Test APT repository #163
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test APT repository | |
| "on": | |
| schedule: | |
| - cron: "0 */6 * * *" | |
| workflow_dispatch: | |
| workflow_run: | |
| workflows: ["Update repositories with packages"] | |
| types: [completed] | |
| jobs: | |
| test-apt-install: | |
| name: "${{ matrix.package }} / ${{ matrix.component }}" | |
| runs-on: | |
| - codebuild-defguard-core-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| - instance-size:small | |
| container: public.ecr.aws/docker/library/debian:trixie-slim | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| package: [defguard, defguard-proxy, defguard-gateway] | |
| component: [release, pre-release, release-2.0, pre-release-2.0] | |
| include: | |
| - package: defguard | |
| github_repo: DefGuard/defguard | |
| - package: defguard-proxy | |
| github_repo: DefGuard/proxy | |
| - package: defguard-gateway | |
| github_repo: DefGuard/gateway | |
| steps: | |
| - name: Install prerequisites | |
| run: apt-get update -y && apt-get install -y ca-certificates curl jq libmnl0 libnftnl11 | |
| - name: Add Defguard GPG key | |
| run: | | |
| install -m 0755 -d /etc/apt/keyrings | |
| curl -fsSL https://apt.defguard.net/defguard.asc -o /etc/apt/keyrings/defguard.asc | |
| chmod a+r /etc/apt/keyrings/defguard.asc | |
| - name: Add Defguard APT repository | |
| run: | | |
| echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/defguard.asc] https://apt.defguard.net/ trixie ${{ matrix.component }}" \ | |
| > /etc/apt/sources.list.d/defguard.list | |
| - name: Update APT cache | |
| run: apt-get update -y | |
| - name: Check package availability in component | |
| run: | | |
| CANDIDATE=$(apt-cache policy ${{ matrix.package }} | awk '/Candidate:/ {print $2}') | |
| if [ -z "$CANDIDATE" ] || [ "$CANDIDATE" = "(none)" ]; then | |
| echo "::notice::${{ matrix.package }} not available in component ${{ matrix.component }}, skipping" | |
| echo "SKIP=true" >> $GITHUB_ENV | |
| else | |
| echo "Candidate version: $CANDIDATE" | |
| echo "SKIP=false" >> $GITHUB_ENV | |
| fi | |
| - name: Get expected version from GitHub | |
| if: env.SKIP != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| case "${{ matrix.component }}" in | |
| release-2.0) PRERELEASE=false; MAJOR=v2. ;; | |
| pre-release-2.0) PRERELEASE=true; MAJOR=v2. ;; | |
| release) PRERELEASE=false; MAJOR=v1. ;; | |
| pre-release) PRERELEASE=true; MAJOR=v1. ;; | |
| esac | |
| VERSION=$(curl -sf \ | |
| -H "Authorization: Bearer $GH_TOKEN" \ | |
| https://api.github.com/repos/${{ matrix.github_repo }}/releases \ | |
| | jq -r --argjson pre "$PRERELEASE" --arg major "$MAJOR" \ | |
| '[.[] | select(.draft == false and .prerelease == $pre and (.tag_name | startswith($major)))][0].tag_name // empty') | |
| if [ -z "$VERSION" ]; then | |
| echo "::notice::no $MAJOR release (prerelease=$PRERELEASE) of ${{ matrix.package }} on GitHub, skipping" | |
| echo "SKIP=true" >> $GITHUB_ENV | |
| exit 0 | |
| fi | |
| VERSION="${VERSION#v}" | |
| # legacy pre-release still holds 2.0 betas published before the | |
| # component split; accept them instead of expecting the latest v1.x | |
| CANDIDATE=$(apt-cache policy ${{ matrix.package }} | awk '/Candidate:/ {print $2}') | |
| if [ "${{ matrix.component }}" = "pre-release" ] && [ "${CANDIDATE%%.*}" != "1" ]; then | |
| echo "::notice::candidate $CANDIDATE is from before the component split, skipping version comparison" | |
| VERSION="" | |
| fi | |
| echo "Expected version: $VERSION" | |
| echo "EXPECTED_VERSION=$VERSION" >> $GITHUB_ENV | |
| - name: Install ${{ matrix.package }} | |
| if: env.SKIP != 'true' | |
| run: apt-get install -y ${{ matrix.package }} | |
| - name: Verify ${{ matrix.package }} version | |
| if: env.SKIP != 'true' | |
| run: | | |
| INSTALLED=$(dpkg -s ${{ matrix.package }} | grep '^Version:' | awk '{print $2}') | |
| echo "Installed version: $INSTALLED" | |
| if [ -n "$EXPECTED_VERSION" ]; then | |
| echo "Expected version: $EXPECTED_VERSION" | |
| if [ "$INSTALLED" != "$EXPECTED_VERSION" ]; then | |
| echo "Version mismatch!" | |
| exit 1 | |
| fi | |
| fi | |
| ${{ matrix.package }} -V |