Skip to content

Fix virgin tea not syncing its pantry #547

Fix virgin tea not syncing its pantry

Fix virgin tea not syncing its pantry #547

Workflow file for this run

name: CD
on:
push:
branches:
- main
paths:
- README.md
workflow_dispatch:
concurrency:
group: distribute
cancel-in-progress: true
jobs:
check:
permissions:
actions: write # for cancel-action
runs-on: ubuntu-latest
outputs:
version: ${{ steps.tea.outputs.version }}
steps:
- uses: actions/checkout@v3
- uses: teaxyz/setup@v0
id: tea
- name: sanity check
run: |
test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f1 -d.)"
test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f2 -d.)"
test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f3 -d.)"
- id: rev-parse
name: did we already publish this version?
run: |
# fetch tags since actions/checkout is a shallow checkout
git fetch --prune --unshallow --tags
if git show-ref --tags v${{ steps.tea.outputs.version }} --quiet; then
echo "result=cancel" >> $GITHUB_OUTPUT
else
echo "result=commence" >> $GITHUB_OUTPUT
fi
- uses: andymckay/[email protected]
if: ${{ steps.rev-parse.outputs.result == 'cancel' }}
qa:
# run tests on all our runners since we’ve had issues in the past where
# subtle differences weren’t caught and pantry builds started failing :/
needs: [check]
runs-on: ${{ matrix.os }}
strategy:
matrix:
os:
- [self-hosted, macOS, ARM64]
- [self-hosted, linux, ARM64]
- [self-hosted, macOS, X64]
- [self-hosted, linux, X64]
steps:
- uses: actions/checkout@v3
- uses: teaxyz/setup@v0
- run: deno task test
# we compile here so we can attach binaries to the release itself
# we do this because people expect that, and will be confused otherwise
# and we want people to be able to just grab the single binaries as
# they wish
compile:
needs: [qa, check, bundle-src]
permissions:
contents: read
actions: write
strategy:
matrix:
platform:
- os: macos-latest
build-id: darwin+x86-64
- os: ubuntu-latest
build-id: linux+x86-64
- os: [self-hosted, macOS, ARM64]
build-id: darwin+aarch64
- os: [self-hosted, linux, ARM64]
build-id: linux+aarch64
runs-on: ${{ matrix.platform.os }}
name: ${{ matrix.platform.build-id }}
steps:
- uses: actions/download-artifact@v3
with:
name: srcs
- run: tar xJf tea-${{ needs.check.outputs.version }}.tar.xz --strip-components=1
- uses: teaxyz/cli/.github/actions/cache@v0 # avoids sporadic 500s from deno’s CDN
- uses: teaxyz/setup@v0
- run: deno task compile
- uses: teaxyz/brewkit/actions/setup-codesign@v0
if: startsWith(matrix.platform.build-id, 'darwin+')
with:
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
# codesign always fails for deno binaries, even though it
# signs fine. See https://github.com/denoland/deno/issues/575
- run: codesign --sign "$APPLE_IDENTITY" --force --preserve-metadata=entitlements,requirements,flags,runtime ./tea || true
env:
APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}
- name: sanity check
run: test "$(./tea --version)" = "tea ${{ needs.check.outputs.version }}"
- run: tar cJf tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz tea
- name: GPG sign archive
run: |
tea gpg-agent --daemon || true
echo $GPG_PRIVATE_KEY | \
base64 -d | \
tea gpg --import --batch --yes
tea gpg \
--detach-sign --armor \
--local-user $GPG_KEY_ID \
tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz
env:
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
- uses: actions/upload-artifact@v3
with:
name: binaries
path: |
tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz
tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz.asc
if-no-files-found: error
bundle-src:
runs-on: ubuntu-latest
needs: [qa, check]
env:
FILENAME: tea-${{ needs.check.outputs.version }}
steps:
- uses: actions/checkout@v3
with:
path: ${{ env.FILENAME }}
- name: Clean
run: rm -rf ${{ env.FILENAME }}/.github .gitpod.yml
- name: Stamp Version
run: echo "export default function() { return '${{ needs.check.outputs.version }}' }" > $FILENAME/src/hooks/useVersion.ts
- name: Include GPG pubkey
run: echo $PUBKEY | base64 -d > $FILENAME/tea.xyz.pub.asc
env:
PUBKEY: ${{ secrets.GPG_PUBLIC_KEY }}
- run: tar cJf $FILENAME.tar.xz $FILENAME
- uses: actions/upload-artifact@v3
with:
name: srcs
path: ${{ env.FILENAME }}.tar.xz
if-no-files-found: error
release:
permissions:
contents: write
needs: [check, compile, bundle-src]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/download-artifact@v3
- uses: softprops/action-gh-release@v1
with:
tag_name: v${{ needs.check.outputs.version }}
files: |
binaries/*
srcs/*
fail_on_unmatched_files: true
generate_release_notes: true
token: ${{secrets.TEMP_JACOBS_GITHUB_PAT}} # using our own PAT so other workflows run
bump-tap:
needs: [release]
runs-on: ubuntu-latest
steps:
- uses: aurelien-baudet/workflow-dispatch@v2
with:
workflow: bump.yml
repo: teaxyz/homebrew-pkgs
ref: main
token: ${{secrets.TEMP_JACOBS_GITHUB_PAT}}
# these are the binaries that curl https://tea.xyz/platform/arch/ download
upload-binaries:
needs: [release]
runs-on: ubuntu-latest
steps:
- uses: actions/download-artifact@v3
with:
name: binaries
path: binaries
- uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
- name: Unpack Binaries
working-directory: binaries
run: |
for filename in *.tar.xz; do
tar xJf $filename
result="${filename#*+}"
result="${result%.tar.xz}"
mv tea tea-$result
rm $filename
done
- name: Upload to S3
run: |
aws s3 cp binaries/tea-darwin+aarch64 s3://www.tea.xyz/Darwin/arm64 $FLAGS
aws s3 cp binaries/tea-darwin+x86-64 s3://www.tea.xyz/Darwin/x86_64 $FLAGS
# Both because, iirc, some linuxen are inconsistent
aws s3 cp binaries/tea-linux+aarch64 s3://www.tea.xyz/Linux/arm64 $FLAGS
aws s3 cp binaries/tea-linux+aarch64 s3://www.tea.xyz/Linux/aarch64 $FLAGS
aws s3 cp binaries/tea-linux+x86-64 s3://www.tea.xyz/Linux/x86_64 $FLAGS
env:
FLAGS: --metadata-directive REPLACE --cache-control no-cache,must-revalidate
- name: Invalidate CloudFront
run:
aws cloudfront create-invalidation
--distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
--paths $STATIC_PATHS
env:
STATIC_PATHS: >-
/Darwin/arm64
/Darwin/x86_64
/Linux/arm64
/Linux/aarch64
/Linux/x86_64
smoke-teaxyz-setup-github-action:
needs: [upload-binaries]
runs-on: ubuntu-latest
steps:
- uses: aurelien-baudet/workflow-dispatch@v2
with:
workflow: smoke-test.yml
repo: teaxyz/setup
ref: main
token: ${{secrets.TEMP_JACOBS_GITHUB_PAT}}
wait-for-completion: false