Skip to content

Commit 3433798

Browse files
sondavidbsondavidb
authored
ci(canary): move to script, use own downloader (runfinch#1593)
* ci: get tag more efficiently in Debian canary Signed-off-by: David Son <[email protected]> * ci(canary): move to script, use own download Signed-off-by: David Son <[email protected]> --------- Signed-off-by: David Son <[email protected]>
1 parent f2de8e0 commit 3433798

File tree

2 files changed

+73
-61
lines changed

2 files changed

+73
-61
lines changed

‎.github/workflows/canary-deb.yaml‎

Lines changed: 8 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -21,71 +21,18 @@ on:
2121
pull_request:
2222
paths:
2323
- '.github/workflows/canary-deb.yaml'
24+
- 'scripts/canary-deb.sh'
2425

2526
jobs:
26-
get-latest-tag:
27-
name: Get the latest release tag
28-
runs-on: ubuntu-latest
29-
timeout-minutes: 2
30-
outputs:
31-
tag: ${{ steps.latest-tag.outputs.tag }}
32-
steps:
33-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
34-
with:
35-
fetch-depth: 0
36-
- name: 'Get the latest tag'
37-
id: latest-tag
38-
uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0
39-
4027
canary-deb:
4128
name: Test Finch APT repo health
4229
runs-on: ubuntu-latest
43-
timeout-minutes: 3
44-
needs: get-latest-tag
30+
timeout-minutes: 2
4531
steps:
46-
- name: Setup environment variables
47-
run: |
48-
ARCH=$(dpkg --print-architecture)
49-
echo "ARCH=${ARCH}" >> $GITHUB_ENV
50-
51-
# Strip v from tag
52-
tag=${{ needs.get-latest-tag.outputs.tag }}
53-
version=${tag/v/}
54-
echo "version=${version}" >> $GITHUB_ENV
55-
56-
echo "filename=runfinch-finch_${version}_${ARCH}.deb" >> $GITHUB_ENV
57-
- name: Add Finch APT Repository
58-
run: |
59-
echo "Detected architecture: ${{ env.ARCH }}"
60-
61-
curl -fsSL https://artifact.runfinch.com/deb/GPG_KEY.pub | gpg --dearmor -o /usr/share/keyrings/runfinch-finch-archive-keyring.gpg
62-
echo "deb [signed-by=/usr/share/keyrings/runfinch-finch-archive-keyring.gpg arch=${{ env.ARCH }}] https://artifact.runfinch.com/deb noble main" | sudo tee /etc/apt/sources.list.d/runfinch-finch.list
63-
sudo apt update
64-
65-
- name: Download latest release from GitHub
66-
uses: "robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05" # v1.12.0
32+
- name: Checkout canary script
33+
uses: actions/checkout@v5
6734
with:
68-
tag: ${{ needs.get-latest-tag.outputs.tag }}
69-
fileName: ${{ env.filename }}
70-
out-file-path: github-release
71-
72-
- name: Download .deb from APT repo
73-
run: apt-get download runfinch-finch
74-
75-
- name: Verify shasum matches GitHub release shasum
76-
run: |
77-
apt_file=${GITHUB_WORKSPACE}/${{ env.filename }}
78-
apt_file_shasum=$(sha256sum ${apt_file} | awk '{print $1}')
79-
80-
81-
github_file=${GITHUB_WORKSPACE}/github-release/${{ env.filename }}
82-
github_file_shasum=$(sha256sum ${github_file} | awk '{print $1}')
83-
84-
if [[ $(diff <(echo ${apt_file_shasum}) <(echo ${github_file_shasum})) ]]; then
85-
echo "❌ sha256sum mismatch!"
86-
echo "apt repo shasum: ${apt_file_shasum}"
87-
echo "GitHub release shasum: ${github_file_shasum}"
88-
exit 1
89-
else
90-
echo "✅ shasum ${apt_file_shasum} identical"
91-
fi
35+
sparse-checkout: |
36+
scripts/canary-deb.sh
37+
- name: Run canary script
38+
run: ./scripts/canary-deb.sh

‎scripts/canary-deb.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
3+
set -o pipefail
4+
5+
ARCH=$(dpkg --print-architecture)
6+
echo "Detected architecture: ${ARCH}"
7+
8+
if [[ -z "${GITHUB_WORKSPACE}" ]]; then
9+
GITHUB_WORKSPACE=${PWD}
10+
fi
11+
12+
#
13+
# GitHub artifact downloading
14+
#
15+
16+
github_artifact_dir=${GITHUB_WORKSPACE}/github-release
17+
18+
req=$(curl https://api.github.com/repos/runfinch/finch/releases/latest)
19+
deb_asset=$(echo ${req} | jq --arg suffix "${ARCH}.deb" '.assets[] | select(.name|endswith($suffix))')
20+
21+
deb_url=$(echo ${deb_asset} | jq -r '.url')
22+
filename=$(echo ${deb_asset} | jq -r '.name')
23+
24+
sha_unparsed=$(echo ${deb_asset} | jq -r '.digest')
25+
while IFS=':' read -ra sha_arr; do
26+
expected_shasum=${sha_arr[1]}
27+
done <<< "${sha_unparsed}"
28+
29+
mkdir ${github_artifact_dir}
30+
curl -L -H "Accept: application/octet-stream" -o ${github_artifact_dir}/${filename} ${deb_url}
31+
32+
github_file_shasum=$(sha256sum ${github_artifact_dir}/${filename} | awk '{print $1}')
33+
34+
if [[ $(diff <(echo ${expected_shasum}) <(echo ${github_file_shasum})) ]]; then
35+
printf "shasum mismatch from GitHub\nexpected:%1\ngot:%s\n" expected_shasum github_file_shasum
36+
exit 1
37+
fi
38+
39+
#
40+
# APT repo downloading
41+
#
42+
43+
curl -fsSL https://artifact.runfinch.com/deb/GPG_KEY.pub | gpg --dearmor -o /usr/share/keyrings/runfinch-finch-archive-keyring.gpg
44+
echo "deb [signed-by=/usr/share/keyrings/runfinch-finch-archive-keyring.gpg arch=${ARCH}] https://artifact.runfinch.com/deb noble main" | sudo tee /etc/apt/sources.list.d/runfinch-finch.list
45+
46+
# This should only update the runfinch repo.
47+
# If this breaks, changing it to `sudo apt-get update` should be acceptable, it just takes longer to run.
48+
sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/runfinch-finch.list" -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0"
49+
50+
apt-get download runfinch-finch
51+
apt_file=${GITHUB_WORKSPACE}/${filename}
52+
apt_file_shasum=$(sha256sum ${apt_file} | awk '{print $1}')
53+
54+
#
55+
# Compare shasums
56+
#
57+
58+
if [[ $(diff <(echo ${apt_file_shasum}) <(echo ${expected_shasum})) ]]; then
59+
echo "❌ sha256sum mismatch!"
60+
echo "apt repo shasum: ${apt_file_shasum}"
61+
echo "GitHub release shasum: ${github_file_shasum}"
62+
exit 1
63+
else
64+
echo "✅ shasum ${apt_file_shasum} identical"
65+
fi

0 commit comments

Comments
 (0)