clawk/.github/workflows/release.yml at main · clawkwork/clawk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
name: release

# Cut a release by pushing a tag: `git tag v0.1.0 && git push origin v0.1.0`.
# Builds the macOS/arm64 and Linux (amd64 + arm64) binaries, publishes them as
# one GitHub release, and (if HOMEBREW_TAP_TOKEN is set) bumps the Homebrew tap
# formula to the macOS tarball.
#
# Every artifact runs `make guestbin` first, embedding the in-guest binaries so
# an installed clawk needs no Go toolchain to boot a sandbox. GUEST_ARCH is the
# artifact's OWN architecture: hardware virtualization can't cross
# architectures, so a linux/amd64 clawk only ever boots amd64 guests and needs
# exactly one set.
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  # Create the release once, before anything uploads into it.
  #
  # The three artifact builds below (two Linux matrix legs plus macOS) stay
  # deliberately independent of each other — a failure in one shouldn't
  # withhold the others' binaries — but they cannot each CREATE the release: on
  # a tag with no release yet they race to POST /releases, and the loser fails
  # with 422 already_exists, dropping an architecture's tarball from a release
  # that built fine. Doing it here also pins the generated notes to one
  # deterministic run instead of whichever job happened to win.
  create-release:
    runs-on: ubuntu-latest
    steps:
      - uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true

  # The Linux artifacts the firecracker provider needs. Pure Go — no cgo, no
  # signing — so both architectures cross-compile from one runner.
  linux:
    needs: create-release
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goarch: [amd64, arm64]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Prebuild guest binaries (linux/${{ matrix.goarch }})
        run: make guestbin GUEST_ARCH=${{ matrix.goarch }}

      - name: Build clawk (linux/${{ matrix.goarch }})
        env:
          CGO_ENABLED: "0"
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
        run: go build -trimpath -o clawk ./cmd/clawk

      - name: Package tarball
        id: pkg
        run: |
          tarball="clawk-${GITHUB_REF_NAME}-linux-${{ matrix.goarch }}.tar.gz"
          # No clawk.entitlements: codesigning is macOS-only.
          tar czf "$tarball" clawk LICENSE
          sha=$(sha256sum "$tarball" | awk '{print $1}')
          echo "tarball=$tarball" >> "$GITHUB_OUTPUT"
          {
            echo "### clawk ${GITHUB_REF_NAME} (linux/${{ matrix.goarch }})"
            echo "\`sha256: ${sha}\`"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload release asset
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ steps.pkg.outputs.tarball }}

  release:
    # Virtualization.framework is cgo/Objective-C: the binary MUST be built
    # on macOS arm64 — it cannot be cross-compiled from Linux.
    needs: create-release
    runs-on: macos-14
    env:
      TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Prebuild guest binaries (linux/arm64)
        run: make guestbin GUEST_ARCH=arm64

      - name: Build clawk (darwin/arm64)
        run: go build -trimpath -o clawk ./cmd/clawk

      - name: Package tarball
        id: pkg
        run: |
          tarball="clawk-${GITHUB_REF_NAME}-darwin-arm64.tar.gz"
          tar czf "$tarball" clawk clawk.entitlements LICENSE
          sha=$(shasum -a 256 "$tarball" | awk '{print $1}')
          {
            echo "tarball=$tarball"
            echo "sha256=$sha"
            echo "url=https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/${tarball}"
          } >> "$GITHUB_OUTPUT"
          {
            echo "### clawk ${GITHUB_REF_NAME}"
            echo "\`sha256: ${sha}\`"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload release asset
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ steps.pkg.outputs.tarball }}

      # Rewrites version/url/sha256 in the tap's Formula/clawk.rb and pushes.
      # Skipped automatically when HOMEBREW_TAP_TOKEN isn't configured — in
      # that case grab the sha256 from the job summary and bump the formula
      # by hand.
      - name: Update Homebrew tap
        if: env.TAP_TOKEN != ''
        env:
          URL: ${{ steps.pkg.outputs.url }}
          SHA: ${{ steps.pkg.outputs.sha256 }}
        run: |
          v="${GITHUB_REF_NAME#v}"
          git clone "https://x-access-token:${TAP_TOKEN}@github.com/clawkwork/homebrew-tap.git" tap
          cd tap
          sed -i.bak -E \
            -e "s|^  version \".*\"|  version \"${v}\"|" \
            -e "s|^  url \".*\"|  url \"${URL}\"|" \
            -e "s|^  sha256 \".*\"|  sha256 \"${SHA}\"|" \
            Formula/clawk.rb
          rm -f Formula/clawk.rb.bak
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -am "clawk ${v}"
          git push