jcoffey-dev
0543931616
Pushing a v* tag runs .github/workflows/release.yml: vet, test, govulncheck, then scripts/build-release.sh builds reproducible archives for linux/amd64 and linux/arm64 with a SHA256SUMS file, and attaches them to the release. workflow_dispatch takes a tag for a run that never started. Same shape as ihasmail-oneshot's releases. Adds a version subcommand, set at build time. go.mod moves to 1.26.8: the workflow builds with the go.mod version, and govulncheck finds four standard-library vulnerabilities the tool reaches in 1.26.5 (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), all fixed in 1.26.6. README installs from the latest release, with building from source as the alternative; CONTRIBUTING describes how releases are cut.
41 lines
1.6 KiB
Bash
Executable File
41 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# SPDX-FileCopyrightText: 2026 Coffey Labs
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
#
|
|
# Build the release archives: one per architecture, plus SHA256SUMS.
|
|
#
|
|
# Usage: scripts/build-release.sh VERSION [OUTDIR]
|
|
# scripts/build-release.sh v2026.9.15 dist
|
|
#
|
|
# The release workflow runs exactly this, so a release can be reproduced -- or
|
|
# checked before tagging -- on any machine with Go. Archive names carry no
|
|
# version, so .../releases/latest/download/<name> always means the newest.
|
|
set -euo pipefail
|
|
|
|
VERSION="${1:?usage: $0 VERSION [OUTDIR]}"
|
|
OUT="${2:-dist}"
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
rm -rf "$OUT" && mkdir -p "$OUT"
|
|
OUT="$(cd "$OUT" && pwd)"
|
|
STAGE="$(mktemp -d)"
|
|
trap 'rm -rf "$STAGE"' EXIT
|
|
|
|
# Linux only: the tool runs as root on the mail server it upgrades, which is a
|
|
# systemd service or a Docker container there.
|
|
for arch in amd64 arm64; do
|
|
name="stalwart-migrate-linux-$arch"
|
|
mkdir -p "$STAGE/$name"
|
|
echo "==> building $name ($VERSION)"
|
|
(cd "$ROOT" && CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath \
|
|
-ldflags "-s -w -X main.version=$VERSION" -o "$STAGE/$name/stalwart-migrate" ./cmd/stalwart-migrate)
|
|
cp "$ROOT/LICENSE" "$ROOT/README.md" "$STAGE/$name/"
|
|
# Fixed owner and time, so the same commit gives the same archive.
|
|
tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@${SOURCE_DATE_EPOCH:-0}" \
|
|
-C "$STAGE/$name" -czf "$OUT/$name.tar.gz" stalwart-migrate LICENSE README.md
|
|
done
|
|
|
|
(cd "$OUT" && sha256sum ./*.tar.gz | sed 's| \./| |' > SHA256SUMS)
|
|
echo "==> $OUT:"
|
|
(cd "$OUT" && cat SHA256SUMS)
|