feat: add signed PostgreSQL release updates

2026-08-03 23:45:32 +08:00
parent 2524a37a07
commit f6e22cb670
99 changed files with 44671 additions and 284 deletions
@@ -0,0 +1,116 @@
+name: Signed Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      GITEA_BASE_URL: ${{ vars.GITEA_BASE_URL }}
+      GITEA_REPOSITORY: ${{ github.repository }}
+      GITEA_ALLOW_INSECURE_HTTP: ${{ vars.GITEA_ALLOW_INSECURE_HTTP }}
+      GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }}
+      RELEASE_PRIVATE_KEY_B64: ${{ secrets.RELEASE_PRIVATE_KEY_B64 }}
+      NODE_OPTIONS: --max-old-space-size=8192
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build, sign, and publish release
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          tag="${GITHUB_REF_NAME:?missing tag name}"
+          version="${tag#v}"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]] \
+            || { printf 'invalid release tag: %s\n' "$tag" >&2; exit 2; }
+
+          api_base="${GITEA_BASE_URL:?missing GITEA_BASE_URL repository variable}"
+          repository="${GITEA_REPOSITORY:-awaioi/ERP}"
+          case "$api_base" in
+            https://*) curl_protocols=(--proto '=https' --proto-redir '=https') ;;
+            http://*)
+              [[ "${GITEA_ALLOW_INSECURE_HTTP:-0}" == "1" || "${GITEA_ALLOW_INSECURE_HTTP:-0}" == "true" ]] \
+                || { printf 'GITEA_BASE_URL must use HTTPS\n' >&2; exit 1; }
+              curl_protocols=(--proto '=http,https' --proto-redir '=http,https')
+              ;;
+            *) printf 'invalid GITEA_BASE_URL\n' >&2; exit 1 ;;
+          esac
+          [[ "$repository" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] \
+            || { printf 'invalid GITEA_REPOSITORY\n' >&2; exit 1; }
+          [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing RELEASE_GITEA_TOKEN secret\n' >&2; exit 1; }
+          [[ -n "${RELEASE_PRIVATE_KEY_B64:-}" ]] \
+            || { printf 'missing RELEASE_PRIVATE_KEY_B64 secret\n' >&2; exit 1; }
+
+          umask 077
+          key_file="${RUNNER_TEMP:-/tmp}/kaidi-erp-release-key.pem"
+          cleanup() { rm -f "$key_file" release.json release-payload.json; }
+          trap cleanup EXIT
+          printf '%s' "$RELEASE_PRIVATE_KEY_B64" | base64 --decode > "$key_file"
+          export ERP_RELEASE_PRIVATE_KEY_FILE="$key_file"
+          bash scripts/package-release.sh "$version"
+
+          owner="${repository%%/*}"
+          repo="${repository#*/}"
+          release_api="${api_base%/}/api/v1/repos/$owner/$repo/releases"
+          auth_header="Authorization: token $GITEA_TOKEN"
+          status="$(curl "${curl_protocols[@]}" --silent --show-error --location \
+            --output release.json --write-out '%{http_code}' \
+            --header "$auth_header" --header 'Accept: application/json' \
+            "$release_api/tags/$tag")"
+
+          python3 - "$tag" > release-payload.json <<'PY'
+          import json, sys
+          tag = sys.argv[1]
+          print(json.dumps({
+              "tag_name": tag,
+              "name": tag,
+              "body": f"Kaidi ERP {tag}",
+              "draft": False,
+              "prerelease": "-" in tag.split("+", 1)[0],
+          }, separators=(",", ":")))
+          PY
+
+          if [[ "$status" == "404" ]]; then
+            curl "${curl_protocols[@]}" --fail-with-body --silent --show-error --location --retry 3 \
+              --header "$auth_header" --header 'Content-Type: application/json' \
+              --data-binary @release-payload.json --output release.json "$release_api"
+          elif [[ "$status" == "200" ]]; then
+            release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"
+            curl "${curl_protocols[@]}" --fail-with-body --silent --show-error --location --retry 3 \
+              --request PATCH --header "$auth_header" --header 'Content-Type: application/json' \
+              --data-binary @release-payload.json --output release.json "$release_api/$release_id"
+          else
+            printf 'Gitea release lookup returned HTTP %s\n' "$status" >&2
+            cat release.json >&2
+            exit 1
+          fi
+
+          release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"
+          for asset in "dist/kaidi-erp-$version.tar.gz" dist/SHA256SUMS dist/SHA256SUMS.sig; do
+            name="$(basename "$asset")"
+            encoded_name="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$name")"
+            existing_id="$(python3 - "$name" <<'PY'
+          import json, sys
+          release = json.load(open("release.json"))
+          print(next((item["id"] for item in release.get("assets", []) if item.get("name") == sys.argv[1]), ""))
+          PY
+          )"
+            if [[ -n "$existing_id" ]]; then
+              curl "${curl_protocols[@]}" --fail-with-body --silent --show-error --location --retry 3 \
+                --request DELETE --header "$auth_header" \
+                "$release_api/$release_id/assets/$existing_id"
+            fi
+            curl "${curl_protocols[@]}" --fail-with-body --silent --show-error --location --retry 3 \
+              --request POST --header "$auth_header" \
+              --form "attachment=@$asset" \
+              "$release_api/$release_id/assets?name=$encoded_name" >/dev/null
+          done
+
+          printf 'Published %s release %s\n' "$repository" "$tag"