58 lines
2.4 KiB
YAML
58 lines
2.4 KiB
YAML
name: Standalone registry checks
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
check:
|
|
# Register this label only on a disposable isolated runner. Never use an
|
|
# Argand production/host runner. Prerequisites are in docs/RELEASING.md.
|
|
runs-on: site-registry-isolated
|
|
timeout-minutes: 30
|
|
env:
|
|
REGISTRY_REPOSITORY_URL: ${{ forgejo.server_url }}/${{ forgejo.repository }}.git
|
|
REGISTRY_REVISION: ${{ forgejo.sha }}
|
|
CARGO_BUILD_JOBS: '2'
|
|
CARGO_TERM_COLOR: never
|
|
RUSTC_WRAPPER: ''
|
|
steps:
|
|
- name: Fetch the exact public source revision without credentials
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$REGISTRY_REVISION" =~ ^[0-9a-f]{40}$ ]]
|
|
mkdir checkout
|
|
cd checkout
|
|
git init --initial-branch=main
|
|
git remote add origin "$REGISTRY_REPOSITORY_URL"
|
|
git fetch --depth=1 origin "$REGISTRY_REVISION"
|
|
git checkout --detach FETCH_HEAD
|
|
test "$(git rev-parse HEAD)" = "$REGISTRY_REVISION"
|
|
- name: Fetch locked build dependencies and run offline acceptance
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd checkout
|
|
export CARGO_TARGET_DIR="$PWD/target"
|
|
export CARGO_BUILD_BUILD_DIR="$PWD/build"
|
|
cargo fetch --locked
|
|
bash scripts/check.sh
|
|
- name: Verify deterministic source packaging and rebuild the archive
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cd checkout
|
|
python3 scripts/source_release.py create --output ../source-release-a > ../release-a.json
|
|
python3 scripts/source_release.py create --output ../source-release-b > ../release-b.json
|
|
cmp ../source-release-a/source.tar.gz ../source-release-b/source.tar.gz
|
|
cmp ../source-release-a/RELEASE.json ../source-release-b/RELEASE.json
|
|
registry_pin="$(python3 -c 'import json; print(json.load(open("../release-a.json"))["pin"])')"
|
|
python3 scripts/source_release.py verify --release ../source-release-a --pin "$registry_pin"
|
|
mkdir ../unpacked
|
|
tar -xzf ../source-release-a/source.tar.gz -C ../unpacked
|
|
registry_prefix="$(python3 -c 'import json; print(json.load(open("../source-release-a/RELEASE.json"))["prefix"])')"
|
|
cd "../unpacked/$registry_prefix"
|
|
export CARGO_TARGET_DIR="$PWD/target"
|
|
export CARGO_BUILD_BUILD_DIR="$PWD/build"
|
|
bash scripts/check.sh
|