marc
6dd1026c5a
Build the distribution from src/ (control, versioned SQL, META, MIT LICENSE, PGXS Makefile, install README), checksum it, and sign an Ed25519 JWT manifest (audience pgmorbac-release) with the verification public key attached to the release. `npm run release` does it locally; the Drone pipeline does it on a v* tag once the repo is Trusted with the pgmorbac_release_key + gitea_token secrets.
35 lines
1007 B
YAML
35 lines
1007 B
YAML
---
|
|
kind: pipeline
|
|
type: docker
|
|
name: release
|
|
|
|
# Cuts the signed PGXN distribution and publishes it as a Gitea release.
|
|
# Triggered by version tags (v<major>.<minor>.<patch>).
|
|
#
|
|
# Repo must be Trusted in Drone. Required secrets:
|
|
# pgmorbac_release_key Ed25519 private key PEM (content, not a path)
|
|
# gitea_token Gitea API token with write access to crudy/pgmorbac
|
|
|
|
trigger:
|
|
event:
|
|
- tag
|
|
ref:
|
|
- refs/tags/v*
|
|
|
|
steps:
|
|
- name: build-and-release
|
|
image: node:24-alpine
|
|
environment:
|
|
PGMORBAC_RELEASE_KEY_PEM:
|
|
from_secret: pgmorbac_release_key
|
|
GITEA_TOKEN:
|
|
from_secret: gitea_token
|
|
GITEA_URL: https://git.villains.fr
|
|
GITEA_REPO: crudy/pgmorbac
|
|
commands:
|
|
- apk add --no-cache zip bash
|
|
- npm install --no-audit --no-fund
|
|
- umask 077 && printf '%s\n' "$PGMORBAC_RELEASE_KEY_PEM" > /tmp/release-key.pem
|
|
- PGMORBAC_RELEASE_KEY=/tmp/release-key.pem node scripts/build-dist.mjs
|
|
- node scripts/gitea-release.mjs
|