omarandClaude Opus 5
56a276bcc1
The fork had a full suite and no CI that ran it. Upstream's test workflows trigger on stable/testing/unstable; this repo only has main. And Gitea does not read .github/workflows at all once .gitea/workflows exists, so those files were decoration here. 115 of the 116 test files under shater/** had never executed in CI even once, which is how TestDNSFilterRemoteBlocklistHTTPClient stayed red across two published releases without anyone noticing. The gate is a job inside release.yml that build-apk needs, because a separate workflow cannot block another one. It runs the suite under the shipped tag set, on Linux — 6 of 7 test files in transport/wireguard and 12 in shater/generate compile only there or only under those tags, and those are exactly the files covering AmneziaWG. Three guards stop it from passing by running nothing, which is the failure this whole change is about. The tag set may only ADD test files, never remove one. Every package go list says has tests must appear as "ok <pkg>" in the output, so a suite that collapses to "no test files" fails instead of passing. And the panel run counts its test files first, because node --test exits 0 with "pass 0" when the glob matches nothing. The publish step used to exit 0 having published nothing: its assertions all live inside a loop over artifacts, so an empty directory ran the body zero times and reported success. It now counts what it published and fails on zero. Verified by extracting the shipped step text and running it against stubs: empty artifacts gives exit 0 before and exit 10 after; the rolling-release readback still fires its own exit 14. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
537 lines
28 KiB
YAML
537 lines
28 KiB
YAML
# Shater v0.2 — build the 4-package signed **apk** feed and publish it as
|
|
# per-arch Gitea releases consumable as an apk repository.
|
|
#
|
|
# WHAT WE SHIP
|
|
# ONE forked binary plus its OpenWrt glue, 4 packages, all built the canonical
|
|
# SDK way:
|
|
# - shaterd PREBUILT static-musl + SPA-embedded + UPX binary. Built
|
|
# OUT OF TREE by scripts/build-shaterd.sh (Go + Node + UPX)
|
|
# and staged into openwrt/shaterd/files/ BEFORE the SDK
|
|
# build; the openwrt/shaterd package just $(INSTALL_BIN)s
|
|
# the arch-matched artifact. (arch-specific .apk)
|
|
# - shater-core data glue, PKGARCH=all
|
|
# - luci-app-shater LuCI thin launcher, PKGARCH=all (uses feeds/luci/luci.mk)
|
|
# - byedpi ciadpi, C cross-compiled from source by the SDK (arch-specific)
|
|
#
|
|
# TARGET HARDWARE / ARCH MATRIX
|
|
# x86_64 -> the QEMU testbed VM (generic x86-64).
|
|
# aarch64_cortex-a53 -> BOTH production routers (BPI-R3 mini + BPI-R4,
|
|
# mediatek/filogic), both on 25.12 with apk-tools 3.
|
|
# Only shaterd + byedpi are arch-specific; shater-core + luci-app-shater are
|
|
# PKGARCH=all, so one build of each covers every device — but the RELEASES
|
|
# are still per-arch (see the release-apk job for why).
|
|
#
|
|
# FORMAT: apk ONLY (25.12+)
|
|
# The fleet runs OpenWrt/ImmortalWrt 25.12, where opkg is replaced by Alpine
|
|
# apk (.apk files, binary packages.adb index, EC keys in /etc/apk/keys/). The
|
|
# old .ipk lane was removed in 2026-07 (docs-shater/DECISIONS.md D22): no
|
|
# device we serve has an opkg binary at all, so building and signing a second
|
|
# feed served nobody.
|
|
#
|
|
# FEED SIGNING (EC / apk)
|
|
# packages.adb is signed with the EC (prime256v1) SECRET key in the Gitea repo
|
|
# secret KEY_APK; routers verify it with the committed public key
|
|
# dist/shater-apk.pem (ci/gen-apk-key.sh). Do NOT regenerate the key — that
|
|
# invalidates every deployed router's trust.
|
|
#
|
|
# AUTO-RELEASE
|
|
# push a tag `vX.Y.Z` -> versioned per-arch releases `apk-vX.Y.Z-<arch>`.
|
|
# workflow_dispatch -> rolling per-arch `apk-latest-<arch>` (always-fresh
|
|
# feed). Publish uses the Gitea API via curl (ci/gitea-release.sh) — no
|
|
# external action needed. NOTE: the apk release tags deliberately do NOT start
|
|
# with `v` so publishing them cannot re-trigger this workflow's `v*` filter.
|
|
#
|
|
# PACKAGE VERSIONING (bug B4)
|
|
# PKG_VERSION/PKG_RELEASE are NOT hand-written in the Makefiles any more. They
|
|
# used to be, and nobody bumped them: v0.2.2…v0.2.6 all shipped as
|
|
# `shaterd 0.2.0-r3` with different binaries inside, so `apk update` never saw
|
|
# a new version and routers could not be updated at all. Now `ci/version.sh`
|
|
# derives them from the git tag ONCE per job (the "Compute version" step,
|
|
# exported via $GITHUB_ENV):
|
|
# tag `vX.Y.Z` -> X.Y.Z-r1
|
|
# anything else -> <nearest tag>-r<commits since it + 1>
|
|
# and hands them to the SDK build as SHATER_PKG_VERSION/SHATER_PKG_RELEASE;
|
|
# $SHATER_VERSION (the same numbers, plus the short sha off-tag) is stamped
|
|
# into the binary's constant.Version. ci/sdk-build-apk.sh then ASSERTS that the
|
|
# built .apk really carry that version, so the failure can never be silent
|
|
# again. This is also why the build job checks out with fetch-depth: 0
|
|
# — `git describe` needs tags and ancestry. `byedpi` is excluded: it keeps
|
|
# upstream ByeDPI's own PKG_VERSION (see openwrt/byedpi/Makefile).
|
|
|
|
# CACHING (T3 — fast CI)
|
|
# All caches use actions/cache pinned to v3.3.2: the LAST release speaking the
|
|
# OLD cache API that Gitea's act_runner cache server implements. v4 (and the
|
|
# v3.4.x backports) moved to GitHub's new cache service and fail on act_runner
|
|
# — the same reason upload-artifact is pinned to v3 here. If the runner's
|
|
# cache server is disabled, actions/cache degrades to a warning and the build
|
|
# proceeds uncached (correct, just slower).
|
|
# What is cached, and why each key is safe:
|
|
# - ImmortalWrt SDK tarball (.cache/sdk) — key = tarball basename (carries
|
|
# release + target + gcc), exact-only. Cold-miss fallback chain lives in
|
|
# ci/fetch-sdk.sh: own Gitea release-asset mirror (tag `sdk-cache`) ->
|
|
# upstream with stall-kill + retries; upstream success re-seeds the mirror.
|
|
# - SDK dl/ sources (.cache/dl) — key = hash of openwrt/*/Makefile
|
|
# (PKG_VERSION/PKG_HASH live there). Stale-safe: the buildroot verifies
|
|
# PKG_HASH on every dl/ file and re-downloads on mismatch, so restore-keys
|
|
# prefix fallback is allowed.
|
|
# - Go module + build cache — key = hash of go.sum; shared by both build
|
|
# jobs (each builds both GOARCHes).
|
|
# - panel/node_modules — key = hash of panel/package-lock.json, exact-only
|
|
# (a lockfile change MUST miss); on hit build-shaterd.sh gets --fast.
|
|
# - apt .deb archives for the debian:bookworm host-deps of the apk SDK
|
|
# container (.cache/apt) — key = hash of ci/sdk-build-apk.sh (the apt list
|
|
# is in it).
|
|
# - SDK feeds/ git checkouts (.cache/feeds) — the single biggest recurring
|
|
# cost: `scripts/feeds update -a` cloned base+packages+luci+routing+
|
|
# telephony EVERY run (~7 min/job; github.com is ~1 MB/s from this
|
|
# runner — run 51 evidence). The feeds dir is symlinked into the SDK
|
|
# container from the workspace cache; `feeds update` on an existing clone
|
|
# is a fast fetch+checkout of the pinned revs. Correctness-safe: update
|
|
# always checks out feeds.conf's pins, and ci/sdk-build-apk.sh wipes the
|
|
# cache + re-clones fresh if update ever fails on a cached checkout.
|
|
# Key = lane + SDK release (shared across the two arch jobs — the same
|
|
# release pins identical feed revs; the sequential runner means the second
|
|
# arch restores what the first saved). restore-keys lets an SDK version
|
|
# bump start from the old clones (git fetch delta, not re-clone).
|
|
# Act_runner facts this design leans on (verified in run 51 logs):
|
|
# - the cache backend works: restores/saves confirmed, hashFiles() works;
|
|
# - docker images (debian:bookworm, runner-images) live on the PERSISTENT
|
|
# host daemon — "Image is up to date" each run, no re-download;
|
|
# - each actions/cache SAVE is followed by an exact 3-minute act_runner
|
|
# stall (node process lingers; hit→no-save→no stall). Steady state saves
|
|
# nothing, so adding cache entries is fine, but keys that change every
|
|
# run (e.g. github.sha) would cost +3 min/entry/run — do NOT do that.
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
# A re-dispatch supersedes the still-running build of the same ref: cancel it
|
|
# instead of piling up parallel runs (the user re-triggers often). Tag builds
|
|
# are safe: each tag is its own group, so a release build is only ever cancelled
|
|
# by a re-run of the SAME tag (which supersedes it by definition). Gitea
|
|
# versions without concurrency support ignore this block harmlessly.
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# ---------------------------------------------------------------------------
|
|
# THE TEST GATE (2026-07-26). Everything below `needs:` this job, so a red test
|
|
# stops the release instead of shipping with it.
|
|
#
|
|
# WHY IT IS A JOB HERE AND NOT JUST .gitea/workflows/test.yml: a separate
|
|
# workflow cannot block another one — they run side by side and a red `test`
|
|
# workflow would have published anyway. Only a `needs:` edge inside THIS
|
|
# workflow is a gate. test.yml exists too, for fast feedback on `main`; both
|
|
# call the same scripts/run-tests.sh so they cannot drift.
|
|
#
|
|
# WHAT WAS BROKEN: the release tract ran two `go test` invocations in total —
|
|
# build-shaterd.sh's one-package buildtags check and check-router-tags.sh's
|
|
# three named tests. 115 of the 116 test files under shater/** had never run in
|
|
# CI (upstream's .github/workflows/test.yml triggers on branches this fork does
|
|
# not have, and Gitea ignores .github/workflows entirely once .gitea/workflows
|
|
# exists). TestDNSFilterRemoteBlocklistHTTPClient shipped red twice.
|
|
#
|
|
# WHAT IT COVERS: the whole suite under the SHIPPED build tags
|
|
# (scripts/router-tags.sh) on linux — the two dimensions that were missing.
|
|
# transport/wireguard compiles 1 test file without the tag set and 7 with it
|
|
# (the AmneziaWG ones); shater/generate has 44 test files on linux against 32
|
|
# elsewhere. Plus a -race pass and the panel's TypeScript tests. Details and
|
|
# the named, reasoned exclusions are in scripts/run-tests.sh.
|
|
test:
|
|
name: test gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# go.mod `replace`s wireguard-go to ./submodules/wireguard-go, so without
|
|
# this even `go list` fails. Same step/reason as in build-apk below.
|
|
- name: Init wireguard-go submodule (awg)
|
|
run: git submodule update --init --depth 1 submodules/wireguard-go
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false # explicit actions/cache@v3.3.2 below
|
|
|
|
# Same cache key as build-apk: this job runs first, so it warms the module
|
|
# + build cache the SDK-lane build then restores. (v3.3.2 pin: see header.)
|
|
- name: Cache Go modules + build cache
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: |
|
|
~/go/pkg/mod
|
|
~/.cache/go-build
|
|
key: go-${{ hashFiles('go.sum') }}
|
|
restore-keys: |
|
|
go-
|
|
|
|
# Node 24, NOT the 20 build-apk uses for the SPA: panel's tests are
|
|
# TypeScript run directly by `node --test`, and type stripping only exists
|
|
# from 22.6 — on node 20 `npm test` dies before running a single case.
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
|
|
- name: Cache panel node_modules
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: panel/node_modules
|
|
key: npm-${{ hashFiles('panel/package-lock.json') }}
|
|
|
|
- name: Panel tests
|
|
run: bash scripts/run-panel-tests.sh
|
|
|
|
- name: Go tests (shipped tags, linux, + race)
|
|
run: bash scripts/run-tests.sh
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build the 4 packages through the ImmortalWrt 25.12 apk-SDK for the 25.12/apk
|
|
# fleet (BPI-R3 mini on BananaWRT 25.12-mtk-vendor, BPI-R4 on OpenWrt 25.12,
|
|
# and the testbed VM). Produces a per-arch apk repo dir: *.apk + EC-signed
|
|
# packages.adb + shater-apk.pem, uploaded as the artifact `apkfeed-<arch>`.
|
|
build-apk:
|
|
name: apk ${{ matrix.arch }}
|
|
# THE GATE EDGE. A red test skips this job, which leaves no artifact, which
|
|
# (with the guards in release-apk) leaves nothing published.
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# ImmortalWrt 25.12.1 official SDK tarballs (no immortalwrt/sdk docker
|
|
# tag exists for mediatek-filogic 25.12 — see ci/build-feed-apk.sh).
|
|
- arch: x86_64 # testbed VM
|
|
sdk_url: https://downloads.immortalwrt.org/releases/25.12.1/targets/x86/64/immortalwrt-sdk-25.12.1-x86-64_gcc-14.3.0_musl.Linux-x86_64.tar.zst
|
|
- arch: aarch64_cortex-a53 # BPI-R3 mini (BananaWRT 25.12-mtk-vendor) + BPI-R4
|
|
sdk_url: https://downloads.immortalwrt.org/releases/25.12.1/targets/mediatek/filogic/immortalwrt-sdk-25.12.1-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
|
|
steps:
|
|
# fetch-depth: 0 — the package version is DERIVED from the git tag
|
|
# (ci/version.sh: nearest `vX.Y.Z` + commits since it). The default
|
|
# shallow checkout has neither tags nor ancestry, so `git describe` would
|
|
# fail and every dispatch build would fall back to 0.0.0.
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# scripts/build-shaterd.sh builds the AmneziaWG-patched wireguard-go via a
|
|
# go.mod `replace => ./submodules/wireguard-go`, so that submodule must be
|
|
# present. actions/checkout does not fetch submodules by default; init ONLY
|
|
# this one (the clients/apple+android submodules are large and unneeded).
|
|
- name: Init wireguard-go submodule (awg)
|
|
run: git submodule update --init --depth 1 submodules/wireguard-go
|
|
|
|
# THE version step (bug B4). One computation, used by both the binary
|
|
# (constant.Version) and the three tag-versioned packages, exported to
|
|
# every later step of this job:
|
|
# tag vX.Y.Z -> X.Y.Z-r1 ; off-tag -> <last tag>-r<commits+1>
|
|
- name: Compute version from git tag
|
|
run: bash ci/version.sh --env >> "$GITHUB_ENV"
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false # explicit actions/cache@v3.3.2 below
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
# ---- caches (see the header comment for keys + version pin rationale) ----
|
|
- name: Cache Go modules + build cache
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: |
|
|
~/go/pkg/mod
|
|
~/.cache/go-build
|
|
key: go-${{ hashFiles('go.sum') }}
|
|
restore-keys: |
|
|
go-
|
|
|
|
- name: Cache panel node_modules
|
|
id: npm-cache
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: panel/node_modules
|
|
key: npm-${{ hashFiles('panel/package-lock.json') }}
|
|
|
|
- name: Cache SDK dl/ (package sources)
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: .cache/dl
|
|
key: dl-${{ hashFiles('openwrt/*/Makefile') }}
|
|
restore-keys: |
|
|
dl-
|
|
|
|
- name: Cache apt archives (bookworm host-deps)
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: .cache/apt
|
|
key: apt-bookworm-${{ hashFiles('ci/sdk-build-apk.sh') }}
|
|
restore-keys: |
|
|
apt-bookworm-
|
|
|
|
# The ~300 MB SDK tarball was re-downloaded EVERY run from
|
|
# downloads.immortalwrt.org, which flakes/stalls (>40 min hangs). Cache it
|
|
# by tarball basename (exact key: an SDK version bump = clean miss); on a
|
|
# cold miss ci/fetch-sdk.sh falls back to our own `sdk-cache` release-asset
|
|
# mirror, then to upstream with stall-kill + retries (and re-seeds the
|
|
# mirror) — so even with a dead cache server this never wedges the run.
|
|
- name: Compute SDK cache key
|
|
id: sdkkey
|
|
run: |
|
|
echo "tarball=$(basename '${{ matrix.sdk_url }}')" >> "$GITHUB_OUTPUT"
|
|
echo "relver=$(echo '${{ matrix.sdk_url }}' | sed -n 's#.*/releases/\([^/]*\)/.*#\1#p')" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache ImmortalWrt SDK tarball
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: .cache/sdk
|
|
key: sdk-${{ steps.sdkkey.outputs.tarball }}
|
|
|
|
# feeds git checkouts (see header) — one entry shared by both apk arch
|
|
# jobs of one ImmortalWrt release (identical feeds.conf.default pins).
|
|
- name: Cache SDK feeds checkouts
|
|
uses: actions/cache@v3.3.2
|
|
with:
|
|
path: .cache/feeds
|
|
key: feeds-apk-${{ steps.sdkkey.outputs.relver }}
|
|
restore-keys: |
|
|
feeds-apk-
|
|
|
|
# D23 — the shipped tag set is a TRIMMED subset (scripts/router-tags.sh);
|
|
# everything else in CI builds with the full upstream set, so without this
|
|
# step the one combination we actually ship is never exercised. That is how
|
|
# `with_gvisor` was trimmed while `with_wireguard` stayed and every shipped
|
|
# binary answered a WireGuard node with "gVisor is not included in this
|
|
# build" (2026-07-25). The check runs the declared-feature/tag comparison
|
|
# and then constructs one node of every declared protocol through box.New
|
|
# UNDER THE SHIPPED TAGS. It runs before the artifact build so a tag trim
|
|
# that breaks a feature fails the release instead of shipping.
|
|
- name: Verify the shipped build-tag set (D23)
|
|
run: bash scripts/check-router-tags.sh
|
|
|
|
- name: Install UPX
|
|
run: sudo apt-get update -qq && sudo apt-get install -y -qq upx-ucl
|
|
|
|
# Artifact-order contract: the SPA-embedded shaterd binary is built OUT of
|
|
# the SDK and staged into openwrt/shaterd/files/ BEFORE the package build
|
|
# (the openwrt/shaterd package only installs the staged artifact).
|
|
# $SHATER_VERSION (from the version step above) is stamped into
|
|
# constant.Version, so the binary and the package agree. On an exact
|
|
# node_modules cache hit, --fast skips the redundant `npm ci`.
|
|
- name: Build & stage shaterd artifact
|
|
env:
|
|
NPM_CACHE_HIT: ${{ steps.npm-cache.outputs.cache-hit }}
|
|
run: |
|
|
set -eu
|
|
FAST=""
|
|
if [ "${NPM_CACHE_HIT:-}" = "true" ]; then FAST="--fast"; fi
|
|
echo "shaterd version: $SHATER_VERSION / package ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE} (npm cache hit: ${NPM_CACHE_HIT:-false})"
|
|
bash scripts/build-shaterd.sh $FAST
|
|
|
|
# Compile the 4 packages as .apk through the ImmortalWrt 25.12 SDK and
|
|
# sign the per-arch packages.adb with the EC key (secret KEY_APK).
|
|
# MIRROR_TOKEN lets ci/fetch-sdk.sh seed the `sdk-cache` mirror release
|
|
# after a (rare) upstream download — best-effort, never fails the build.
|
|
- name: Build signed apk feed (ImmortalWrt 25.12 SDK)
|
|
env:
|
|
KEY_APK: ${{ secrets.KEY_APK }}
|
|
MIRROR_TOKEN: ${{ secrets.RELEASE_TOKEN != '' && secrets.RELEASE_TOKEN || github.token }}
|
|
run: bash ci/build-feed-apk.sh "${{ matrix.arch }}" "${{ matrix.sdk_url }}" "out-apk/${{ matrix.arch }}"
|
|
|
|
- name: Show apk feed
|
|
run: ls -l "out-apk/${{ matrix.arch }}"
|
|
|
|
- name: Upload apk feed artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: apkfeed-${{ matrix.arch }}
|
|
path: out-apk/${{ matrix.arch }}/*
|
|
if-no-files-found: error
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Publish: ONE release PER ARCH (apk package filenames carry no arch, and apk
|
|
# fetches `<name>-<ver>.apk` relative to the packages.adb URL — a flat
|
|
# multi-arch release would collide). Every run refreshes the ROLLING pointer
|
|
# `apk-latest-<arch>`; a `vX.Y.Z` tag run ALSO publishes the pinnable
|
|
# `apk-vX.Y.Z-<arch>`. The tags do NOT match the workflow's `v*` trigger, so
|
|
# publishing them cannot re-trigger the build.
|
|
#
|
|
# WHY THE ROLLING RELEASE IS PUBLISHED ON TAG RUNS TOO (fixed 2026-07-25):
|
|
# it used to be an either/or — `TAG=apk-latest-<arch>` on dispatch, ELSE
|
|
# `TAG=apk-<ver>-<arch>` — so once releases moved to tag pushes the rolling
|
|
# pointer was never written again. It froze at 0.2.0 (published 2026-07-24)
|
|
# while v0.2.9/v0.2.10 published fine, and every router whose
|
|
# /etc/apk/repositories.d/shater.list points at the rolling URL kept getting a
|
|
# successful, silent `apk update` with nothing new. Rolling is the whole point
|
|
# of that URL, so it is now written unconditionally and asserted afterwards.
|
|
release-apk:
|
|
name: release apk
|
|
needs: [test, build-apk]
|
|
# Publish whatever arch feeds succeeded — do NOT block the aarch64 release
|
|
# when an unrelated arch (e.g. x86_64) fails. download-artifact only fetches
|
|
# artifacts that exist, and the publish loop skips missing apkfeed-* dirs.
|
|
#
|
|
# `needs.test.result == 'success'` is the second half of the gate. Without
|
|
# it, `!cancelled()` is true when the test job FAILS (build-apk is then
|
|
# skipped), this job runs with no artifacts at all, and — see the guard at
|
|
# the end of the publish step — used to exit 0 having published nothing. Red
|
|
# tests must SKIP this job, not "succeed" through it.
|
|
if: ${{ !cancelled() && needs.test.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download all arch apk feeds
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
path: artifacts
|
|
|
|
# Identity of the VERSIONED release only. The rolling pointer is published
|
|
# on every run with fixed prerelease=true/rolling=true, so it needs nothing
|
|
# from here.
|
|
- name: Determine release identity
|
|
id: rel
|
|
run: |
|
|
set -eu
|
|
if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
|
|
echo "ver=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
|
|
echo "prerelease=false" >> "$GITHUB_OUTPUT"
|
|
echo "rolling=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "ver=latest" >> "$GITHUB_OUTPUT"
|
|
echo "prerelease=true" >> "$GITHUB_OUTPUT"
|
|
echo "rolling=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Publish per-arch apk releases
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN != '' && secrets.RELEASE_TOKEN || github.token }}
|
|
VER: ${{ steps.rel.outputs.ver }}
|
|
PRERELEASE: ${{ steps.rel.outputs.prerelease }}
|
|
ROLLING: ${{ steps.rel.outputs.rolling }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Counted, and asserted non-zero at the end. Until 2026-07-26 this loop
|
|
# was the step's whole body: with no artifacts the glob stayed
|
|
# unexpanded, `[ -d ... ]` was false, `continue` ran once, the loop
|
|
# ended and the step exited 0 — "release apk" went GREEN having
|
|
# published absolutely nothing. Any upstream failure (all arches
|
|
# failing to build, an artifact-name change, a download-artifact
|
|
# hiccup) therefore looked like a successful release.
|
|
published=0
|
|
for d in artifacts/apkfeed-*; do
|
|
[ -d "$d" ] || continue
|
|
arch="${d#artifacts/apkfeed-}"
|
|
ROLL="apk-latest-$arch"
|
|
|
|
# The version we just built, read straight off the artifact
|
|
# (`shaterd-<ver>-r<rel>.apk`). NOT recomputed with ci/version.sh:
|
|
# this job checks out shallow, so it has no tags to describe from.
|
|
pkg=""
|
|
for a in "$d"/shaterd-*.apk; do
|
|
if [ -f "$a" ]; then pkg="$(basename "$a")"; fi
|
|
done
|
|
[ -n "$pkg" ] || { echo "[release-apk] ERROR: no shaterd-*.apk in $d"; exit 11; }
|
|
want="${pkg#shaterd-}"; want="${want%.apk}"
|
|
echo "[release-apk] arch=$arch built version=$want"
|
|
|
|
BODY="Automated apk (OpenWrt/ImmortalWrt 25.12+) package repo for \`$arch\`.
|
|
Packages: shaterd + byedpi (per-arch), shater-core + luci-app-shater (arch=all).
|
|
This build: \`$want\`.
|
|
The index \`packages.adb\` is EC-signed; trust anchor \`shater-apk.pem\` (also in \`dist/\`).
|
|
|
|
── Add as an apk repository (rolling — install once, then just update) ──
|
|
wget -O /etc/apk/keys/shater-apk.pem https://git.qomar.pw/omar/shater/releases/download/$ROLL/shater-apk.pem
|
|
echo \"https://git.qomar.pw/omar/shater/releases/download/apk-latest-\$(cat /etc/apk/arch)/packages.adb\" > /etc/apk/repositories.d/shater.list
|
|
apk update
|
|
apk add luci-app-shater # pulls shater-core + shaterd too
|
|
apk add byedpi # optional: ByeDPI desync egress
|
|
\`apk-latest-<arch>\` is a MOVING pointer: every release run replaces its
|
|
assets, so the same repo line keeps serving the newest build. To pin a
|
|
version instead, point the repo line at
|
|
\`.../download/apk-vX.Y.Z-\$(cat /etc/apk/arch)/packages.adb\` — then the
|
|
file must be edited by hand for each upgrade.
|
|
── Update — ALWAYS name the packages, NEVER a bare \`apk upgrade\` ──
|
|
apk update
|
|
apk upgrade shaterd shater-core luci-app-shater byedpi
|
|
A bare \`apk upgrade\` reconciles EVERY installed package against every
|
|
configured repo and can downgrade unrelated system packages; naming them
|
|
upgrades only those (apk-tools 3: \"If list of packages is provided, only
|
|
those packages are upgraded along with needed dependencies\").
|
|
Full guide: docs-shater/INSTALL.md §5."
|
|
|
|
# 1) the pinnable versioned release (tag runs only)
|
|
if [ "$VER" != latest ]; then
|
|
echo "[release-apk] publishing apk-$VER-$arch from $d"
|
|
TAG="apk-$VER-$arch" NAME="shater apk $VER ($arch)" BODY="$BODY" \
|
|
PRERELEASE="$PRERELEASE" ROLLING="$ROLLING" \
|
|
bash ci/gitea-release.sh "$d"/*
|
|
fi
|
|
|
|
# 2) the rolling pointer — ALWAYS, tag run included. ci/gitea-release.sh
|
|
# deletes the existing release before recreating it, so the old
|
|
# version's assets are REPLACED, never accumulated (two versions of
|
|
# one package in one index would let apk choose, not us).
|
|
echo "[release-apk] publishing $ROLL from $d"
|
|
TAG="$ROLL" NAME="shater apk latest ($arch)" BODY="$BODY" \
|
|
PRERELEASE=true ROLLING=true \
|
|
bash ci/gitea-release.sh "$d"/*
|
|
|
|
# 3) ASSERT the rolling release really serves THIS build — same class
|
|
# of check as ci/sdk-build-apk.sh's package-version assert, and for
|
|
# the same reason: the previous failure mode was silent. Reads the
|
|
# published release back over the API and requires our three
|
|
# tag-versioned packages at $want, the index, the key — and NO
|
|
# left-over package asset at any other version.
|
|
api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$ROLL"
|
|
got="$(curl -fsS -H "Authorization: token $TOKEN" "$api" \
|
|
| tr '{},' '\n\n\n' \
|
|
| sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sort -u)" || {
|
|
echo "[release-apk] ERROR: cannot read back $ROLL from the API"; exit 12; }
|
|
echo "[release-apk] $ROLL assets: $(printf '%s ' $got)"
|
|
# here-string, NOT `printf | grep -q`: under `pipefail` the early
|
|
# exit of grep -q can SIGPIPE the writer and fail a passing check.
|
|
for f in "shaterd-$want.apk" "shater-core-$want.apk" \
|
|
"luci-app-shater-$want.apk" packages.adb shater-apk.pem; do
|
|
grep -qxF "$f" <<<"$got" || {
|
|
echo "[release-apk] ERROR: $ROLL does not contain '$f' after publish."
|
|
echo " A router pinned to the rolling URL would have silently"
|
|
echo " stayed on its old version with a successful apk update."
|
|
exit 13; }
|
|
done
|
|
stale="$(grep -E '^(shaterd|shater-core|luci-app-shater)-.*\.apk$' <<<"$got" \
|
|
| grep -vxF -e "shaterd-$want.apk" -e "shater-core-$want.apk" \
|
|
-e "luci-app-shater-$want.apk" || true)"
|
|
[ -z "$stale" ] || {
|
|
echo "[release-apk] ERROR: $ROLL still holds stale package assets:"
|
|
printf ' %s\n' $stale
|
|
echo " Two versions of one package in one feed = apk picks by its"
|
|
echo " own rules, not by our intent."
|
|
exit 14; }
|
|
echo "[release-apk] OK — $ROLL serves $want"
|
|
published=$((published + 1))
|
|
done
|
|
|
|
# The assert the loop above never had. Zero feeds published is a failed
|
|
# release, not a quiet success — say so with a non-zero exit.
|
|
if [ "$published" -eq 0 ]; then
|
|
echo "[release-apk] ERROR: no apkfeed-* artifact reached this job, so"
|
|
echo " NOTHING was published. Downloaded tree:"
|
|
ls -la artifacts 2>&1 | sed 's/^/ /' || echo " (no artifacts/ dir at all)"
|
|
exit 10
|
|
fi
|
|
echo "[release-apk] published $published arch feed(s)"
|