mixeme
bd61fd9c23
Pin compose and local trial to ghcr.io/mixeme/selfpost:1.0.0, close the CHANGELOG cut, and retire implementation-plan / v1.x-closure-plan. Includes the post-cut startup fixes needed for a green release e2e gate: root-owned TLS copies for postfix check, maillog_file_prefixes for /data, hostname gate and traversable /data, panel /healthz before setup, and setup-token / TempDir reclaim via docker exec. Co-Authored-By: Composer <noreply@cursor.com> Co-authored-by: Cursor <cursoragent@cursor.com>
105 lines
3.5 KiB
YAML
105 lines
3.5 KiB
YAML
name: release
|
|
|
|
# Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
|
|
# Ordinary commits do not publish anything — only a pushed tag matching
|
|
# vX.Y.Z does. That tag is the single source the version comes from: it goes
|
|
# into both the image tag and the panel binary's -ldflags version, so the two
|
|
# can never drift apart (the invariant restore's version check in spec 7.5.A
|
|
# depends on).
|
|
#
|
|
# Native per-architecture builds (see docs/development.md), not qemu:
|
|
# running the full Postfix/OpenDKIM stack under emulation for the e2e gate
|
|
# below is impractically slow. Each arch builds, e2e-gates and pushes its own
|
|
# tag on its own native runner; a merge job then combines them into the one
|
|
# manifest tag documented in deploy/docker-compose.yml. "test, then push" (not
|
|
# push-by-digest then test) is deliberate: it means the bytes that get tagged
|
|
# are exactly the bytes that passed e2e, at the cost of per-arch tags lingering
|
|
# in the registry as a side effect (harmless — the version tag's immutability,
|
|
# spec 10.1, is about that tag, not these).
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v[0-9]+.[0-9]+.[0-9]+"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
prepare:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
steps:
|
|
- name: Derive version from tag
|
|
id: version
|
|
run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
needs: prepare
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: ubuntu-latest
|
|
arch: amd64
|
|
- runner: ubuntu-24.04-arm
|
|
arch: arm64
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build image (native, loaded locally for the e2e gate)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: build/Dockerfile
|
|
load: true
|
|
provenance: false
|
|
build-args: |
|
|
VERSION=${{ needs.prepare.outputs.version }}
|
|
tags: selfpost:e2e
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26"
|
|
cache-dependency-path: test/e2e/go.sum
|
|
|
|
- name: e2e (gates publishing — see docs/development.md)
|
|
run: cd test/e2e && go test -v -timeout 20m ./...
|
|
|
|
- name: Log in to ghcr.io
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Push per-arch tag
|
|
run: |
|
|
docker tag selfpost:e2e "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
|
|
docker push "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
|
|
|
|
merge:
|
|
needs: [prepare, build]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Log in to ghcr.io
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Merge per-arch tags into the version manifest
|
|
run: |
|
|
docker buildx imagetools create \
|
|
-t "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}" \
|
|
"ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64" \
|
|
"ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"
|