4cc873883c
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
153 lines
5.7 KiB
YAML
153 lines
5.7 KiB
YAML
name: Linux platform matrix
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/linux-platform-matrix.yml'
|
|
- 'deploy/**'
|
|
- 'src/ServerMonitorManager.Agent/**'
|
|
- 'src/ServerMonitorManager.Control/**'
|
|
- 'src/ServerMonitorManager.Core/**'
|
|
- 'tests/bootstrap/**'
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/workflows/linux-platform-matrix.yml'
|
|
- 'deploy/**'
|
|
- 'src/ServerMonitorManager.Agent/**'
|
|
- 'src/ServerMonitorManager.Control/**'
|
|
- 'src/ServerMonitorManager.Core/**'
|
|
- 'tests/bootstrap/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: linux-platform-matrix-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
release-archive:
|
|
name: Release archive (${{ matrix.runtime }})
|
|
runs-on: ubuntu-24.04
|
|
strategy:
|
|
matrix:
|
|
runtime: [linux-x64, linux-arm64]
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Set up .NET 10
|
|
uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- name: Publish compatible release
|
|
run: |
|
|
set -Eeuo pipefail
|
|
dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
|
|
--configuration Release --runtime '${{ matrix.runtime }}' --self-contained true \
|
|
-p:PublishSingleFile=true -p:PublishTrimmed=true -o out/agent
|
|
dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
|
|
--configuration Release --runtime '${{ matrix.runtime }}' --self-contained true \
|
|
-p:PublishSingleFile=true -p:PublishTrimmed=true -o out/control
|
|
dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj \
|
|
--configuration Release --runtime '${{ matrix.runtime }}' --self-contained true \
|
|
-p:PublishSingleFile=true -p:PublishTrimmed=true -o out/provisioning-helper
|
|
install -d out/deploy out/bootstrap
|
|
install -m 0644 deploy/ochenstarik-smm-control.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-agent.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-provisioning-helper.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-firewall.service out/deploy/
|
|
install -m 0755 deploy/ochenstarik-smm-policy-apply out/deploy/
|
|
install -m 0755 deploy/ochenstarik-smm-emergency out/deploy/
|
|
install -m 0755 deploy/ochenstarik-server-monitor-manager.sh out/bootstrap/
|
|
archive='server-monitor-manager-${{ matrix.runtime }}.tar.gz'
|
|
tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap
|
|
sha256sum "$archive" >"$archive.sha256"
|
|
|
|
- name: Upload release archive
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: server-monitor-manager-${{ matrix.runtime }}-matrix
|
|
path: |
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
|
|
|
|
ubuntu-vm:
|
|
name: ${{ matrix.name }} native VM
|
|
needs: release-archive
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: Ubuntu 22.04 x64
|
|
runner: ubuntu-22.04
|
|
runtime: linux-x64
|
|
- name: Ubuntu 24.04 x64
|
|
runner: ubuntu-24.04
|
|
runtime: linux-x64
|
|
- name: Ubuntu 22.04 arm64
|
|
runner: ubuntu-22.04-arm
|
|
runtime: linux-arm64
|
|
- name: Ubuntu 24.04 arm64
|
|
runner: ubuntu-24.04-arm
|
|
runtime: linux-arm64
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Download release archive
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: server-monitor-manager-${{ matrix.runtime }}-matrix
|
|
path: artifacts
|
|
|
|
- name: Install twice and restart services
|
|
run: |
|
|
bash tests/bootstrap/run-native-systemd-smoke.sh \
|
|
'artifacts/server-monitor-manager-${{ matrix.runtime }}.tar.gz' \
|
|
deploy/ochenstarik-server-monitor-manager.sh
|
|
|
|
debian-systemd:
|
|
name: ${{ matrix.name }} systemd restart
|
|
needs: release-archive
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: Debian 12 x64
|
|
runner: ubuntu-24.04
|
|
runtime: linux-x64
|
|
image: debian:12
|
|
- name: Debian 13 x64
|
|
runner: ubuntu-24.04
|
|
runtime: linux-x64
|
|
image: debian:13
|
|
- name: Debian 12 arm64
|
|
runner: ubuntu-24.04-arm
|
|
runtime: linux-arm64
|
|
image: debian:12
|
|
- name: Debian 13 arm64
|
|
runner: ubuntu-24.04-arm
|
|
runtime: linux-arm64
|
|
image: debian:13
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Download release archive
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: server-monitor-manager-${{ matrix.runtime }}-matrix
|
|
path: artifacts
|
|
|
|
- name: Install twice and restart systemd container
|
|
run: |
|
|
bash tests/bootstrap/run-systemd-container-smoke.sh \
|
|
'${{ matrix.image }}' \
|
|
'artifacts/server-monitor-manager-${{ matrix.runtime }}.tar.gz' \
|
|
deploy/ochenstarik-server-monitor-manager.sh
|