🦈🏠🐜❗ Initial Commit ❗🐜🦈🏠 #40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Daily Build | |
| on: | |
| schedule: | |
| # 3am UTC daily | |
| - cron: '0 3 * * *' | |
| push: | |
| branches: | |
| - main | |
| - master | |
| workflow_dispatch: | |
| concurrency: | |
| group: daily-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || github.ref == 'refs/heads/devel' || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' }} | |
| permissions: | |
| contents: read | |
| env: | |
| PROJECT_NAME: shortner | |
| jobs: | |
| # Compute VERSION once — matrix legs must never each compute their own value. | |
| # Daily identity is the commit being built, not release.txt or a timestamp. | |
| version: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.set.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Compute version | |
| id: set | |
| run: | | |
| echo "version=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" | |
| build: | |
| needs: [version] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: casjaysdev/go:latest | |
| strategy: | |
| matrix: | |
| include: | |
| - goos: linux | |
| goarch: amd64 | |
| - goos: linux | |
| goarch: arm64 | |
| - goos: darwin | |
| goarch: amd64 | |
| - goos: darwin | |
| goarch: arm64 | |
| - goos: windows | |
| goarch: amd64 | |
| ext: .exe | |
| - goos: windows | |
| goarch: arm64 | |
| ext: .exe | |
| - goos: freebsd | |
| goarch: amd64 | |
| - goos: freebsd | |
| goarch: arm64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set build info | |
| run: | | |
| echo "VERSION=${{ needs.version.outputs.version }}" >> $GITHUB_ENV | |
| echo "COMMIT_ID=$(git rev-parse --short HEAD)" >> $GITHUB_ENV | |
| BUILD_EPOCH=$(date -u +%s) | |
| echo "BUILD_EPOCH=${BUILD_EPOCH}" >> $GITHUB_ENV | |
| echo "BUILD_DATE=$(date -u -d @${BUILD_EPOCH} +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV | |
| # OFFICIAL_SITE (optional): site.txt wins; otherwise use repository secrets or leave empty | |
| # Never guess or assume - must be explicitly defined by user | |
| if [ -f site.txt ]; then | |
| echo "OFFICIAL_SITE=$(cat site.txt)" >> $GITHUB_ENV | |
| else | |
| echo "OFFICIAL_SITE=${{ secrets.OFFICIAL_SITE }}" >> $GITHUB_ENV | |
| fi | |
| - name: Build server | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: 0 | |
| run: | | |
| LDFLAGS="-s -w -X 'github.com/apimgr/shortner/src/common/version.Version=${{ env.VERSION }}' -X 'github.com/apimgr/shortner/src/common/version.CommitID=${{ env.COMMIT_ID }}' -X 'github.com/apimgr/shortner/src/common/version.BuildEpoch=${{ env.BUILD_EPOCH }}' -X 'github.com/apimgr/shortner/src/common/version.OfficialSite=${{ env.OFFICIAL_SITE }}'" | |
| go build -buildvcs=false -trimpath -ldflags "${LDFLAGS}" -o ${{ env.PROJECT_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }} ./src | |
| # CLI build - only if src/client/ directory exists | |
| - name: Build CLI | |
| if: hashFiles('src/client/**') != '' | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: 0 | |
| run: | | |
| LDFLAGS="-s -w -X 'github.com/apimgr/shortner/src/common/version.Version=${{ env.VERSION }}' -X 'github.com/apimgr/shortner/src/common/version.CommitID=${{ env.COMMIT_ID }}' -X 'github.com/apimgr/shortner/src/common/version.BuildEpoch=${{ env.BUILD_EPOCH }}' -X 'github.com/apimgr/shortner/src/common/version.OfficialSite=${{ env.OFFICIAL_SITE }}'" | |
| go build -buildvcs=false -trimpath -ldflags "${LDFLAGS}" -o ${{ env.PROJECT_NAME }}-cli-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }} ./src/client | |
| - name: Upload server artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ env.PROJECT_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: ${{ env.PROJECT_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }} | |
| - name: Upload CLI artifact | |
| if: hashFiles('src/client/**') != '' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ env.PROJECT_NAME }}-cli-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: ${{ env.PROJECT_NAME }}-cli-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }} | |
| release: | |
| needs: [version, build] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| # GitHub artifact attestations (SBOM, provenance) | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: binaries | |
| merge-multiple: true | |
| - name: Set version | |
| run: echo "VERSION=${{ needs.version.outputs.version }}" >> $GITHUB_ENV | |
| - name: Create version.txt | |
| run: echo "${{ env.VERSION }}" > binaries/version.txt | |
| - name: Create source archive | |
| run: | | |
| tar --exclude='.git' --exclude='.github' --exclude='.gitea' \ | |
| --exclude='binaries' --exclude='releases' --exclude='*.tar.gz' \ | |
| -czf binaries/${{ env.PROJECT_NAME }}-${{ env.VERSION }}-source.tar.gz . | |
| # SBOM tooling lives in the build image — never install it on the runner | |
| - name: Generate SBOM (CycloneDX) | |
| run: | | |
| docker run --rm -v "$PWD":/app -w /app -e GOFLAGS=-buildvcs=false casjaysdev/go:latest \ | |
| cyclonedx-gomod mod -json -output "binaries/${{ env.PROJECT_NAME }}-${{ env.VERSION }}-sbom.cdx.json" | |
| - name: Generate checksums | |
| run: | | |
| cd "$GITHUB_WORKSPACE/binaries" | |
| FILES="$(ls)" | |
| sha256sum $FILES > sha256.txt | |
| sha512sum $FILES > sha512.txt | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: binaries/${{ env.PROJECT_NAME }}-* | |
| - name: Delete previous daily release | |
| run: | | |
| gh release delete daily --yes 2>/dev/null || true | |
| git push origin :refs/tags/daily 2>/dev/null || true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| - name: Create Release | |
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 | |
| with: | |
| tag_name: daily | |
| name: "Daily Build ${{ env.VERSION }}" | |
| files: binaries/* | |
| prerelease: true | |
| body: "Daily build: ${{ env.VERSION }}" |