ahdoawhfo
e4ef47c901
act_runner's job containers live on a temporary bridge network that does not inherit the runner's own egress path, so apt-get against Canonical mirrors can time out even on a US host. Remove the apt step, rely on the tools baked into gitea/runner-images, and fetch the shellcheck static binary over HTTPS when it is missing. Also add a short network diagnostics step to make future egress issues obvious at a glance. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
278 lines
10 KiB
YAML
278 lines
10 KiB
YAML
name: Build and Release
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
version:
|
||
description: '版本号 (留空则自动生成 v<YYYY.MM.DD>-<short-sha>)'
|
||
required: false
|
||
default: ''
|
||
prerelease:
|
||
description: '标记为预发布 (Pre-release)'
|
||
required: false
|
||
default: 'false'
|
||
type: choice
|
||
options:
|
||
- 'false'
|
||
- 'true'
|
||
draft:
|
||
description: '以草稿方式创建 Release (不对外公开)'
|
||
required: false
|
||
default: 'false'
|
||
type: choice
|
||
options:
|
||
- 'false'
|
||
- 'true'
|
||
skip_tests:
|
||
description: '跳过单元测试 (紧急构建时使用)'
|
||
required: false
|
||
default: 'false'
|
||
type: choice
|
||
options:
|
||
- 'false'
|
||
- 'true'
|
||
|
||
jobs:
|
||
build-release:
|
||
runs-on: ubuntu-latest
|
||
env:
|
||
# 仓库使用 SHA-256 对象格式，actions/checkout 内部 `git init` 需在此模式下运行，否则 fetch 会报
|
||
# `mismatched algorithms: client sha1; server sha256`。
|
||
GIT_DEFAULT_HASH: sha256
|
||
steps:
|
||
- name: Checkout (full history)
|
||
uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 0
|
||
|
||
- name: Network diagnostics
|
||
run: |
|
||
set +e
|
||
echo "=== DNS ==="
|
||
cat /etc/resolv.conf 2>/dev/null | head -5 || true
|
||
echo "=== Route ==="
|
||
ip route 2>/dev/null | head -3 || true
|
||
echo "=== Egress probe (5s connect timeout) ==="
|
||
for url in \
|
||
https://github.com \
|
||
https://objects.githubusercontent.com \
|
||
https://mirrors.aliyun.com \
|
||
http://archive.ubuntu.com \
|
||
http://security.ubuntu.com \
|
||
; do
|
||
code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 --connect-timeout 5 "$url" || echo TIMEOUT)
|
||
printf ' %-45s -> %s\n' "$url" "$code"
|
||
done
|
||
|
||
- name: Ensure required tools (shellcheck via GitHub release)
|
||
run: |
|
||
set -euo pipefail
|
||
|
||
# 镜像 gitea/runner-images:ubuntu-latest 已自带 curl / jq / tar / sha256sum。
|
||
# 唯一通常缺失的是 shellcheck，从 GitHub releases 拉静态二进制即可，不走 apt。
|
||
for tool in curl jq tar sha256sum; do
|
||
command -v "$tool" >/dev/null || {
|
||
echo "::error::基础工具 $tool 不在 PATH 中，镜像异常。请更换 runner 镜像。" >&2
|
||
exit 1
|
||
}
|
||
done
|
||
|
||
if command -v shellcheck >/dev/null 2>&1; then
|
||
echo "shellcheck 已就绪：$(shellcheck --version | awk '/^version:/{print $2}')"
|
||
exit 0
|
||
fi
|
||
|
||
SC_VER=v0.10.0
|
||
case "$(uname -m)" in
|
||
x86_64) SC_ARCH=x86_64 ;;
|
||
aarch64) SC_ARCH=aarch64 ;;
|
||
*) echo "::error::不支持的架构: $(uname -m)" >&2; exit 1 ;;
|
||
esac
|
||
URL="https://github.com/koalaman/shellcheck/releases/download/${SC_VER}/shellcheck-${SC_VER}.linux.${SC_ARCH}.tar.xz"
|
||
echo "下载 $URL"
|
||
curl -fsSL --retry 3 --connect-timeout 15 -o /tmp/shellcheck.tar.xz "$URL"
|
||
tar -xJf /tmp/shellcheck.tar.xz -C /tmp
|
||
if [[ $EUID -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
|
||
SUDO=sudo
|
||
else
|
||
SUDO=
|
||
fi
|
||
$SUDO install -m 0755 "/tmp/shellcheck-${SC_VER}/shellcheck" /usr/local/bin/shellcheck
|
||
shellcheck --version | awk '/^version:/{print "shellcheck 已安装：" $2}'
|
||
|
||
- name: Run shellcheck
|
||
run: |
|
||
set -euo pipefail
|
||
shellcheck iptables-forward.sh install.sh lib/*.sh tests/run_all.sh
|
||
|
||
- name: Run unit tests
|
||
if: ${{ inputs.skip_tests != 'true' }}
|
||
run: |
|
||
set -euo pipefail
|
||
bash tests/run_all.sh --skip-integration
|
||
|
||
- name: Compute version metadata
|
||
id: ver
|
||
run: |
|
||
set -euo pipefail
|
||
SHORT_SHA=$(git rev-parse --short=7 HEAD)
|
||
FULL_SHA=$(git rev-parse HEAD)
|
||
DATE=$(date -u +%Y.%m.%d)
|
||
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||
|
||
if [[ -n "${{ inputs.version }}" ]]; then
|
||
VERSION="${{ inputs.version }}"
|
||
else
|
||
VERSION="v${DATE}-${SHORT_SHA}"
|
||
fi
|
||
|
||
TAG="${VERSION}"
|
||
TITLE="IPTables 端口转发管理工具 ${VERSION}"
|
||
ARTIFACT_BASE="iptables-forward-${VERSION}"
|
||
|
||
{
|
||
echo "version=${VERSION}"
|
||
echo "tag=${TAG}"
|
||
echo "title=${TITLE}"
|
||
echo "artifact_base=${ARTIFACT_BASE}"
|
||
echo "short_sha=${SHORT_SHA}"
|
||
echo "full_sha=${FULL_SHA}"
|
||
echo "build_time=${BUILD_TIME}"
|
||
} >> "$GITHUB_OUTPUT"
|
||
|
||
echo "准备构建: ${VERSION}"
|
||
|
||
- name: Ensure tag does not already exist
|
||
run: |
|
||
set -euo pipefail
|
||
TAG='${{ steps.ver.outputs.tag }}'
|
||
if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
|
||
echo "::error::Tag ${TAG} 已存在于远端。请手动传入新的 version 输入。"
|
||
exit 1
|
||
fi
|
||
|
||
- name: Build release tarball
|
||
id: build
|
||
run: |
|
||
set -euo pipefail
|
||
NAME='${{ steps.ver.outputs.artifact_base }}'
|
||
mkdir -p "dist/${NAME}"
|
||
cp iptables-forward.sh install.sh README.md "dist/${NAME}/"
|
||
cp -r lib "dist/${NAME}/"
|
||
[[ -f LICENSE ]] && cp LICENSE "dist/${NAME}/" || true
|
||
chmod 755 "dist/${NAME}/iptables-forward.sh" "dist/${NAME}/install.sh"
|
||
|
||
tar -czf "dist/${NAME}.tar.gz" -C dist "${NAME}"
|
||
( cd dist && sha256sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256" )
|
||
|
||
ls -la dist/
|
||
|
||
- name: Generate changelog
|
||
id: changelog
|
||
run: |
|
||
set -euo pipefail
|
||
PREV_TAG=$(git tag --list 'v*' --sort=-creatordate | head -n 1 || true)
|
||
|
||
{
|
||
echo "## 构建信息"
|
||
echo ""
|
||
echo "- **版本**: \`${{ steps.ver.outputs.version }}\`"
|
||
echo "- **提交**: \`${{ steps.ver.outputs.full_sha }}\`"
|
||
echo "- **构建时间 (UTC)**: ${{ steps.ver.outputs.build_time }}"
|
||
echo "- **触发者**: @${{ github.actor }}"
|
||
echo ""
|
||
echo "## 变更记录"
|
||
echo ""
|
||
if [[ -n "${PREV_TAG}" ]]; then
|
||
echo "自 \`${PREV_TAG}\` 以来的提交:"
|
||
echo ""
|
||
git log "${PREV_TAG}..HEAD" --pretty='- %s (`%h`)' --no-merges || true
|
||
else
|
||
echo "首次发布，近 30 条提交:"
|
||
echo ""
|
||
git log -30 --pretty='- %s (`%h`)' --no-merges
|
||
fi
|
||
echo ""
|
||
echo "## 安装"
|
||
echo ""
|
||
echo '```bash'
|
||
echo "# 下载"
|
||
echo "wget ${{ github.server_url }}/${{ github.repository }}/releases/download/${{ steps.ver.outputs.tag }}/${{ steps.ver.outputs.artifact_base }}.tar.gz"
|
||
echo "wget ${{ github.server_url }}/${{ github.repository }}/releases/download/${{ steps.ver.outputs.tag }}/${{ steps.ver.outputs.artifact_base }}.tar.gz.sha256"
|
||
echo ""
|
||
echo "# 校验"
|
||
echo "sha256sum -c ${{ steps.ver.outputs.artifact_base }}.tar.gz.sha256"
|
||
echo ""
|
||
echo "# 解压并安装 (可选)"
|
||
echo "tar -xzf ${{ steps.ver.outputs.artifact_base }}.tar.gz"
|
||
echo "cd ${{ steps.ver.outputs.artifact_base }}"
|
||
echo "sudo ./install.sh # 链接到 /usr/local/bin/iptables-forward"
|
||
echo ""
|
||
echo "# 直接运行"
|
||
echo "sudo ./iptables-forward.sh"
|
||
echo '```'
|
||
} > dist/RELEASE_NOTES.md
|
||
|
||
cat dist/RELEASE_NOTES.md
|
||
|
||
- name: Create tag and Release via Gitea API
|
||
env:
|
||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
GITEA_URL: ${{ github.server_url }}
|
||
REPO: ${{ github.repository }}
|
||
TAG: ${{ steps.ver.outputs.tag }}
|
||
TITLE: ${{ steps.ver.outputs.title }}
|
||
SHA: ${{ steps.ver.outputs.full_sha }}
|
||
ARTIFACT_BASE: ${{ steps.ver.outputs.artifact_base }}
|
||
PRERELEASE: ${{ inputs.prerelease }}
|
||
DRAFT: ${{ inputs.draft }}
|
||
run: |
|
||
set -euo pipefail
|
||
|
||
BODY=$(jq -Rs . < dist/RELEASE_NOTES.md)
|
||
|
||
PAYLOAD=$(jq -nc \
|
||
--arg tag "$TAG" \
|
||
--arg sha "$SHA" \
|
||
--arg name "$TITLE" \
|
||
--argjson body "$BODY" \
|
||
--argjson prerelease "$PRERELEASE" \
|
||
--argjson draft "$DRAFT" \
|
||
'{tag_name: $tag, target_commitish: $sha, name: $name, body: $body, prerelease: $prerelease, draft: $draft}')
|
||
|
||
echo "Creating release: $TAG"
|
||
RESP=$(curl -sSfL -X POST \
|
||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||
-H "Content-Type: application/json" \
|
||
-d "${PAYLOAD}" \
|
||
"${GITEA_URL}/api/v1/repos/${REPO}/releases")
|
||
|
||
RELEASE_ID=$(echo "$RESP" | jq -r '.id')
|
||
if [[ -z "${RELEASE_ID}" || "${RELEASE_ID}" == "null" ]]; then
|
||
echo "::error::创建 Release 失败。响应: ${RESP}"
|
||
exit 1
|
||
fi
|
||
echo "Release ID: ${RELEASE_ID}"
|
||
|
||
for asset in "dist/${ARTIFACT_BASE}.tar.gz" "dist/${ARTIFACT_BASE}.tar.gz.sha256"; do
|
||
fname=$(basename "$asset")
|
||
echo "Uploading $fname"
|
||
curl -sSfL -X POST \
|
||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||
-F "attachment=@${asset};filename=${fname}" \
|
||
"${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${fname}" \
|
||
> /dev/null
|
||
done
|
||
|
||
echo "完成: ${GITEA_URL}/${REPO}/releases/tag/${TAG}"
|
||
|
||
- name: Upload artifacts to workflow run (备份)
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: ${{ steps.ver.outputs.artifact_base }}
|
||
path: |
|
||
dist/${{ steps.ver.outputs.artifact_base }}.tar.gz
|
||
dist/${{ steps.ver.outputs.artifact_base }}.tar.gz.sha256
|
||
dist/RELEASE_NOTES.md
|
||
retention-days: 30
|