97 lines
2.5 KiB
YAML
97 lines
2.5 KiB
YAML
---
|
|
|
|
# NOTE: most functionality (apart from building) is abstracted by this include
|
|
include:
|
|
- project: 'archlinux/ci-scripts'
|
|
ref: master
|
|
file: '/prepare_archiso_vm.yml'
|
|
|
|
variables:
|
|
BUILD_SCRIPT: ./.gitlab/ci/build_releng.sh
|
|
PACKAGE_LIST: archiso erofs-utils ipxe openssl zsync python python-jinja python-orjson
|
|
QEMU_BUILD_TIMEOUT: 2400
|
|
QEMU_COPY_ARTIFACTS_TIMEOUT: 120
|
|
QEMU_VM_MEMORY: 3072
|
|
ARCHISO_COW_SPACE_SIZE: 2g
|
|
|
|
stages:
|
|
- check
|
|
- build
|
|
- prepare
|
|
- publish
|
|
|
|
shellcheck:
|
|
before_script:
|
|
- pacman --noconfirm -Syu --needed make shellcheck
|
|
script:
|
|
- make check
|
|
stage: check
|
|
|
|
build:
|
|
except:
|
|
- master@archlinux/releng
|
|
- schedules@archlinux/releng
|
|
- tags@archlinux/releng
|
|
extends: .build
|
|
script:
|
|
- |
|
|
if [[ -n "${SECRET_CODESIGNING_KEY_FILE}" && -n "${SECRET_CODESIGNING_CERT_FILE}" ]]; then
|
|
cp -- "${SECRET_CODESIGNING_CERT_FILE}" codesign.crt
|
|
cp -- "${SECRET_CODESIGNING_KEY_FILE}" codesign.key
|
|
fi
|
|
- ./ci-scripts/scripts/build_in_archiso_vm.sh
|
|
tags:
|
|
- fast-single-thread
|
|
|
|
secure_build:
|
|
extends: .build
|
|
only:
|
|
- master@archlinux/releng
|
|
- schedules@archlinux/releng
|
|
- tags@archlinux/releng
|
|
script:
|
|
- |
|
|
if [[ -n "${SECRET_CODESIGNING_KEY_FILE}" && -n "${SECRET_CODESIGNING_CERT_FILE}" ]]; then
|
|
cp -- "${SECRET_CODESIGNING_CERT_FILE}" codesign.crt
|
|
cp -- "${SECRET_CODESIGNING_KEY_FILE}" codesign.key
|
|
fi
|
|
- ./ci-scripts/scripts/build_in_archiso_vm.sh
|
|
tags:
|
|
- secure
|
|
|
|
prepare_release:
|
|
artifacts:
|
|
reports:
|
|
dotenv: variables.env
|
|
rules:
|
|
- if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_PROJECT_PATH == "archlinux/releng" && $SCHEDULED_PUBLISH == "TRUE"'
|
|
script:
|
|
- printf "TAG=%(%Y.%m.%d)T.%s\n" -1 "${CI_JOB_ID}" > variables.env
|
|
- printf "VERSION=%(%Y.%m.%d)T\n" -1 >> variables.env
|
|
stage: prepare
|
|
tags:
|
|
- secure
|
|
|
|
create_release:
|
|
before_script:
|
|
- pacman -Syu --needed --noconfirm release-cli
|
|
needs:
|
|
- job: prepare_release
|
|
artifacts: true
|
|
release:
|
|
name: 'Release ${TAG}'
|
|
description: 'Auto-created release ${TAG} (version ${VERSION}).'
|
|
tag_name: '$TAG'
|
|
ref: '$CI_COMMIT_SHA'
|
|
assets:
|
|
links:
|
|
- name: 'Build artifacts'
|
|
url: '${CI_PROJECT_URL}/-/jobs/artifacts/${TAG}/browse/output?job=secure_build'
|
|
rules:
|
|
- if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_PROJECT_PATH == "archlinux/releng" && $SCHEDULED_PUBLISH == "TRUE"'
|
|
script:
|
|
- printf "Creating release %s...\n" "${TAG}"
|
|
stage: publish
|
|
tags:
|
|
- secure
|