner (fast, no cross/env-passthrough | |
| # dependency) BEFORE the slow cross builds, so a warning fails in | |
| # ~2 minutes instead of 20. | |
| env: | |
| RUSTFLAGS: "-D warnings" | |
| # --locked: build the exact committed Cargo.lock, never re-resolve to | |
| # "latest compatible". A float drifted `time` onto a version that broke | |
| # `cookie` 0.16.2 on rustc 1.96 and failed the v24.39.0 release. | |
| run: cargo check --locked | |
| - name: Install cross | |
| # Pinned to an exact commit (last crates.io release v0.2.5 is from | |
| # 2023, so git install is required). --locked builds cross with its | |
| # own committed Cargo.lock — the whole cross toolchain is now | |
| # deterministic instead of tracking cross-rs HEAD on every release. | |
| run: cargo install cross --git https://github.com/cross-rs/cross --rev 64b5bb4d3d34de062552b9a2093affe77b4ad16a --locked | |
| - name: Pin libz-sys to working version | |
| run: | | |
| cargo update -p libz-sys --precise 1.1.25 | |
| - name: Pre-pull cross-rs docker image with retries | |
| # `cross build` pulls the build image on first invocation. GHCR's | |
| # token endpoint occasionally times out and the build dies with | |
| # exit 125 (docker auth failure). Pull explicitly with 5 retries + | |
| # exponential-ish backoff so a transient outage doesn't fail the | |
| # whole release. Pulled by digest (see matrix.image_digest) so the | |
| # build container is immutable. | |
| run: | | |
| IMAGE="ghcr.io/cross-rs/${{ matrix.target }}@${{ matrix.image_digest }}" | |
| for attempt in 1 2 3 4 5; do | |
| echo "::group::Pull attempt $attempt for $IMAGE" | |
| if docker pull "$IMAGE"; then | |
| echo "::endgroup::" | |
| echo "✓ pulled $IMAGE on attempt $attempt" | |
| exit 0 | |
| fi | |
| echo "::endgroup::" | |
| wait=$((attempt * 15)) | |
| echo "::warning::pull attempt $attempt failed, sleeping ${wait}s before retry" | |
| sleep $wait | |
| done | |
| echo "::error::Failed to pull $IMAGE after 5 attempts. GHCR may be having an outage; re-run this job (gh run rerun --failed)." | |
| exit 1 | |
| - name: Build static binary | |
| # CROSS_TARGET_<TRIPLE>_IMAGE overrides cross's default mutable | |
| # ":main" image with the digest-pinned one we just pulled (cross | |
| # src/docker/image.rs ImageReference: a full name is used verbatim; | |
| # env-var naming per cross src/config.rs build_var_name() = triple | |
| # uppercased with - replaced by _). | |
| run: | | |
| VAR="CROSS_TARGET_$(echo '${{ matrix.target }}' | tr '[:lower:]-' '[:upper:]_')_IMAGE" | |
| export "$VAR=ghcr.io/cross-rs/${{ matrix.target }}@${{ matrix.image_digest }}" | |
| cross build --release --target ${{ matrix.target }} | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Package binary | |
| run: | | |
| mkdir -p dist | |
| cp target/${{ matrix.target }}/release/wolfstack dist/wolfstack-${{ matrix.arch }} | |
| chmod +x dist/wolfstack-${{ matrix.arch }} | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: wolfstack-${{ matrix.arch }} | |
| path: dist/wolfstack-${{ matrix.arch }} | |
| release: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # gh release create | |
| id-token: write # cosign keyless OIDC + attest provenance | |
| attestations: write # actions/attest-build-provenance | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| with: | |
| # Need full history so we can extract the release commit body | |
| # for release notes, and regenerate CHANGELOG.md. | |
| fetch-depth: 0 | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Compute SHA-256 checksums | |
| run: | | |
| cd dist | |
| sha256sum wolfstack-x86_64 wolfstack-aarch64 > SHA256SUMS | |
| - name: Generate build-provenance attestation | |
| # Run BEFORE cosign signing so subject-path matches just the | |
| # binaries (not the .cosign.bundle files that signing produces). | |
| # Provenance covers both x86_64 and aarch64 in one attestation. | |
| uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 | |
| with: | |
| subject-path: | | |
| dist/wolfstack-x86_64 | |
| dist/wolfstack-aarch64 | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3 | |
| with: | |
| cosign-release: 'v2.4.1' | |
| - name: Sign binaries with cosign (keyless) | |
| # Keyless OIDC: no private key to manage. The signing identity | |
| # is the workflow itself, anchored to the GitHub Actions OIDC | |
| # token. Verifiers check the cert chain back to Sigstore's | |
| # Fulcio CA + Rekor transparency log. Verification command is | |
| # in the release notes. | |
| run: | | |
| cd dist | |
| for f in wolfstack-x86_64 wolfstack-aarch64; do | |
| cosign sign-blob --yes \ | |
| --bundle "${f}.cosign.bundle" \ | |
| "$f" | |
| done | |
| - name: Generate release notes from release-commit body | |
| id: notes | |
| run: | | |
| # Find the most recent release commit (subject starts "v<version>:") | |
| # — that's the commit being released. Its body is the release notes. | |
| # Fallback to a generic note if no v* commit found in last 50. | |
| BODY=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%b' || echo "") | |
| SUBJECT=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%s' || echo "Release") | |
| { | |
| echo "## $SUBJECT" | |
| echo | |
| if [ -n "$BODY" ]; then | |
| echo "$BODY" | |
| echo | |
| fi | |
| cat <<'EOF' | |
| --- | |
| ## Verifying this release | |
| Each binary is signed via [cosign](https://docs.sigstore.dev/) keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) attestation. | |
| **Verify the cosign signature:** | |
| ``` | |
| cosign verify-blob \ | |
| --bundle wolfstack-x86_64.cosign.bundle \ | |
| --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \ | |
| --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ | |
| wolfstack-x86_64 | |
| ``` | |
| **Verify the build provenance:** | |
| ``` | |
| gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack | |
| ``` | |
| **Verify the SHA-256 checksum:** | |
| ``` | |
| sha256sum -c SHA256SUMS | |
| ``` | |
| ## Artifacts | |
| - `wolfstack-x86_64` / `wolfstack-aarch64` — static musl binaries (Linux x86_64 and ARM64 / Raspberry Pi 4+). | |
| - `wolfstack-<arch>.cosign.bundle` — cosign signature bundle (cert + signature + Rekor entry). | |
| - `SHA256SUMS` — checksums for both binaries. | |
| For per-version history see [CHANGELOG.md](https://github.com/wolfsoftwaresystemsltd/WolfStack/blob/master/CHANGELOG.md). | |
| EOF | |
| } > release-notes.md | |
| - name: Create or update release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION="v${{ steps.version.outputs.version }}" | |
| # Delete existing release if it exists (update scenario) | |
| gh release delete "$VERSION" --yes 2>/dev/null || true | |
| git push --delete origin "$VERSION" 2>/dev/null || true | |
| # Drop local tag too — with fetch-depth: 0 the checkout pulls | |
| # all tags, so a stale local v* tag disagrees with the just- | |
| # deleted remote one. `gh release create` refuses in that | |
| # state ("tag exists locally but has not been pushed"). The | |
| # next step's `--target master` re-creates the tag fresh. | |
| git tag -d "$VERSION" 2>/dev/null || true | |
| # Create release with binaries, signatures, and checksums | |
| gh release create "$VERSION" \ | |
| --target master \ | |
| --title "WolfStack $VERSION" \ | |
| --notes-file release-notes.md \ | |
| dist/wolfstack-x86_64 \ | |
| dist/wolfstack-x86_64.cosign.bundle \ | |
| dist/wolfstack-aarch64 \ | |
| dist/wolfstack-aarch64.cosign.bundle \ | |
| dist/SHA256SUMS | |
| - name: Regenerate CHANGELOG.md and push back to master | |
| # Best-effort: CHANGELOG.md is regenerated from `git log` after | |
| # each release so the file always reflects the latest tagged | |
| # version. The workflow's path filter excludes CHANGELOG.md, so | |
| # this push doesn't re-trigger the workflow (no loop). | |
| # If push fails (branch protection, race) the release is still | |
| # cut — operator runs `scripts/gen-changelog.sh` locally and | |
| # commits manually. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| bash scripts/gen-changelog.sh CHANGELOG.md | |
| if git diff --quiet CHANGELOG.md; then | |
| echo "CHANGELOG.md already up to date" | |
| exit 0 | |
| fi | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| git add CHANGELOG.md | |
| git commit -m "chore: regenerate CHANGELOG.md for v${{ steps.version.outputs.version }}" | |
| git push origin master || { | |
| echo "::warning::Failed to push CHANGELOG.md update — release was cut, but the file is now stale. Run scripts/gen-changelog.sh locally and commit." >&2 | |
| exit 0 | |
| } |