Files
NeoTachyon/.github/workflows/build.yml
T
Dushnilin 603c0df91b feat(security,ci,ui): harden CI/CD, LuCI ACL, low-space updates and mobile layout
- ci: make frontend CI read-only with strict diff check and deterministic calls.json
- ci: pin external GitHub Actions in workflows to immutable commit SHAs
- ci: add openwrt-e2e blocking gate job running docker_e2e_test.sh
- fix(diagnostic): fix contstants.ts typo and update all 13 import sites
- fix(acl): remove unused /bin/busybox exec from rpcd ACL and add regression test
- feat(updates): add low-space update fallback when creating sing-box.old is impossible
- fix(routes): preserve dedicated Discord gateway subnets (162.159.128.0/21)
- feat(ui): implement responsive auto-fit grid and mobile modal viewport bounds
- test: add viewport regression test suite in vitest
2026-09-14 23:00:18 +03:00

149 lines
5.4 KiB
YAML

name: Build packages
on:
push:
tags:
- "*"
workflow_dispatch:
inputs:
release_tag:
description: Release tag to build and publish
required: true
type: string
release_notes:
description: Optional release notes/comment
required: false
type: string
permissions:
contents: write
jobs:
preparation:
name: Setup build version
runs-on: ubuntu-latest
outputs:
version: ${{ steps.version.outputs.version }}
commitish: ${{ steps.version.outputs.commitish }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- id: version
shell: bash
run: |
INPUT_VERSION="${{ inputs.release_tag || '' }}"
if [ -n "$INPUT_VERSION" ]; then
VERSION="$INPUT_VERSION"
else
VERSION=$(git describe --tags --exact-match 2>/dev/null || true)
fi
VERSION="${VERSION#v}"
if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Release version must use x.y.z format, got: ${VERSION:-<empty>}" >&2
exit 1
fi
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "commitish=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
build:
name: Build Tachyon release packages
runs-on: ubuntu-latest
needs: preparation
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- name: Build release artifacts
shell: bash
run: |
VERSION="${{ needs.preparation.outputs.version }}"
bash ./build.sh "$VERSION" "$PWD/filtered-bin/release"
ls -la "$PWD/filtered-bin/release"
- name: Upload build artifacts
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
with:
name: release-files-${{ needs.preparation.outputs.version }}
path: ./filtered-bin/release/*
retention-days: 1
if-no-files-found: error
release:
name: Create Release
runs-on: ubuntu-latest
needs:
- preparation
- build
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Create release dir
run: mkdir -p ./filtered-bin/release
- name: Download release artifacts
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
with:
name: release-files-${{ needs.preparation.outputs.version }}
path: ./filtered-bin/release
- name: Prepare release notes
id: prepare_notes
shell: bash
env:
GH_TOKEN: ${{ github.token }}
TAG_NAME: ${{ github.event_name == 'push' && github.ref_name || needs.preparation.outputs.version }}
COMMIT_SHA: ${{ needs.preparation.outputs.commitish }}
WORKFLOW_NOTES: ${{ github.event_name == 'workflow_dispatch' && inputs.release_notes || '' }}
run: |
EXISTING_BODY=""
if gh release view "$TAG_NAME" >/dev/null 2>&1; then
EXISTING_BODY="$(gh release view "$TAG_NAME" --json body -q .body 2>/dev/null || true)"
fi
TRIMMED="$(printf '%s' "$EXISTING_BODY" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
if [ -n "$TRIMMED" ] && ! printf '%s\n' "$TRIMMED" | grep -Eq '^Commit:[[:space:]]*[0-9a-fA-F]+$'; then
echo "Existing release notes found for $TAG_NAME. Preserving them."
printf '%s\n' "$EXISTING_BODY" > ./release_notes.md
echo "generate_notes=false" >> "$GITHUB_OUTPUT"
elif [ -n "$WORKFLOW_NOTES" ]; then
echo "Using workflow_dispatch release notes."
printf 'Commit: %s\n\n%s\n' "$COMMIT_SHA" "$WORKFLOW_NOTES" > ./release_notes.md
echo "generate_notes=false" >> "$GITHUB_OUTPUT"
else
echo "No existing release notes found. Using commit placeholder."
printf 'Commit: %s\n' "$COMMIT_SHA" > ./release_notes.md
echo "generate_notes=true" >> "$GITHUB_OUTPUT"
fi
- name: Release on tag push
if: ${{ github.event_name == 'push' }}
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
with:
files: ./filtered-bin/release/*
tag_name: ${{ github.ref_name }}
name: ${{ github.ref_name }}
target_commitish: ${{ needs.preparation.outputs.commitish }}
generate_release_notes: ${{ steps.prepare_notes.outputs.generate_notes == 'true' }}
draft: false
prerelease: false
make_latest: true
overwrite_files: true
body_path: ./release_notes.md
- name: Release on workflow dispatch
if: ${{ github.event_name == 'workflow_dispatch' }}
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
with:
files: ./filtered-bin/release/*
tag_name: ${{ needs.preparation.outputs.version }}
name: ${{ needs.preparation.outputs.version }}
target_commitish: ${{ needs.preparation.outputs.commitish }}
generate_release_notes: ${{ steps.prepare_notes.outputs.generate_notes == 'true' }}
draft: false
prerelease: false
make_latest: true
overwrite_files: true
body_path: ./release_notes.md