v0.4.13: resolve relative includes against the config root, like nginx #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Release Binaries | |
| # Mirrors the pattern used by the WolfStack repo: every push to main | |
| # that touches the crate or the workflow itself rebuilds static musl | |
| # binaries for x86_64 and aarch64, signs them via cosign keyless OIDC, | |
| # and creates / updates the GitHub release tagged after the version in | |
| # Cargo.toml. | |
| # | |
| # setup.sh then downloads the matching binary instead of cargo-building | |
| # on the operator's box, which removes the rustup-toolchain / build- | |
| # deps surface as a failure mode. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'Cargo.toml' | |
| - 'src/**' | |
| - '.github/workflows/release.yml' | |
| workflow_dispatch: | |
| jobs: | |
| # Hard gate: clippy with warnings-as-errors + the test suite must pass | |
| # before any release binary is built. Keeps the tree clippy-clean (the | |
| # wolfstack repo enforces the same bar). Fix at root — no bare #[allow]. | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - name: Clippy (warnings = errors) | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Tests | |
| run: cargo test --all-targets | |
| build: | |
| needs: lint | |
| strategy: | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-musl | |
| arch: x86_64 | |
| runner: ubuntu-latest | |
| - target: aarch64-unknown-linux-musl | |
| arch: aarch64 | |
| runner: ubuntu-latest | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Install cross | |
| run: cargo install cross --git https://github.com/cross-rs/cross | |
| - name: Build static binary | |
| run: cross build --release --target ${{ matrix.target }} | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Package binary | |
| run: | | |
| mkdir -p dist | |
| cp target/${{ matrix.target }}/release/wolfproxy dist/wolfproxy-${{ matrix.arch }} | |
| chmod +x dist/wolfproxy-${{ matrix.arch }} | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: wolfproxy-${{ matrix.arch }} | |
| path: dist/wolfproxy-${{ matrix.arch }} | |
| release: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # gh release create | |
| id-token: write # cosign keyless OIDC + attest provenance | |
| attestations: write # actions/attest-build-provenance | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Get version | |
| id: version | |
| run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT" | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Compute SHA-256 checksums | |
| run: | | |
| cd dist | |
| sha256sum wolfproxy-x86_64 wolfproxy-aarch64 > SHA256SUMS | |
| - name: Generate build-provenance attestation | |
| uses: actions/attest-build-provenance@v3 | |
| with: | |
| subject-path: | | |
| dist/wolfproxy-x86_64 | |
| dist/wolfproxy-aarch64 | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| with: | |
| cosign-release: 'v2.4.1' | |
| - name: Sign binaries with cosign (keyless) | |
| # Keyless OIDC — signing identity is this workflow, anchored | |
| # to the GitHub Actions OIDC token. Verifiers walk the cert | |
| # chain back to Sigstore's Fulcio CA + Rekor transparency log. | |
| run: | | |
| cd dist | |
| for f in wolfproxy-x86_64 wolfproxy-aarch64; do | |
| cosign sign-blob --yes \ | |
| --bundle "${f}.cosign.bundle" \ | |
| "$f" | |
| done | |
| - name: Generate release notes from release-commit body | |
| id: notes | |
| run: | | |
| BODY=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%b' || echo "") | |
| SUBJECT=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%s' || echo "Release") | |
| { | |
| echo "## $SUBJECT" | |
| echo | |
| if [ -n "$BODY" ]; then | |
| echo "$BODY" | |
| echo | |
| fi | |
| cat <<'EOF' | |
| --- | |
| ## Verifying this release | |
| Each binary is signed via [cosign](https://docs.sigstore.dev/) keyless OIDC and ships with a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) attestation. | |
| **Verify the cosign signature:** | |
| ``` | |
| cosign verify-blob \ | |
| --bundle wolfproxy-x86_64.cosign.bundle \ | |
| --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \ | |
| --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ | |
| wolfproxy-x86_64 | |
| ``` | |
| **Verify the build provenance:** | |
| ``` | |
| gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy | |
| ``` | |
| **Verify the SHA-256 checksum:** | |
| ``` | |
| sha256sum -c SHA256SUMS | |
| ``` | |
| ## Artifacts | |
| - `wolfproxy-x86_64` / `wolfproxy-aarch64` — static musl binaries (Linux x86_64 and ARM64). | |
| - `wolfproxy-<arch>.cosign.bundle` — cosign signature bundle (cert + signature + Rekor entry). | |
| - `SHA256SUMS` — checksums for both binaries. | |
| EOF | |
| } > release-notes.md | |
| - name: Create or update release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION="v${{ steps.version.outputs.version }}" | |
| gh release delete "$VERSION" --yes 2>/dev/null || true | |
| git push --delete origin "$VERSION" 2>/dev/null || true | |
| git tag -d "$VERSION" 2>/dev/null || true | |
| gh release create "$VERSION" \ | |
| --target main \ | |
| --title "WolfProxy $VERSION" \ | |
| --notes-file release-notes.md \ | |
| dist/wolfproxy-x86_64 \ | |
| dist/wolfproxy-x86_64.cosign.bundle \ | |
| dist/wolfproxy-aarch64 \ | |
| dist/wolfproxy-aarch64.cosign.bundle \ | |
| dist/SHA256SUMS |