4cc873883c
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
133 lines
6.1 KiB
YAML
133 lines
6.1 KiB
YAML
name: Linux release artifacts
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
bootstrap:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Validate bootstrap
|
|
run: |
|
|
bash -n deploy/ochenstarik-server-monitor-manager.sh
|
|
bash -n deploy/ochenstarik-smm-policy-apply
|
|
bash -n deploy/ochenstarik-smm-emergency
|
|
bash -n tests/bootstrap/run-native-systemd-smoke.sh
|
|
bash -n tests/bootstrap/run-systemd-container-smoke.sh
|
|
shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
|
|
shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
|
|
shellcheck --severity=error deploy/ochenstarik-smm-emergency
|
|
shellcheck --severity=error tests/bootstrap/run-native-systemd-smoke.sh
|
|
shellcheck --severity=error tests/bootstrap/run-systemd-container-smoke.sh
|
|
bash tests/bootstrap/test-bootstrap-contract.sh
|
|
|
|
- name: Package bootstrap
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
install -m 0755 deploy/ochenstarik-server-monitor-manager.sh ochenstarik-server-monitor-manager.sh
|
|
sha256sum ochenstarik-server-monitor-manager.sh > ochenstarik-server-monitor-manager.sh.sha256
|
|
bootstrap_sha="$(sha256sum ochenstarik-server-monitor-manager.sh | awk '{print $1}')"
|
|
jq -n \
|
|
--arg schema "smm-bootstrap-manifest/v1" \
|
|
--arg version "${GITHUB_REF_NAME}" \
|
|
--arg bootstrap "ochenstarik-server-monitor-manager.sh" \
|
|
--arg bootstrap_sha256 "$bootstrap_sha" \
|
|
'{schema: $schema, version: $version, bootstrap: $bootstrap, bootstrap_sha256: $bootstrap_sha256, supported_runtimes: ["linux-x64", "linux-arm64"]}' \
|
|
> server-monitor-manager-bootstrap-manifest.json
|
|
|
|
- name: Upload bootstrap artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: server-monitor-manager-bootstrap
|
|
path: |
|
|
ochenstarik-server-monitor-manager.sh
|
|
ochenstarik-server-monitor-manager.sh.sha256
|
|
server-monitor-manager-bootstrap-manifest.json
|
|
|
|
- name: Generate SBOM (bootstrap)
|
|
run: dotnet tool install --global CycloneDX && dotnet CycloneDX ServerMonitorManager.slnx -o sbom -j --filename server-monitor-manager-bootstrap-sbom || true
|
|
|
|
- name: Attach bootstrap to GitHub Release
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
|
|
permissions:
|
|
contents: write
|
|
with:
|
|
prerelease: ${{ contains(github.ref_name, '-') }}
|
|
files: |
|
|
ochenstarik-server-monitor-manager.sh
|
|
ochenstarik-server-monitor-manager.sh.sha256
|
|
server-monitor-manager-bootstrap-manifest.json
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
runtime: [linux-x64, linux-arm64]
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Set up .NET 10
|
|
uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- name: Publish agent
|
|
run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/agent
|
|
|
|
- name: Publish control
|
|
run: dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/control
|
|
|
|
- name: Publish provisioning helper
|
|
run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/provisioning-helper
|
|
|
|
- name: Package
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
install -d out/deploy out/bootstrap
|
|
install -m 0644 deploy/ochenstarik-smm-control.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-agent.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-provisioning-helper.service out/deploy/
|
|
install -m 0644 deploy/ochenstarik-smm-firewall.service out/deploy/
|
|
install -m 0755 deploy/ochenstarik-smm-policy-apply out/deploy/
|
|
install -m 0755 deploy/ochenstarik-smm-emergency out/deploy/
|
|
install -m 0755 deploy/ochenstarik-server-monitor-manager.sh out/bootstrap/
|
|
archive="server-monitor-manager-${{ matrix.runtime }}.tar.gz"
|
|
tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap
|
|
sha256sum "$archive" > "$archive.sha256"
|
|
|
|
- name: Generate SBOM
|
|
run: |
|
|
dotnet tool install --global CycloneDX
|
|
dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" || true
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: server-monitor-manager-${{ matrix.runtime }}
|
|
path: |
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
|
|
|
|
- name: Attach to GitHub Release
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
|
|
permissions:
|
|
contents: write
|
|
with:
|
|
prerelease: ${{ contains(github.ref_name, '-') }}
|
|
files: |
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz
|
|
server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
|