saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Create workflow for each of the supported repositories

Browse source 
Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
This commit is contained in:
Pedro Algarvio 2023-10-06 10:06:47 +01:00 • committed by Pedro Algarvio
parent efe18b6f12
commit efadd88601
10 changed files with 525 additions and 1298 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

94
.github/workflows/templates/build-deb-repo.yml.jinja → .github/workflows/build-deb-repo.yml vendored
View file

@ -1,24 +1,78 @@
---
name: Build DEB Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
generate-matrix:
name: DEB (matrix)
runs-on:
- self-hosted
- linux
- x86_64
outputs:
repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
- name: Checkout Source Code
uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Generate Package Repo Matrix
id: generate-pkg-repo-matrix
run: |
tools ci pkg-repo-matrix deb
build-deb-repo:
name: DEB
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
needs:
- generate-matrix
strategy:
fail-fast: false
matrix:
include:
<%- for distro, version, arch in (
("debian", "10", "x86_64"),
("debian", "10", "aarch64"),
("debian", "11", "x86_64"),
("debian", "11", "aarch64"),
("ubuntu", "20.04", "x86_64"),
("ubuntu", "20.04", "aarch64"),
("ubuntu", "22.04", "x86_64"),
("ubuntu", "22.04", "aarch64"),
) %>
- distro: <{ distro }>
version: "<{ version }>"
arch: <{ arch }>
<%- endfor %>
include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
- uses: actions/checkout@v4
- name: Download System Dependencies
@ -38,7 +92,7 @@
- name: Download DEB Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-deb
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -76,15 +130,15 @@
- name: Create Repository
run: |
tools pkg repo create deb --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create deb --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error

56
.github/workflows/templates/build-macos-repo.yml.jinja → .github/workflows/build-macos-repo.yml vendored
View file

@ -1,5 +1,52 @@
---
name: Build DEB Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
build-repo:
name: MacOS
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
strategy:
fail-fast: false
matrix:
pkg-type:
- macos
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
@ -14,7 +61,7 @@
- name: Download macOS x86_64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
name: salt-${{ inputs.salt-version }}-x86_64-macos
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -52,15 +99,14 @@
- name: Create Repository
run: |
tools pkg repo create macos --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create macos --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: macos-repo

67
.github/workflows/templates/build-onedir-repo.yml.jinja → .github/workflows/build-onedir-repo.yml vendored
View file

@ -1,5 +1,52 @@
---
name: Build Onedir Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
build-repo:
name: Onedir
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
strategy:
fail-fast: false
matrix:
pkg-type:
- onedir
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
@ -14,43 +61,43 @@
- name: Download Linux x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
name: salt-${{ inputs.salt-version }}-onedir-linux-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Linux aarch64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
name: salt-${{ inputs.salt-version }}-onedir-linux-aarch64.tar.xz
path: artifacts/pkgs/incoming
- name: Download macOS x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
name: salt-${{ inputs.salt-version }}-onedir-darwin-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.zip
path: artifacts/pkgs/incoming
- name: Download Windows x86 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
name: salt-${{ inputs.salt-version }}-onedir-windows-x86.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
name: salt-${{ inputs.salt-version }}-onedir-windows-x86.zip
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -88,14 +135,14 @@
- name: Create Repository
run: |
tools pkg repo create onedir --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create onedir --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error

99
.github/workflows/templates/build-rpm-repo.yml.jinja → .github/workflows/build-rpm-repo.yml vendored
View file

@ -1,32 +1,71 @@
---
name: Build RPM Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
generate-matrix:
name: RPM (matrix)
runs-on:
- self-hosted
- linux
- x86_64
outputs:
repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
- name: Checkout Source Code
uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Generate Package Repo Matrix
id: generate-pkg-repo-matrix
run: |
tools ci pkg-repo-matrix rpm
build-repo:
name: RPM
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
needs:
- generate-matrix
strategy:
fail-fast: false
matrix:
include:
<%- for distro, version, arch in (
("amazon", "2", "x86_64"),
("amazon", "2", "aarch64"),
("redhat", "7", "x86_64"),
("redhat", "7", "aarch64"),
("redhat", "8", "x86_64"),
("redhat", "8", "aarch64"),
("redhat", "9", "x86_64"),
("redhat", "9", "aarch64"),
("fedora", "36", "x86_64"),
("fedora", "36", "aarch64"),
("fedora", "37", "x86_64"),
("fedora", "37", "aarch64"),
("fedora", "38", "x86_64"),
("fedora", "38", "aarch64"),
("photon", "3", "x86_64"),
("photon", "3", "aarch64"),
("photon", "4", "x86_64"),
("photon", "4", "aarch64"),
) %>
- distro: <{ distro }>
version: "<{ version }>"
arch: <{ arch }>
<%- endfor %>
include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
steps:
- uses: actions/checkout@v4
@ -48,7 +87,7 @@
- name: Download RPM Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-rpm
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -86,22 +125,20 @@
- name: Create Repository
env:
<%- if gh_environment == 'staging' %>
SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
<%- endif %>
SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
run: |
tools pkg repo create rpm --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create rpm --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error

61
.github/workflows/templates/build-src-repo.yml.jinja → .github/workflows/build-src-repo.yml vendored
View file

@ -1,5 +1,52 @@
---
name: Build Source Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
build-repo:
name: Source
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
strategy:
fail-fast: false
matrix:
pkg-type:
- onedir
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
@ -14,7 +61,7 @@
- name: Download Source Tarball
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
name: salt-${{ inputs.salt-version }}.tar.gz
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -52,8 +99,8 @@
- name: Create Repository
run: |
tools pkg repo create src --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create src --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Copy Files For Source Only Artifact Uploads
@ -64,10 +111,10 @@
- name: Upload Standalone Repository As An Artifact
uses: actions/upload-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-src-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-src-repo
path: |
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
artifacts/src/salt-${{ inputs.salt-version }}.tar.gz
artifacts/src/salt-${{ inputs.salt-version }}.tar.gz.*
artifacts/src/*-GPG-*
retention-days: 7
if-no-files-found: error
@ -75,7 +122,7 @@
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error

61
.github/workflows/templates/build-windows-repo.yml.jinja → .github/workflows/build-windows-repo.yml vendored
View file

@ -1,5 +1,52 @@
---
name: Build Windows Repository
on:
workflow_call:
inputs:
environment:
type: string
required: true
description: The environment to run against
gpg_key_id:
type: string
required: true
description: The GPG key ID to use
salt-version:
type: string
required: true
description: The Salt version of the packages to install and test
env:
RELENV_DATA: "${{ github.workspace }}/.relenv"
COLUMNS: 190
AWS_MAX_ATTEMPTS: "10"
AWS_RETRY_MODE: "adaptive"
PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
PIP_EXTRA_INDEX_URL: https://pypi.org/simple
jobs:
build-repo:
name: Windows
environment: ${{ inputs.environment }}
runs-on:
- self-hosted
- linux
- repo-${{ inputs.environment }}
strategy:
fail-fast: false
matrix:
pkg-type:
- windows
steps:
- name: "Throttle Builds"
shell: bash
run: |
t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
@ -14,25 +61,25 @@
- name: Download Windows NSIS x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
name: salt-${{ inputs.salt-version }}-x86-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
name: salt-${{ inputs.salt-version }}-x86-MSI
path: artifacts/pkgs/incoming
- name: Download Windows NSIS amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
name: salt-${{ inputs.salt-version }}-amd64-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
name: salt-${{ inputs.salt-version }}-amd64-MSI
path: artifacts/pkgs/incoming
- name: Setup GnuPG
@ -70,14 +117,14 @@
- name: Create Repository
run: |
tools pkg repo create windows --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
tools pkg repo create windows --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
--salt-version=${{ inputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error

642
.github/workflows/nightly.yml vendored
View file

@ -2314,634 +2314,78 @@ jobs:
if-no-files-found: error
build-src-repo:
name: Build Source Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Source Tarball
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create src --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Copy Files For Source Only Artifact Uploads
run: |
mkdir artifacts/src
find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
- name: Upload Standalone Repository As An Artifact
uses: actions/upload-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-src-repo
path: |
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
artifacts/src/*-GPG-*
retention-days: 7
if-no-files-found: error
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: src-repo
- build-source-tarball
uses: ./.github/workflows/build-src-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-deb-repo:
name: Build DEB Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
- build-deb-pkgs-onedir
strategy:
fail-fast: false
matrix:
include:
- distro: debian
version: "10"
arch: x86_64
- distro: debian
version: "10"
arch: aarch64
- distro: debian
version: "11"
arch: x86_64
- distro: debian
version: "11"
arch: aarch64
- distro: ubuntu
version: "20.04"
arch: x86_64
- distro: ubuntu
version: "20.04"
arch: aarch64
- distro: ubuntu
version: "22.04"
arch: x86_64
- distro: ubuntu
version: "22.04"
arch: aarch64
steps:
- uses: actions/checkout@v4
- name: Download System Dependencies
run: |
sudo apt update
sudo apt install -y devscripts apt-utils
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download DEB Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
uses: ./.github/workflows/build-deb-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-rpm-repo:
name: Build RPM Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
- build-rpm-pkgs-onedir
strategy:
fail-fast: false
matrix:
include:
- distro: amazon
version: "2"
arch: x86_64
- distro: amazon
version: "2"
arch: aarch64
- distro: redhat
version: "7"
arch: x86_64
- distro: redhat
version: "7"
arch: aarch64
- distro: redhat
version: "8"
arch: x86_64
- distro: redhat
version: "8"
arch: aarch64
- distro: redhat
version: "9"
arch: x86_64
- distro: redhat
version: "9"
arch: aarch64
- distro: fedora
version: "36"
arch: x86_64
- distro: fedora
version: "36"
arch: aarch64
- distro: fedora
version: "37"
arch: x86_64
- distro: fedora
version: "37"
arch: aarch64
- distro: fedora
version: "38"
arch: x86_64
- distro: fedora
version: "38"
arch: aarch64
- distro: photon
version: "3"
arch: x86_64
- distro: photon
version: "3"
arch: aarch64
- distro: photon
version: "4"
arch: x86_64
- distro: photon
version: "4"
arch: aarch64
steps:
- uses: actions/checkout@v4
- name: Download System Dependencies
run: |
sudo apt update
sudo apt install -y rpm
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download RPM Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
env:
SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
run: |
tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
uses: ./.github/workflows/build-rpm-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-windows-repo:
name: Build Windows Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
- build-windows-pkgs-onedir
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Windows NSIS x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
path: artifacts/pkgs/incoming
- name: Download Windows NSIS amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create windows --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: windows-repo
uses: ./.github/workflows/build-windows-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-macos-repo:
name: Build macOS Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
- build-macos-pkgs-onedir
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download macOS x86_64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create macos --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: macos-repo
uses: ./.github/workflows/build-macos-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-onedir-repo:
name: Build Onedir Repository
environment: nightly
runs-on:
- self-hosted
- linux
- repo-nightly
name: Build Repository
needs:
- prepare-workflow
- build-salt-onedir-linux
- build-salt-onedir-macos
- build-salt-onedir-windows
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Linux x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Linux aarch64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
path: artifacts/pkgs/incoming
- name: Download macOS x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
path: artifacts/pkgs/incoming
- name: Download Windows x86 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create onedir --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: onedir-repo
uses: ./.github/workflows/build-onedir-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: nightly
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
publish-repositories:
name: Publish Repositories

644
.github/workflows/staging.yml vendored
View file

@ -2170,636 +2170,78 @@ jobs:
skip-junit-reports: true
build-src-repo:
name: Build Source Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Source Tarball
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create src --key-id=64CBBC8173D76B3F \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Copy Files For Source Only Artifact Uploads
run: |
mkdir artifacts/src
find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
- name: Upload Standalone Repository As An Artifact
uses: actions/upload-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-src-repo
path: |
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
artifacts/src/*-GPG-*
retention-days: 7
if-no-files-found: error
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: src-repo
- build-source-tarball
uses: ./.github/workflows/build-src-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-deb-repo:
name: Build DEB Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
- build-deb-pkgs-onedir
strategy:
fail-fast: false
matrix:
include:
- distro: debian
version: "10"
arch: x86_64
- distro: debian
version: "10"
arch: aarch64
- distro: debian
version: "11"
arch: x86_64
- distro: debian
version: "11"
arch: aarch64
- distro: ubuntu
version: "20.04"
arch: x86_64
- distro: ubuntu
version: "20.04"
arch: aarch64
- distro: ubuntu
version: "22.04"
arch: x86_64
- distro: ubuntu
version: "22.04"
arch: aarch64
steps:
- uses: actions/checkout@v4
- name: Download System Dependencies
run: |
sudo apt update
sudo apt install -y devscripts apt-utils
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download DEB Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
uses: ./.github/workflows/build-deb-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-rpm-repo:
name: Build RPM Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
- build-rpm-pkgs-onedir
strategy:
fail-fast: false
matrix:
include:
- distro: amazon
version: "2"
arch: x86_64
- distro: amazon
version: "2"
arch: aarch64
- distro: redhat
version: "7"
arch: x86_64
- distro: redhat
version: "7"
arch: aarch64
- distro: redhat
version: "8"
arch: x86_64
- distro: redhat
version: "8"
arch: aarch64
- distro: redhat
version: "9"
arch: x86_64
- distro: redhat
version: "9"
arch: aarch64
- distro: fedora
version: "36"
arch: x86_64
- distro: fedora
version: "36"
arch: aarch64
- distro: fedora
version: "37"
arch: x86_64
- distro: fedora
version: "37"
arch: aarch64
- distro: fedora
version: "38"
arch: x86_64
- distro: fedora
version: "38"
arch: aarch64
- distro: photon
version: "3"
arch: x86_64
- distro: photon
version: "3"
arch: aarch64
- distro: photon
version: "4"
arch: x86_64
- distro: photon
version: "4"
arch: aarch64
steps:
- uses: actions/checkout@v4
- name: Download System Dependencies
run: |
sudo apt update
sudo apt install -y rpm
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download RPM Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
env:
SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
run: |
tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
uses: ./.github/workflows/build-rpm-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-windows-repo:
name: Build Windows Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
- build-windows-pkgs-onedir
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Windows NSIS x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI x86 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
path: artifacts/pkgs/incoming
- name: Download Windows NSIS amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
path: artifacts/pkgs/incoming
- name: Download Windows MSI amd64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create windows --key-id=64CBBC8173D76B3F \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: windows-repo
uses: ./.github/workflows/build-windows-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-macos-repo:
name: Build macOS Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
- build-macos-pkgs-onedir
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download macOS x86_64 Packages
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create macos --key-id=64CBBC8173D76B3F \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: macos-repo
uses: ./.github/workflows/build-macos-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
build-onedir-repo:
name: Build Onedir Repository
environment: staging
runs-on:
- self-hosted
- linux
- repo-staging
name: Build Repository
needs:
- prepare-workflow
- build-salt-onedir-linux
- build-salt-onedir-macos
- build-salt-onedir-windows
steps:
- uses: actions/checkout@v4
- name: Setup Python Tools Scripts
uses: ./.github/actions/setup-python-tools-scripts
- name: Get Salt Project GitHub Actions Bot Environment
run: |
TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
- name: Download Linux x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Linux aarch64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
path: artifacts/pkgs/incoming
- name: Download macOS x86_64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
path: artifacts/pkgs/incoming
- name: Download Windows x86 Onedir Archive
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
path: artifacts/pkgs/incoming
- name: Download Windows amd64 Onedir Archive(zip)
uses: actions/download-artifact@v3
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
path: artifacts/pkgs/incoming
- name: Setup GnuPG
run: |
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
GNUPGHOME="$(mktemp -d -p /run/gpg)"
echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
cat <<EOF > "${GNUPGHOME}/gpg.conf"
batch
no-tty
pinentry-mode loopback
EOF
- name: Get Secrets
env:
SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
run: |
SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text | jq .default_key -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
| gpg --import -
sync
aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
--query SecretString --output text| jq .default_passphrase -r | base64 -d \
| gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
sync
rm "$SECRETS_KEY_FILE"
echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
- name: Create Repository Path
run: |
mkdir -p artifacts/pkgs/repo
- name: Create Repository
run: |
tools pkg repo create onedir --key-id=64CBBC8173D76B3F \
--salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
--incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
- name: Upload Repository As An Artifact
uses: ./.github/actions/upload-artifact
with:
name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
path: artifacts/pkgs/repo/*
retention-days: 7
if-no-files-found: error
archive-name: onedir-repo
uses: ./.github/workflows/build-onedir-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: staging
gpg_key_id: 64CBBC8173D76B3F
secrets: inherit
publish-repositories:
name: Publish Repositories

36
.github/workflows/templates/build-repos.yml.jinja vendored
View file

@ -1,33 +1,33 @@
<%- for platform, type, display_name, needs_pkg in (
(None, "src", "Source", False),
("linux", "deb", "DEB", True),
("linux", "rpm", "RPM", True),
("windows", "windows", "Windows", True),
("macos", "macos", "macOS", True),
(None, "onedir", "Onedir", False),
) %>
<%- for type, display_name in (
("src", "Source"),
("deb", "DEB"),
("rpm", "RPM"),
("windows", "Windows"),
("macos", "macOS"),
("onedir", "Onedir"),
) %>
<%- set job_name = "build-{}-repo".format(type) %>
<%- do build_repo_needs.append(job_name) %>
<{ job_name }>:
name: Build <{ display_name }> Repository
environment: <{ gh_environment }>
runs-on:
- self-hosted
- linux
- repo-<{ gh_environment }>
name: Build Repository
needs:
- prepare-workflow
<%- if needs_pkg %>
<%- if type not in ("src", "onedir") %>
- build-<{ type }>-pkgs-onedir
<%- elif platform %>
- build-salt-onedir-<{ platform }>
<%- elif type == 'onedir' %>
- build-salt-onedir-linux
- build-salt-onedir-macos
- build-salt-onedir-windows
<%- elif type == 'src' %>
- build-source-tarball
<%- endif %>
<%- include "build-{}-repo.yml.jinja".format(type) %>
uses: ./.github/workflows/build-<{ type }>-repo.yml
with:
salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
environment: <{ gh_environment }>
gpg_key_id: <{ gpg_key_id }>
secrets: inherit
<%- endfor %>

63
tools/ci.py
View file

@ -777,6 +777,69 @@ def pkg_matrix(
ctx.exit(0)
@ci.command(
name="pkg-repo-matrix",
arguments={
"pkg_type": {
"help": "The package type",
},
},
)
def pkg_repo_matrix(ctx: Context, pkg_type: str):
"""
Generate the matrix for the package repository builds
"""
_matrix = []
if pkg_type == "deb":
for distro in ("debian", "ubuntu"):
if distro == "debian":
versions = ["10", "11"]
else:
versions = ["20.04", "22.04"]
for arch in ("x86_64", "aarch64"):
for version in versions:
_matrix.append(
{
"distro": distro,
"version": version,
"arch": arch,
}
)
elif pkg_type == "rpm":
for distro in ("amazon", "redhat", "fedora", "photon"):
if distro == "amazon":
versions = ["2"]
elif distro == "redhat":
versions = ["7", "8", "9"]
elif distro == "fedora":
versions = ["36", "37", "38"]
elif distro == "photon":
versions = ["3", "4"]
else:
ctx.error(f"Don't know how to handle distro {distro}")
ctx.exit(1)
for arch in ("x86_64", "aarch64"):
for version in versions:
_matrix.append(
{
"distro": distro,
"version": version,
"arch": arch,
}
)
else:
_matrix.append({"pkg_type": pkg_type})
ctx.info("Generated matrix:")
ctx.print(_matrix, soft_wrap=True)
github_output = os.environ.get("GITHUB_OUTPUT")
if github_output is not None:
with open(github_output, "a", encoding="utf-8") as wfh:
wfh.write(f"matrix={json.dumps(_matrix)}\n")
ctx.exit(0)
@ci.command(
name="get-releases",
arguments={