From 8260a8721569f4f05a8539e45491f9aa216b10a3 Mon Sep 17 00:00:00 2001 From: elky Date: Wed, 9 Sep 2026 13:01:05 +0800 Subject: [PATCH] ci: build Linux-only gateway releases --- .github/workflows/nightly.yml | 71 ++++++++++++++---------------- .github/workflows/release.yml | 56 +++++++++-------------- README.md | 4 +- tests/release_supply_chain_test.sh | 24 +++++++++- 4 files changed, 79 insertions(+), 76 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index c216dbfd6..ff5e00268 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -251,18 +251,6 @@ jobs: arch: arm64 os: ubuntu-latest use_cross: true - - name: macos-amd64 - target: x86_64-apple-darwin - platform: macos - arch: amd64 - os: macos-15-intel - use_cross: false - - name: macos-arm64 - target: aarch64-apple-darwin - platform: macos - arch: arm64 - os: macos-15 - use_cross: false steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: @@ -398,31 +386,29 @@ jobs: VERSION="nightly" mkdir -p package release-assets - for platform in linux macos; do - for arch in amd64 arm64; do - bundle="aether-${VERSION}-${platform}-${arch}" - root="package/${bundle}" - mkdir -p "${root}/bin" "${root}/frontend" + for arch in amd64 arm64; do + bundle="aether-${VERSION}-linux-${arch}" + root="package/${bundle}" + mkdir -p "${root}/bin" "${root}/frontend" - install -m 0755 \ - "artifacts/nightly-gateway-${platform}-${arch}/aether-gateway" \ - "${root}/bin/aether-gateway" - cp -R artifacts/nightly-frontend-dist/. "${root}/frontend/" - sed \ - -e "s/^SOURCE_REF=\"\${AETHER_SOURCE_REF:-main}\"/SOURCE_REF=\"\${AETHER_SOURCE_REF:-${SOURCE_REF}}\"/" \ - -e "s/^VERSION=\"\${AETHER_VERSION:-}\"/VERSION=\"\${AETHER_VERSION:-${VERSION}}\"/" \ - install.sh > "${root}/install.sh" - chmod 0755 "${root}/install.sh" - install -m 0755 update.sh "${root}/update.sh" - install -m 0644 docker-compose.yml "${root}/docker-compose.yml" - install -m 0644 docker-compose.single-node.yml "${root}/docker-compose.single-node.yml" - install -m 0644 .env.example "${root}/.env.example" - install -m 0755 generate_keys.sh "${root}/generate_keys.sh" - install -m 0644 README.md "${root}/README.md" - install -m 0644 LICENSE "${root}/LICENSE" + install -m 0755 \ + "artifacts/nightly-gateway-linux-${arch}/aether-gateway" \ + "${root}/bin/aether-gateway" + cp -R artifacts/nightly-frontend-dist/. "${root}/frontend/" + sed \ + -e "s/^SOURCE_REF=\"\${AETHER_SOURCE_REF:-main}\"/SOURCE_REF=\"\${AETHER_SOURCE_REF:-${SOURCE_REF}}\"/" \ + -e "s/^VERSION=\"\${AETHER_VERSION:-}\"/VERSION=\"\${AETHER_VERSION:-${VERSION}}\"/" \ + install.sh > "${root}/install.sh" + chmod 0755 "${root}/install.sh" + install -m 0755 update.sh "${root}/update.sh" + install -m 0644 docker-compose.yml "${root}/docker-compose.yml" + install -m 0644 docker-compose.single-node.yml "${root}/docker-compose.single-node.yml" + install -m 0644 .env.example "${root}/.env.example" + install -m 0755 generate_keys.sh "${root}/generate_keys.sh" + install -m 0644 README.md "${root}/README.md" + install -m 0644 LICENSE "${root}/LICENSE" - tar -C package -czf "release-assets/${bundle}.tar.gz" "${bundle}" - done + tar -C package -czf "release-assets/${bundle}.tar.gz" "${bundle}" done sed \ @@ -432,8 +418,8 @@ jobs: chmod 0755 release-assets/install.sh (cd release-assets && sha256sum *.tar.gz > SHA256SUMS) - test "$(find release-assets -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 4 - test "$(wc -l < release-assets/SHA256SUMS)" -eq 4 + test "$(find release-assets -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 2 + test "$(wc -l < release-assets/SHA256SUMS)" -eq 2 (cd release-assets && sha256sum -c SHA256SUMS) for archive in release-assets/*.tar.gz; do tar -tzf "${archive}" >/dev/null @@ -517,6 +503,15 @@ jobs: --repo "${REPOSITORY}" \ --clobber + published_assets="$(gh release view "${RELEASE_TAG}" --repo "${REPOSITORY}" --json assets --jq '.assets[].name')" + while IFS= read -r asset_name; do + if [[ "${asset_name}" == aether-nightly-*.tar.gz && ! -f "release-assets/${asset_name}" ]]; then + gh release delete-asset "${RELEASE_TAG}" "${asset_name}" \ + --repo "${REPOSITORY}" \ + --yes + fi + done <<<"${published_assets}" + # target_commitish does not move an existing git tag. Move the ref # only after the complete asset set is available. if gh api "repos/${REPOSITORY}/git/ref/tags/${RELEASE_TAG}" >/dev/null 2>&1; then @@ -541,8 +536,6 @@ jobs: expected_assets=( aether-nightly-linux-amd64.tar.gz aether-nightly-linux-arm64.tar.gz - aether-nightly-macos-amd64.tar.gz - aether-nightly-macos-arm64.tar.gz SHA256SUMS install.sh ) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9f453bc86..7f0625eee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -186,18 +186,6 @@ jobs: arch: arm64 os: ubuntu-latest use_cross: true - - name: macos-amd64 - target: x86_64-apple-darwin - platform: macos - arch: amd64 - os: macos-15-intel - use_cross: false - - name: macos-arm64 - target: aarch64-apple-darwin - platform: macos - arch: arm64 - os: macos-15 - use_cross: false steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 @@ -356,31 +344,29 @@ jobs: fi mkdir -p package release-assets - for platform in linux macos; do - for arch in amd64 arm64; do - bundle="aether-${VERSION}-${platform}-${arch}" - root="package/${bundle}" - mkdir -p \ - "${root}/bin" \ - "${root}/frontend" + for arch in amd64 arm64; do + bundle="aether-${VERSION}-linux-${arch}" + root="package/${bundle}" + mkdir -p \ + "${root}/bin" \ + "${root}/frontend" - install -m 0755 "artifacts/aether-gateway-${platform}-${arch}/aether-gateway" "${root}/bin/aether-gateway" - cp -R artifacts/frontend-dist/. "${root}/frontend/" - sed \ - -e "s/^SOURCE_REF=\"\${AETHER_SOURCE_REF:-main}\"/SOURCE_REF=\"\${AETHER_SOURCE_REF:-${SOURCE_REF}}\"/" \ - -e "s/^VERSION=\"\${AETHER_VERSION:-}\"/VERSION=\"\${AETHER_VERSION:-${VERSION}}\"/" \ - install.sh > "${root}/install.sh" - chmod 0755 "${root}/install.sh" - install -m 0755 update.sh "${root}/update.sh" - install -m 0644 docker-compose.yml "${root}/docker-compose.yml" - install -m 0644 docker-compose.single-node.yml "${root}/docker-compose.single-node.yml" - install -m 0644 .env.example "${root}/.env.example" - install -m 0755 generate_keys.sh "${root}/generate_keys.sh" - install -m 0644 README.md "${root}/README.md" - install -m 0644 LICENSE "${root}/LICENSE" + install -m 0755 "artifacts/aether-gateway-linux-${arch}/aether-gateway" "${root}/bin/aether-gateway" + cp -R artifacts/frontend-dist/. "${root}/frontend/" + sed \ + -e "s/^SOURCE_REF=\"\${AETHER_SOURCE_REF:-main}\"/SOURCE_REF=\"\${AETHER_SOURCE_REF:-${SOURCE_REF}}\"/" \ + -e "s/^VERSION=\"\${AETHER_VERSION:-}\"/VERSION=\"\${AETHER_VERSION:-${VERSION}}\"/" \ + install.sh > "${root}/install.sh" + chmod 0755 "${root}/install.sh" + install -m 0755 update.sh "${root}/update.sh" + install -m 0644 docker-compose.yml "${root}/docker-compose.yml" + install -m 0644 docker-compose.single-node.yml "${root}/docker-compose.single-node.yml" + install -m 0644 .env.example "${root}/.env.example" + install -m 0755 generate_keys.sh "${root}/generate_keys.sh" + install -m 0644 README.md "${root}/README.md" + install -m 0644 LICENSE "${root}/LICENSE" - tar -C package -czf "release-assets/${bundle}.tar.gz" "${bundle}" - done + tar -C package -czf "release-assets/${bundle}.tar.gz" "${bundle}" done sed \ diff --git a/README.md b/README.md index 818bcf9ba..8dbd0679d 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,9 @@ cd Aether curl -fsSL https://raw.githubusercontent.com/fawney19/Aether/main/install.sh | sudo bash -s -- --mode compose ``` -原生 Linux systemd / macOS launchd 安装需先准备 PostgreSQL，将连接串通过 `DATABASE_URL` 传给安装进程，并选择 `--mode single-node`；不再自动创建本地数据库文件。 +正式版和 Nightly 自动构建仅提供 Linux `amd64` / `arm64` 二进制包，Docker 镜像同样支持这两种架构。macOS 用户可使用 Docker 或自行从源码构建；安装脚本保留对历史 macOS 制品的兼容。独立 Aether Tunnel 的多平台发行不受此调整影响。 + +原生 Linux systemd 安装需先准备 PostgreSQL，将连接串通过 `DATABASE_URL` 传给安装进程，并选择 `--mode single-node`；不再自动创建本地数据库文件。 ### Nightly（每日 main 构建） diff --git a/tests/release_supply_chain_test.sh b/tests/release_supply_chain_test.sh index a7c3b5d6e..32a37ce79 100755 --- a/tests/release_supply_chain_test.sh +++ b/tests/release_supply_chain_test.sh @@ -4,6 +4,7 @@ set -euo pipefail REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)" COMPOSE_FILE="${REPO_ROOT}/docker-compose.yml" RELEASE_WORKFLOW="${REPO_ROOT}/.github/workflows/release.yml" +NIGHTLY_WORKFLOW="${REPO_ROOT}/.github/workflows/nightly.yml" TUNNEL_RELEASE_WORKFLOW="${REPO_ROOT}/.github/workflows/build-tunnel.yml" APP_DOCKERFILE="${REPO_ROOT}/Dockerfile.app" @@ -48,6 +49,27 @@ assert_line "${RELEASE_WORKFLOW}" " release-assets/install.sh" assert_line "${RELEASE_WORKFLOW}" " release-assets/SHA256SUMS" assert_line "${RELEASE_WORKFLOW}" " release-assets/AETHER_RELEASE_PROVENANCE.sigstore.json" +for workflow in "${RELEASE_WORKFLOW}" "${NIGHTLY_WORKFLOW}"; do + assert_line "${workflow}" " - name: linux-amd64" + assert_line "${workflow}" " - name: linux-arm64" + assert_line "${workflow}" " for arch in amd64 arm64; do" + assert_line "${workflow}" ' bundle="aether-${VERSION}-linux-${arch}"' + if grep -Eq 'macos|apple-darwin|for platform in' "${workflow}"; then + fail_test "gateway workflow still references a removed build platform: ${workflow}" + fi +done + +assert_line "${NIGHTLY_WORKFLOW}" \ + ' test "$(find release-assets -maxdepth 1 -name '\''*.tar.gz'\'' | wc -l)" -eq 2' +assert_line "${NIGHTLY_WORKFLOW}" \ + ' test "$(wc -l < release-assets/SHA256SUMS)" -eq 2' +assert_line "${NIGHTLY_WORKFLOW}" " aether-nightly-linux-amd64.tar.gz" +assert_line "${NIGHTLY_WORKFLOW}" " aether-nightly-linux-arm64.tar.gz" +assert_line "${NIGHTLY_WORKFLOW}" \ + ' if [[ "${asset_name}" == aether-nightly-*.tar.gz && ! -f "release-assets/${asset_name}" ]]; then' +assert_line "${NIGHTLY_WORKFLOW}" \ + ' gh release delete-asset "${RELEASE_TAG}" "${asset_name}" \' + assert_line "${TUNNEL_RELEASE_WORKFLOW}" " attestations: write" assert_line "${TUNNEL_RELEASE_WORKFLOW}" " id-token: write" assert_line "${TUNNEL_RELEASE_WORKFLOW}" \ @@ -63,4 +85,4 @@ if grep -ERq '^[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]+[^[:space:]#]+@[^0-9 fail_test "workflow contains a mutable third-party action reference" fi -echo "PASS: release supply-chain pins and provenance workflow" +echo "PASS: release supply-chain pins, provenance and Linux-only gateway platforms"