97 lines
4.9 KiB
YAML
97 lines
4.9 KiB
YAML
|
# Generated by ore workflow generate — layer: release
|
||
|
|
# Source: .ontoref/ontology/workflow.ncl — distributions catalog
|
||
|
|
# Do not edit manually — regenerate with: ore workflow generate --layer release
|
||
|
|
#
|
||
|
|
# Daemon image is an OPTIONAL accelerator per ADR-029. Bundles install a
|
||
|
|
# daemon-less CLI; the image serves container deployments.
|
||
|
|
# CI prereqs: per-arch nickel under dist/nickel/<triple>/nickel; cosign key in
|
||
|
|
# $COSIGN_KEY and release upload token in $RELEASE_TOKEN from the src-vault.
|
||
|
|
|
||
|
|
when:
|
||
|
|
event: [tag, manual]
|
||
|
|
|
||
|
|
steps:
|
||
|
|
build-release-musl-x86:
|
||
|
|
image: rust:latest
|
||
|
|
commands:
|
||
|
|
- cargo install cross --locked
|
||
|
|
- cross build --target x86_64-unknown-linux-musl --release
|
||
|
|
|
||
|
|
build-release-musl-arm64:
|
||
|
|
image: rust:latest
|
||
|
|
commands:
|
||
|
|
- cargo install cross --locked
|
||
|
|
- cross build --target aarch64-unknown-linux-musl --release
|
||
|
|
|
||
|
|
build-sbom:
|
||
|
|
image: rust:latest
|
||
|
|
commands:
|
||
|
|
- cargo install cargo-sbom --locked
|
||
|
|
- cargo sbom > sbom.json
|
||
|
|
|
||
|
|
build-bundle-linux-x86:
|
||
|
|
image: rust:latest
|
||
|
|
depends_on: ["build-release-musl-x86"]
|
||
|
|
commands:
|
||
|
|
- cargo install nu --locked
|
||
|
|
- nu install/assemble-bundle.nu --target x86_64-unknown-linux-musl --version "${CI_COMMIT_TAG}" --nickel dist/nickel/x86_64-unknown-linux-musl/nickel
|
||
|
|
|
||
|
|
build-bundle-linux-arm64:
|
||
|
|
image: rust:latest
|
||
|
|
depends_on: ["build-release-musl-arm64"]
|
||
|
|
commands:
|
||
|
|
- cargo install nu --locked
|
||
|
|
- nu install/assemble-bundle.nu --target aarch64-unknown-linux-musl --version "${CI_COMMIT_TAG}" --nickel dist/nickel/aarch64-unknown-linux-musl/nickel
|
||
|
|
|
||
|
|
smoke-bundle:
|
||
|
|
image: rust:latest
|
||
|
|
depends_on: ["build-release-musl-x86"]
|
||
|
|
commands:
|
||
|
|
- cargo install nu --locked
|
||
|
|
- nu install/assemble-bundle.nu smoke --target x86_64-unknown-linux-musl
|
||
|
|
|
||
|
|
dist-oci-image:
|
||
|
|
image: quay.io/buildah/stable
|
||
|
|
depends_on: ["smoke-bundle", "build-release-musl-x86", "build-release-musl-arm64"]
|
||
|
|
commands:
|
||
|
|
- buildah from --name ont-amd64 --arch amd64 alpine:3.21
|
||
|
|
- buildah copy ont-amd64 target/x86_64-unknown-linux-musl/release/ontoref-daemon /usr/local/bin/ontoref-daemon
|
||
|
|
- buildah copy ont-amd64 dist/nickel/x86_64-unknown-linux-musl/nickel /usr/local/bin/nickel
|
||
|
|
- buildah copy ont-amd64 .ontoref/reflection /opt/ontoref/reflection
|
||
|
|
- buildah copy ont-amd64 ontology /opt/ontoref/ontology
|
||
|
|
- buildah config --port 7891 --env ONTOREF_ROOT=/opt/ontoref --env NICKEL_IMPORT_PATH=/opt/ontoref/ontology/schemas:/opt/ontoref/ontology --entrypoint '["ontoref-daemon"]' ont-amd64
|
||
|
|
- buildah commit --manifest ontoref-daemon ont-amd64 reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"-amd64
|
||
|
|
- buildah from --name ont-arm64 --arch arm64 alpine:3.21
|
||
|
|
- buildah copy ont-arm64 target/aarch64-unknown-linux-musl/release/ontoref-daemon /usr/local/bin/ontoref-daemon
|
||
|
|
- buildah copy ont-arm64 dist/nickel/aarch64-unknown-linux-musl/nickel /usr/local/bin/nickel
|
||
|
|
- buildah copy ont-arm64 .ontoref/reflection /opt/ontoref/reflection
|
||
|
|
- buildah copy ont-arm64 ontology /opt/ontoref/ontology
|
||
|
|
- buildah config --port 7891 --env ONTOREF_ROOT=/opt/ontoref --env NICKEL_IMPORT_PATH=/opt/ontoref/ontology/schemas:/opt/ontoref/ontology --entrypoint '["ontoref-daemon"]' ont-arm64
|
||
|
|
- buildah commit --manifest ontoref-daemon ont-arm64 reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"-arm64
|
||
|
|
- buildah manifest push --all ontoref-daemon docker://reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"
|
||
|
|
- cosign sign --key "$COSIGN_KEY" --yes reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"
|
||
|
|
- cosign attest --predicate sbom.json --type spdxjson --key "$COSIGN_KEY" --yes reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"
|
||
|
|
|
||
|
|
dist-oci-bundle-linux-x86:
|
||
|
|
image: ghcr.io/oras-project/oras:v1.2.0
|
||
|
|
depends_on: ["smoke-bundle", "build-bundle-linux-x86"]
|
||
|
|
commands:
|
||
|
|
- cd dist
|
||
|
|
- oras push reg.librecloud.online/ontoref/dist:"${CI_COMMIT_TAG}"-linux-amd64 ontoref-linux-amd64.tar.gz:application/vnd.ontoref.bundle.tar+gzip ontoref-linux-amd64.tar.gz.sha256:text/plain
|
||
|
|
|
||
|
|
dist-oci-bundle-linux-arm64:
|
||
|
|
image: ghcr.io/oras-project/oras:v1.2.0
|
||
|
|
depends_on: ["smoke-bundle", "build-bundle-linux-arm64"]
|
||
|
|
commands:
|
||
|
|
- cd dist
|
||
|
|
- oras push reg.librecloud.online/ontoref/dist:"${CI_COMMIT_TAG}"-linux-arm64 ontoref-linux-arm64.tar.gz:application/vnd.ontoref.bundle.tar+gzip ontoref-linux-arm64.tar.gz.sha256:text/plain
|
||
|
|
|
||
|
|
dist-installer:
|
||
|
|
image: curlimages/curl:latest
|
||
|
|
depends_on: ["smoke-bundle"]
|
||
|
|
commands:
|
||
|
|
# Publish the rendered installer to the plain HTTPS asset endpoint.
|
||
|
|
# PUT target and auth are deployment-specific; https://get.librecloud.online/ontoref/install.sh is the
|
||
|
|
# canonical URL users curl. Replace with your release-asset upload.
|
||
|
|
- 'curl -fsSL --fail -T install/install.sh -H "Authorization: Bearer $RELEASE_TOKEN" https://get.librecloud.online/ontoref/install.sh'
|