Merge pull request #18 from basecubedev/feature/linux-static-compat-b… #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ "v*" ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| # Normal Linux amd64: latest stable toolchain, static pure-Go build. | |
| - goos: linux | |
| goarch: amd64 | |
| go-version: stable | |
| name: paping-go-linux-amd64 | |
| static-linux: true | |
| goamd64: v1 | |
| # Legacy Linux amd64: built with Go 1.23.x for very old distros/kernels. | |
| - goos: linux | |
| goarch: amd64 | |
| go-version: "1.23.x" | |
| name: paping-go-linux-amd64-legacy | |
| static-linux: true | |
| goamd64: v1 | |
| # Linux arm64: latest stable toolchain, static pure-Go build. | |
| - goos: linux | |
| goarch: arm64 | |
| go-version: stable | |
| name: paping-go-linux-arm64 | |
| static-linux: true | |
| - goos: windows | |
| goarch: amd64 | |
| go-version: stable | |
| name: paping-go-windows-amd64.exe | |
| - goos: darwin | |
| goarch: amd64 | |
| go-version: stable | |
| name: paping-go-darwin-amd64 | |
| - goos: darwin | |
| goarch: arm64 | |
| go-version: stable | |
| name: paping-go-darwin-arm64 | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ matrix.go-version }} | |
| check-latest: true | |
| - name: Build | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| STATIC_LINUX: ${{ matrix.static-linux }} | |
| GOAMD64_LEVEL: ${{ matrix.goamd64 }} | |
| ARTIFACT: ${{ matrix.name }} | |
| VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || format('dev-{0}', github.sha) }} | |
| run: | | |
| set -euo pipefail | |
| if [ "${STATIC_LINUX:-}" = "true" ]; then | |
| # Static pure-Go Linux build: no cgo, no GLIBC dependency. | |
| export CGO_ENABLED=0 | |
| if [ -n "${GOAMD64_LEVEL:-}" ]; then | |
| export GOAMD64="${GOAMD64_LEVEL}" | |
| fi | |
| go build \ | |
| -trimpath \ | |
| -tags "netgo osusergo" \ | |
| -ldflags "-s -w -buildid= -X main.version=${VERSION}" \ | |
| -o "${ARTIFACT}" \ | |
| ./cmd/paping-go | |
| else | |
| go build -ldflags "-X main.version=${VERSION}" -o "${ARTIFACT}" ./cmd/paping-go | |
| fi | |
| - name: Verify static Linux binary | |
| if: matrix.static-linux == true | |
| env: | |
| ARTIFACT: ${{ matrix.name }} | |
| run: | | |
| set -euo pipefail | |
| verify_static() { | |
| artifact="$1" | |
| echo "== Verifying ${artifact} ==" | |
| file "${artifact}" | |
| ldd "${artifact}" 2>&1 | tee /tmp/ldd-output.txt || true | |
| if grep -qE 'libc\.so|=>' /tmp/ldd-output.txt; then | |
| echo "ERROR: ${artifact} has dynamic runtime libc dependencies" >&2 | |
| return 1 | |
| fi | |
| if ! grep -q 'not a dynamic executable' /tmp/ldd-output.txt; then | |
| echo "ERROR: ${artifact} is not reported as a static executable" >&2 | |
| return 1 | |
| fi | |
| readelf --version-info "${artifact}" > /tmp/readelf-version-info.txt 2>/dev/null || true | |
| if grep -q 'GLIBC_' /tmp/readelf-version-info.txt; then | |
| echo "ERROR: ${artifact} requires GLIBC version symbols" >&2 | |
| return 1 | |
| fi | |
| echo "OK: ${artifact} is statically linked and GLIBC-independent" | |
| } | |
| verify_static "${ARTIFACT}" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ matrix.name }} | |
| path: ${{ matrix.name }} | |
| release: | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: stable | |
| check-latest: true | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Install nFPM | |
| run: | | |
| go install github.com/goreleaser/nfpm/v2/cmd/nfpm@latest | |
| echo "$HOME/go/bin" >> "$GITHUB_PATH" | |
| - name: Build Debian packages | |
| env: | |
| RELEASE_VERSION: ${{ github.ref_name }} | |
| run: | | |
| VERSION="${RELEASE_VERSION#v}" | |
| NFPM_VERSION="$VERSION" \ | |
| NFPM_ARCH=amd64 \ | |
| NFPM_BINARY=./dist/paping-go-linux-amd64 \ | |
| nfpm package \ | |
| --config packaging/nfpm.yaml \ | |
| --packager deb \ | |
| --target "dist/paping-go_${VERSION}_amd64.deb" | |
| NFPM_VERSION="$VERSION" \ | |
| NFPM_ARCH=arm64 \ | |
| NFPM_BINARY=./dist/paping-go-linux-arm64 \ | |
| nfpm package \ | |
| --config packaging/nfpm.yaml \ | |
| --packager deb \ | |
| --target "dist/paping-go_${VERSION}_arm64.deb" | |
| - name: Verify Debian package structure | |
| run: | | |
| set -euo pipefail | |
| test -f "dist/paping-go_${GITHUB_REF_NAME#v}_amd64.deb" | |
| test -f "dist/paping-go_${GITHUB_REF_NAME#v}_arm64.deb" | |
| for pkg in dist/paping-go_*.deb; do | |
| echo "Inspecting $pkg" | |
| contents_file="$(mktemp)" | |
| dpkg-deb --info "$pkg" | |
| dpkg-deb --contents "$pkg" | tee "$contents_file" | |
| grep -E '/usr/bin/paping-go$' "$contents_file" | |
| grep -E '/usr/share/doc/paping-go/README.md$' "$contents_file" | |
| grep -E '/usr/share/doc/paping-go/LICENSE$' "$contents_file" | |
| done | |
| - name: Install amd64 Debian package smoke test | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y ./dist/paping-go_${GITHUB_REF_NAME#v}_amd64.deb | |
| command -v paping-go | |
| paping-go --version | |
| paping-go --help >/dev/null | |
| sudo apt-get remove -y paping-go | |
| - name: Generate checksums | |
| working-directory: dist | |
| run: sha256sum paping-go-* *.deb > SHA256SUMS | |
| - name: Create release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: dist/* | |
| - name: Trigger basecubedev APT repository update | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ secrets.APT_REPO_WORKFLOW_TOKEN }} | |
| TAG_NAME: ${{ github.ref_name }} | |
| run: | | |
| gh workflow run update-apt.yml \ | |
| --repo basecubedev/basecubedev-apt \ | |
| --ref main \ | |
| -f source_repo=basecubedev/paping-go \ | |
| -f tag="$TAG_NAME" \ | |
| -f package=paping-go |