diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 74fd7353fddbc..ac5b8f23b0adf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -32,80 +32,8 @@ env: CODER_RELEASE_NOTES: ${{ inputs.release_notes }} jobs: - # build-dylib is a separate job to build the dylib on macOS. - build-dylib: - runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest' }} - steps: - - name: Harden Runner - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 - with: - egress-policy: audit - - - name: Checkout - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1 - with: - fetch-depth: 0 - - - name: Setup build tools - run: | - brew install bash gnu-getopt make - echo "$(brew --prefix bash)/bin" >> $GITHUB_PATH - echo "$(brew --prefix gnu-getopt)/bin" >> $GITHUB_PATH - echo "$(brew --prefix make)/libexec/gnubin" >> $GITHUB_PATH - - - name: Setup Go - uses: ./.github/actions/setup-go - - - name: Install rcodesign - run: | - set -euo pipefail - wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-macos-universal.tar.gz - sudo tar -xzf /tmp/rcodesign.tar.gz \ - -C /usr/local/bin \ - --strip-components=1 \ - apple-codesign-0.22.0-macos-universal/rcodesign - rm /tmp/rcodesign.tar.gz - - - name: Setup Apple Developer certificate and API key - run: | - set -euo pipefail - touch /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8} - chmod 600 /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8} - echo "$AC_CERTIFICATE_P12_BASE64" | base64 -d > /tmp/apple_cert.p12 - echo "$AC_CERTIFICATE_PASSWORD" > /tmp/apple_cert_password.txt - echo "$AC_APIKEY_P8_BASE64" | base64 -d > /tmp/apple_apikey.p8 - env: - AC_CERTIFICATE_P12_BASE64: ${{ secrets.AC_CERTIFICATE_P12_BASE64 }} - AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }} - AC_APIKEY_P8_BASE64: ${{ secrets.AC_APIKEY_P8_BASE64 }} - - - name: Build dylibs - run: | - set -euxo pipefail - go mod download - - make gen/mark-fresh - make build/coder-dylib - env: - CODER_SIGN_DARWIN: 1 - AC_CERTIFICATE_FILE: /tmp/apple_cert.p12 - AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt - - - name: Upload build artifacts - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 - with: - name: dylibs - path: | - ./build/*.h - ./build/*.dylib - retention-days: 7 - - - name: Delete Apple Developer certificate and API key - run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8} - release: name: Build and publish - needs: build-dylib runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} permissions: # Required to publish a release @@ -217,18 +145,6 @@ jobs: - name: Install nsis and zstd run: sudo apt-get install -y nsis zstd - - name: Download dylibs - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 - with: - name: dylibs - path: ./build - - - name: Insert dylibs - run: | - mv ./build/*amd64.dylib ./site/out/bin/coder-vpn-darwin-amd64.dylib - mv ./build/*arm64.dylib ./site/out/bin/coder-vpn-darwin-arm64.dylib - mv ./build/*arm64.h ./site/out/bin/coder-vpn-darwin-dylib.h - - name: Install nfpm run: | set -euo pipefail @@ -355,7 +271,6 @@ jobs: ${{ steps.image-base-tag.outputs.tag }} - name: Verify that images are pushed properly - if: steps.image-base-tag.outputs.tag != '' run: | # retry 10 times with a 5 second delay as the images may not be # available immediately @@ -388,6 +303,10 @@ jobs: run: | set -euxo pipefail + # build Docker images for each architecture + version="$(./scripts/version.sh)" + make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag + # we can't build multi-arch if the images aren't pushed, so quit now # if dry-running if [[ "$CODER_RELEASE" != *t* ]]; then @@ -395,10 +314,6 @@ jobs: exit 0 fi - # build Docker images for each architecture - version="$(./scripts/version.sh)" - make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag - # build and push multi-arch manifest, this depends on the other images # being pushed so will automatically push them. make push/build/coder_"$version"_linux.tag