From dc19977bb42a65449573d13489dbe190c5e2c444 Mon Sep 17 00:00:00 2001 From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com> Date: Fri, 9 Jan 2026 16:08:14 +0100 Subject: [PATCH 1/4] Update repositories on full release/pre-release --- .../workflows/update-apt-on-prerelease.yml | 148 ++++++++++++++++++ .github/workflows/update-apt-on-release.yml | 147 +++++++++++++++++ 2 files changed, 295 insertions(+) create mode 100644 .github/workflows/update-apt-on-prerelease.yml create mode 100644 .github/workflows/update-apt-on-release.yml diff --git a/.github/workflows/update-apt-on-prerelease.yml b/.github/workflows/update-apt-on-prerelease.yml new file mode 100644 index 00000000..2c631cf9 --- /dev/null +++ b/.github/workflows/update-apt-on-prerelease.yml @@ -0,0 +1,148 @@ +name: Update repositories with pre-released packages + +on: + release: + types: [published] + +jobs: + update-apt: + if: github.event.release.prerelease == true + runs-on: + - self-hosted + - Linux + - X64 + outputs: + amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} + steps: + - name: Download .deb assets from release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + mkdir debs + gh release download "${{ github.event.release.tag_name }}" \ + --pattern "*.deb" \ + --dir debs + + - name: Get AMD64 DEB SHA256 # Obtain SHA for AUR + run: | + sha=$(sha256sum debs/defguard-client_*_amd64.deb | grep -v ubuntu | awk '{print $1}') + echo "AMD64_SHA=$sha" >> $GITHUB_OUTPUT + id: get_sha + + - name: Install ruby with deb-s3 + run: | + sudo apt-get install -y ruby + gem install deb-s3 + echo "$(ruby -r rubygems -e 'puts Gem.user_dir')/bin" >> $GITHUB_PATH + + - name: Upload DEB to APT repository + run: | + for deb_file in debs/*.deb; do + if [[ "$deb_file" == *"ubuntu-22-04-lts"* ]]; then + codename="bookworm" + else + codename="trixie" + fi + echo "Uploading $deb_file to $codename" + deb-s3 upload -l \ + --bucket=apt.defguard.net \ + --access-key-id=${{ secrets.AWS_ACCESS_KEY_APT }} \ + --secret-access-key=${{ secrets.AWS_SECRET_KEY_APT }} \ + --s3-region=eu-north-1 \ + --no-fail-if-exists \ + --codename="$codename" \ + --component="pre-release" \ + "$deb_file" + done + + apt-sign: + needs: + - update-apt + runs-on: + - self-hosted + - Linux + - X64 + steps: + - name: Sign APT repository + run: | + export AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_APT }} + export AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_KEY_APT }} + export AWS_REGION=eu-north-1 + sudo apt update -y + sudo apt install -y awscli curl jq + + for DIST in trixie bookworm; do + aws s3 cp s3://apt.defguard.net/dists/${DIST}/Release . + + curl -X POST "${{ secrets.DEFGUARD_SIGNING_URL }}?signature_type=both" \ + -H "Authorization: Bearer ${{ secrets.DEFGUARD_SIGNING_API_KEY }}" \ + -F "file=@Release" \ + -o response.json + + cat response.json | jq -r '.files["Release.gpg"].content' | base64 --decode > Release.gpg + cat response.json | jq -r '.files.Release.content' | base64 --decode > InRelease + + aws s3 cp Release.gpg s3://apt.defguard.net/dists/${DIST}/ --acl public-read + aws s3 cp InRelease s3://apt.defguard.net/dists/${DIST}/ --acl public-read + + done + (aws s3 ls s3://apt.defguard.net/dists/ --recursive; aws s3 ls s3://apt.defguard.net/pool/ --recursive) | awk '{print ""$4"
"}' > index.html + aws s3 cp index.html s3://apt.defguard.net/ --acl public-read + + update-aur: + needs: + - update-apt + runs-on: + - self-hosted + - Linux + - X64 + container: archlinux:latest + steps: + - name: Install dependencies + run: | + pacman -Syu --noconfirm + pacman -S --noconfirm git openssh base-devel + - name: Setup SSH for AUR + run: | + mkdir -p ~/.ssh + echo "${{ secrets.AUR_SSH_KEY }}" > ~/.ssh/id_rsa + chmod 600 ~/.ssh/id_rsa + ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts + chmod 600 ~/.ssh/known_hosts + # Create SSH config file + cat > ~/.ssh/config << EOF + Host aur.archlinux.org + IdentityFile ~/.ssh/id_rsa + User aur + StrictHostKeyChecking accept-new + EOF + chmod 600 ~/.ssh/config + - name: Update AUR Package + run: | + + git config --global user.name "Defguard Build System" + git config --global user.email "community@defguard.net" + git config --global --add safe.directory '*' + + rm -rf aur-repo || true + GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" \ + git clone "ssh://aur@aur.archlinux.org/defguard-client.git" aur-repo + cd aur-repo + git config --global --add safe.directory "$(pwd)" + VERSION=$(echo ${GITHUB_REF_NAME#v} | cut -d '-' -f1) + echo "Updating to version: $VERSION" + sed -i "s/^pkgver=.*/pkgver=$VERSION/" PKGBUILD + + AMD64_SHA="${{ needs.update-apt.outputs.amd64_sha }}" + echo "AMD64 DEB SHA256: $AMD64_SHA" + sed -i "s/^sha256sums_x86_64=.*/sha256sums_x86_64=('$AMD64_SHA')/" PKGBUILD + + useradd -m builduser + chown -R builduser:builduser . + + su builduser -c "makepkg --printsrcinfo" > .SRCINFO + git add PKGBUILD .SRCINFO + git commit -m "Updated to $VERSION" + GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" git push + cat PKGBUILD + cat .SRCINFO diff --git a/.github/workflows/update-apt-on-release.yml b/.github/workflows/update-apt-on-release.yml new file mode 100644 index 00000000..495763d1 --- /dev/null +++ b/.github/workflows/update-apt-on-release.yml @@ -0,0 +1,147 @@ +name: Update repositories with released packages + +on: + release: + types: [published] + +jobs: + update-apt: + if: github.event.release.prerelease == false + runs-on: + - self-hosted + - Linux + - X64 + outputs: + amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} + steps: + - name: Download .deb assets from release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + mkdir debs + gh release download "${{ github.event.release.tag_name }}" \ + --pattern "*.deb" \ + --dir debs + + - name: Get AMD64 DEB SHA256 # Obtain SHA for AUR + run: | + sha=$(sha256sum debs/defguard-client_*_amd64.deb | grep -v ubuntu | awk '{print $1}') + echo "AMD64_SHA=$sha" >> $GITHUB_OUTPUT + id: get_sha + + - name: Install ruby with deb-s3 + run: | + sudo apt-get install -y ruby + gem install deb-s3 + echo "$(ruby -r rubygems -e 'puts Gem.user_dir')/bin" >> $GITHUB_PATH + + - name: Upload DEB to APT repository + run: | + for deb_file in debs/*.deb; do + if [[ "$deb_file" == *"ubuntu-22-04-lts"* ]]; then + codename="bookworm" + else + codename="trixie" + fi + echo "Uploading $deb_file to $codename" + deb-s3 upload -l \ + --bucket=apt.defguard.net \ + --access-key-id=${{ secrets.AWS_ACCESS_KEY_APT }} \ + --secret-access-key=${{ secrets.AWS_SECRET_KEY_APT }} \ + --s3-region=eu-north-1 \ + --no-fail-if-exists \ + --codename="$codename" \ + --component="release" \ + "$deb_file" + done + + apt-sign: + needs: + - update-apt + runs-on: + - self-hosted + - Linux + - X64 + steps: + - name: Sign APT repository + run: | + export AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_APT }} + export AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_KEY_APT }} + export AWS_REGION=eu-north-1 + sudo apt update -y + sudo apt install -y awscli curl jq + + for DIST in trixie bookworm; do + aws s3 cp s3://apt.defguard.net/dists/${DIST}/Release . + + curl -X POST "${{ secrets.DEFGUARD_SIGNING_URL }}?signature_type=both" \ + -H "Authorization: Bearer ${{ secrets.DEFGUARD_SIGNING_API_KEY }}" \ + -F "file=@Release" \ + -o response.json + + cat response.json | jq -r '.files["Release.gpg"].content' | base64 --decode > Release.gpg + cat response.json | jq -r '.files.Release.content' | base64 --decode > InRelease + + aws s3 cp Release.gpg s3://apt.defguard.net/dists/${DIST}/ --acl public-read + aws s3 cp InRelease s3://apt.defguard.net/dists/${DIST}/ --acl public-read + + done + (aws s3 ls s3://apt.defguard.net/dists/ --recursive; aws s3 ls s3://apt.defguard.net/pool/ --recursive) | awk '{print ""$4"
"}' > index.html + aws s3 cp index.html s3://apt.defguard.net/ --acl public-read + update-aur: + needs: + - update-apt + runs-on: + - self-hosted + - Linux + - X64 + container: archlinux:latest + steps: + - name: Install dependencies + run: | + pacman -Syu --noconfirm + pacman -S --noconfirm git openssh base-devel + - name: Setup SSH for AUR + run: | + mkdir -p ~/.ssh + echo "${{ secrets.AUR_SSH_KEY }}" > ~/.ssh/id_rsa + chmod 600 ~/.ssh/id_rsa + ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts + chmod 600 ~/.ssh/known_hosts + # Create SSH config file + cat > ~/.ssh/config << EOF + Host aur.archlinux.org + IdentityFile ~/.ssh/id_rsa + User aur + StrictHostKeyChecking accept-new + EOF + chmod 600 ~/.ssh/config + - name: Update AUR Package + run: | + + git config --global user.name "Defguard Build System" + git config --global user.email "community@defguard.net" + git config --global --add safe.directory '*' + + rm -rf aur-repo || true + GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" \ + git clone "ssh://aur@aur.archlinux.org/defguard-client.git" aur-repo + cd aur-repo + git config --global --add safe.directory "$(pwd)" + VERSION=$(echo ${GITHUB_REF_NAME#v} | cut -d '-' -f1) + echo "Updating to version: $VERSION" + sed -i "s/^pkgver=.*/pkgver=$VERSION/" PKGBUILD + + AMD64_SHA="${{ needs.update-apt.outputs.amd64_sha }}" + echo "AMD64 DEB SHA256: $AMD64_SHA" + sed -i "s/^sha256sums_x86_64=.*/sha256sums_x86_64=('$AMD64_SHA')/" PKGBUILD + + useradd -m builduser + chown -R builduser:builduser . + + su builduser -c "makepkg --printsrcinfo" > .SRCINFO + git add PKGBUILD .SRCINFO + git commit -m "Updated to $VERSION" + GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" git push + cat PKGBUILD + cat .SRCINFO From 517d215ea2b35fe72541048aaa9544b4366999f4 Mon Sep 17 00:00:00 2001 From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com> Date: Fri, 9 Jan 2026 16:10:22 +0100 Subject: [PATCH 2/4] Add checkout --- .github/workflows/update-apt-on-prerelease.yml | 2 ++ .github/workflows/update-apt-on-release.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/update-apt-on-prerelease.yml b/.github/workflows/update-apt-on-prerelease.yml index 2c631cf9..472fd16a 100644 --- a/.github/workflows/update-apt-on-prerelease.yml +++ b/.github/workflows/update-apt-on-prerelease.yml @@ -14,6 +14,8 @@ jobs: outputs: amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} steps: + - name: Checkout + uses: actions/checkout@v4 - name: Download .deb assets from release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/update-apt-on-release.yml b/.github/workflows/update-apt-on-release.yml index 495763d1..d6cc2b3f 100644 --- a/.github/workflows/update-apt-on-release.yml +++ b/.github/workflows/update-apt-on-release.yml @@ -14,6 +14,8 @@ jobs: outputs: amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} steps: + - name: Checkout + uses: actions/checkout@v4 - name: Download .deb assets from release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From bd6702860d934b5f691c3251e47bb17122cfeda2 Mon Sep 17 00:00:00 2001 From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com> Date: Fri, 9 Jan 2026 16:11:36 +0100 Subject: [PATCH 3/4] remove aur job from pre-release section --- .../workflows/update-apt-on-prerelease.yml | 66 ------------------- 1 file changed, 66 deletions(-) diff --git a/.github/workflows/update-apt-on-prerelease.yml b/.github/workflows/update-apt-on-prerelease.yml index 472fd16a..81e92d91 100644 --- a/.github/workflows/update-apt-on-prerelease.yml +++ b/.github/workflows/update-apt-on-prerelease.yml @@ -11,8 +11,6 @@ jobs: - self-hosted - Linux - X64 - outputs: - amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} steps: - name: Checkout uses: actions/checkout@v4 @@ -25,12 +23,6 @@ jobs: --pattern "*.deb" \ --dir debs - - name: Get AMD64 DEB SHA256 # Obtain SHA for AUR - run: | - sha=$(sha256sum debs/defguard-client_*_amd64.deb | grep -v ubuntu | awk '{print $1}') - echo "AMD64_SHA=$sha" >> $GITHUB_OUTPUT - id: get_sha - - name: Install ruby with deb-s3 run: | sudo apt-get install -y ruby @@ -90,61 +82,3 @@ jobs: done (aws s3 ls s3://apt.defguard.net/dists/ --recursive; aws s3 ls s3://apt.defguard.net/pool/ --recursive) | awk '{print ""$4"
"}' > index.html aws s3 cp index.html s3://apt.defguard.net/ --acl public-read - - update-aur: - needs: - - update-apt - runs-on: - - self-hosted - - Linux - - X64 - container: archlinux:latest - steps: - - name: Install dependencies - run: | - pacman -Syu --noconfirm - pacman -S --noconfirm git openssh base-devel - - name: Setup SSH for AUR - run: | - mkdir -p ~/.ssh - echo "${{ secrets.AUR_SSH_KEY }}" > ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa - ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts - chmod 600 ~/.ssh/known_hosts - # Create SSH config file - cat > ~/.ssh/config << EOF - Host aur.archlinux.org - IdentityFile ~/.ssh/id_rsa - User aur - StrictHostKeyChecking accept-new - EOF - chmod 600 ~/.ssh/config - - name: Update AUR Package - run: | - - git config --global user.name "Defguard Build System" - git config --global user.email "community@defguard.net" - git config --global --add safe.directory '*' - - rm -rf aur-repo || true - GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" \ - git clone "ssh://aur@aur.archlinux.org/defguard-client.git" aur-repo - cd aur-repo - git config --global --add safe.directory "$(pwd)" - VERSION=$(echo ${GITHUB_REF_NAME#v} | cut -d '-' -f1) - echo "Updating to version: $VERSION" - sed -i "s/^pkgver=.*/pkgver=$VERSION/" PKGBUILD - - AMD64_SHA="${{ needs.update-apt.outputs.amd64_sha }}" - echo "AMD64 DEB SHA256: $AMD64_SHA" - sed -i "s/^sha256sums_x86_64=.*/sha256sums_x86_64=('$AMD64_SHA')/" PKGBUILD - - useradd -m builduser - chown -R builduser:builduser . - - su builduser -c "makepkg --printsrcinfo" > .SRCINFO - git add PKGBUILD .SRCINFO - git commit -m "Updated to $VERSION" - GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new" git push - cat PKGBUILD - cat .SRCINFO From d537baa7dc03e37d08508218e64c5e491ad664ac Mon Sep 17 00:00:00 2001 From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com> Date: Fri, 9 Jan 2026 16:22:03 +0100 Subject: [PATCH 4/4] Add if, merge files --- .../workflows/update-apt-on-prerelease.yml | 84 ------------------- ...on-release.yml => update-repositories.yml} | 13 ++- 2 files changed, 10 insertions(+), 87 deletions(-) delete mode 100644 .github/workflows/update-apt-on-prerelease.yml rename .github/workflows/{update-apt-on-release.yml => update-repositories.yml} (95%) diff --git a/.github/workflows/update-apt-on-prerelease.yml b/.github/workflows/update-apt-on-prerelease.yml deleted file mode 100644 index 81e92d91..00000000 --- a/.github/workflows/update-apt-on-prerelease.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Update repositories with pre-released packages - -on: - release: - types: [published] - -jobs: - update-apt: - if: github.event.release.prerelease == true - runs-on: - - self-hosted - - Linux - - X64 - steps: - - name: Checkout - uses: actions/checkout@v4 - - name: Download .deb assets from release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - mkdir debs - gh release download "${{ github.event.release.tag_name }}" \ - --pattern "*.deb" \ - --dir debs - - - name: Install ruby with deb-s3 - run: | - sudo apt-get install -y ruby - gem install deb-s3 - echo "$(ruby -r rubygems -e 'puts Gem.user_dir')/bin" >> $GITHUB_PATH - - - name: Upload DEB to APT repository - run: | - for deb_file in debs/*.deb; do - if [[ "$deb_file" == *"ubuntu-22-04-lts"* ]]; then - codename="bookworm" - else - codename="trixie" - fi - echo "Uploading $deb_file to $codename" - deb-s3 upload -l \ - --bucket=apt.defguard.net \ - --access-key-id=${{ secrets.AWS_ACCESS_KEY_APT }} \ - --secret-access-key=${{ secrets.AWS_SECRET_KEY_APT }} \ - --s3-region=eu-north-1 \ - --no-fail-if-exists \ - --codename="$codename" \ - --component="pre-release" \ - "$deb_file" - done - - apt-sign: - needs: - - update-apt - runs-on: - - self-hosted - - Linux - - X64 - steps: - - name: Sign APT repository - run: | - export AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_APT }} - export AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_KEY_APT }} - export AWS_REGION=eu-north-1 - sudo apt update -y - sudo apt install -y awscli curl jq - - for DIST in trixie bookworm; do - aws s3 cp s3://apt.defguard.net/dists/${DIST}/Release . - - curl -X POST "${{ secrets.DEFGUARD_SIGNING_URL }}?signature_type=both" \ - -H "Authorization: Bearer ${{ secrets.DEFGUARD_SIGNING_API_KEY }}" \ - -F "file=@Release" \ - -o response.json - - cat response.json | jq -r '.files["Release.gpg"].content' | base64 --decode > Release.gpg - cat response.json | jq -r '.files.Release.content' | base64 --decode > InRelease - - aws s3 cp Release.gpg s3://apt.defguard.net/dists/${DIST}/ --acl public-read - aws s3 cp InRelease s3://apt.defguard.net/dists/${DIST}/ --acl public-read - - done - (aws s3 ls s3://apt.defguard.net/dists/ --recursive; aws s3 ls s3://apt.defguard.net/pool/ --recursive) | awk '{print ""$4"
"}' > index.html - aws s3 cp index.html s3://apt.defguard.net/ --acl public-read diff --git a/.github/workflows/update-apt-on-release.yml b/.github/workflows/update-repositories.yml similarity index 95% rename from .github/workflows/update-apt-on-release.yml rename to .github/workflows/update-repositories.yml index d6cc2b3f..889098ef 100644 --- a/.github/workflows/update-apt-on-release.yml +++ b/.github/workflows/update-repositories.yml @@ -1,4 +1,4 @@ -name: Update repositories with released packages +name: Update repositories with packages on: release: @@ -6,7 +6,6 @@ on: jobs: update-apt: - if: github.event.release.prerelease == false runs-on: - self-hosted - Linux @@ -39,12 +38,19 @@ jobs: - name: Upload DEB to APT repository run: | + if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then + component="pre-release" + else + component="release" + fi + for deb_file in debs/*.deb; do if [[ "$deb_file" == *"ubuntu-22-04-lts"* ]]; then codename="bookworm" else codename="trixie" fi + echo "Uploading $deb_file to $codename" deb-s3 upload -l \ --bucket=apt.defguard.net \ @@ -53,7 +59,7 @@ jobs: --s3-region=eu-north-1 \ --no-fail-if-exists \ --codename="$codename" \ - --component="release" \ + --component="$component" "$deb_file" done @@ -91,6 +97,7 @@ jobs: (aws s3 ls s3://apt.defguard.net/dists/ --recursive; aws s3 ls s3://apt.defguard.net/pool/ --recursive) | awk '{print ""$4"
"}' > index.html aws s3 cp index.html s3://apt.defguard.net/ --acl public-read update-aur: + if: github.event.release.prerelease == false needs: - update-apt runs-on: