public_git
/
freenas-proxmox
mirror of https://github.com/TheGrandWazoo/freenas-proxmox.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
freenas-proxmox/.github/workflows/build.yml

505 lines
21 KiB
YAML
Raw Blame History

name: CI / Build / Publish
on:
push:
branches: ["**"]
tags: ["v*.*.*"]
pull_request:
branches: [master, "release/3.x"]
env:
PACKAGE_NAME: truenas-proxmox
TRANSITIONAL_PACKAGE_NAME: freenas-proxmox
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
# Cancel in-flight runs for the same branch on new push
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# ── Job 1: Lint ──────────────────────────────────────────────────────────────
jobs:
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4.3.1
- name: Install lint tools
run: |
sudo apt-get update -qq
sudo apt-get install -y \
shellcheck libperl-critic-perl \
libwww-perl libio-socket-ssl-perl libjson-perl
# Stub PVE modules not available outside Proxmox hosts
mkdir -p /tmp/pve-stub/PVE/Storage
printf 'package PVE::SafeSyslog;\nuse Exporter "import";\nour @EXPORT = qw(syslog);\nsub syslog {}\n1;\n' \
> /tmp/pve-stub/PVE/SafeSyslog.pm
printf 'package PVE::Tools;\nuse Exporter "import";\nour @EXPORT_OK = qw(run_command);\nsub run_command {}\n1;\n' \
> /tmp/pve-stub/PVE/Tools.pm
printf 'package PVE::Storage::Plugin;\nsub new {}\nsub register {}\nsub lookup_types { [] }\nsub properties { {} }\nsub options { {} }\n1;\n' \
> /tmp/pve-stub/PVE/Storage/Plugin.pm
- name: Perl syntax check
run: |
echo "==> Checking Perl syntax..."
perl -c -I/tmp/pve-stub perl5/PVE/Storage/Custom/TrueNAS.pm \
&& echo "TrueNAS.pm: OK"
- name: Perl static analysis (perlcritic)
run: |
echo "==> Running perlcritic..."
perlcritic --profile .perlcriticrc \
perl5/PVE/Storage/Custom/TrueNAS.pm
- name: Shell script lint (shellcheck)
run: |
echo "==> Running shellcheck..."
shellcheck --severity=warning \
packaging/DEBIAN/postinst \
packaging/DEBIAN/postrm \
packaging/DEBIAN-transitional/postinst
echo "Shell scripts OK"
# ── Job 2: Build .deb ────────────────────────────────────────────────────────
build:
name: Build Package
runs-on: ubuntu-latest
needs: [lint]
outputs:
version: ${{ steps.vars.outputs.version }}
deb_file: ${{ steps.vars.outputs.deb_file }}
transitional_deb_file: ${{ steps.vars.outputs.transitional_deb_file }}
channel: ${{ steps.vars.outputs.channel }}
cloudsmith_repo: ${{ steps.vars.outputs.cloudsmith_repo }}
is_release: ${{ steps.vars.outputs.is_release }}
steps:
- uses: actions/checkout@v4.3.1
with:
fetch-depth: 0
# ── Version resolution ─────────────────────────────────────────────────
# Version strategy:
# Tagged release (v3.x.x) → 3.x.x-1 (stable channel)
# release/3.x branch → <ver>~beta+<sha> (testing channel)
# master branch → <ver>~beta+<sha> (testing channel)
# release/* branches → <ver>~alpha+<sha> (development)
# everything else / PRs → <ver>~dev+<sha> (no publish)
#
# Tilde (~) sorts BELOW the base version in dpkg, so pre-release builds
# never upgrade over a stable package. Stable uses "-1" Debian revision.
- name: Resolve version and channel
id: vars
run: |
SHORT_SHA="${GITHUB_SHA:0:7}"
REF="${{ github.ref }}"
IS_RELEASE="false"
# $VERSION in TrueNAS.pm is the single source of truth.
BASE_VERSION="$(perl -ne 'if (/our\s+\$VERSION\s*=\s*['"'"'"]([^'"'"'"]+)/) { print $1; exit }' \
perl5/PVE/Storage/Custom/TrueNAS.pm 2>/dev/null || echo '0.0.0')"
if [[ "$REF" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
VERSION="${REF#refs/tags/v}-1"
CHANNEL="stable"
CLOUDSMITH_REPO="truenas-proxmox"
IS_RELEASE="true"
if [[ "${REF#refs/tags/v}" != "$BASE_VERSION" ]]; then
echo "::warning::Tag version (${REF#refs/tags/v}) does not match \$VERSION in TrueNAS.pm ($BASE_VERSION)"
fi
elif [[ "$REF" == refs/heads/master || "$REF" == refs/heads/release/3.x ]]; then
VERSION="${BASE_VERSION}~beta+${SHORT_SHA}"
CHANNEL="testing"
CLOUDSMITH_REPO="truenas-proxmox-testing"
elif [[ "$REF" == refs/heads/release/* ]]; then
VERSION="${BASE_VERSION}~alpha+${SHORT_SHA}"
CHANNEL="development"
CLOUDSMITH_REPO="truenas-proxmox-snapshots"
else
VERSION="${BASE_VERSION}~dev+${SHORT_SHA}"
CHANNEL="none"
CLOUDSMITH_REPO=""
fi
DEB_FILE="${PACKAGE_NAME}_${VERSION}_all.deb"
TRANSITIONAL_DEB_FILE="${TRANSITIONAL_PACKAGE_NAME}_${VERSION}_all.deb"
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
echo "deb_file=${DEB_FILE}" >> "$GITHUB_OUTPUT"
echo "transitional_deb_file=${TRANSITIONAL_DEB_FILE}" >> "$GITHUB_OUTPUT"
echo "channel=${CHANNEL}" >> "$GITHUB_OUTPUT"
echo "cloudsmith_repo=${CLOUDSMITH_REPO}" >> "$GITHUB_OUTPUT"
echo "is_release=${IS_RELEASE}" >> "$GITHUB_OUTPUT"
{
echo "### Build Summary"
echo "| | |"
echo "|---|---|"
echo "| Version | \`${VERSION}\` |"
echo "| Channel | \`${CHANNEL}\` |"
echo "| Package | \`${DEB_FILE}\` |"
} >> "$GITHUB_STEP_SUMMARY"
# ── Assemble staging directory ─────────────────────────────────────────
- name: Assemble package staging directory
run: |
VERSION="${{ steps.vars.outputs.version }}"
STAGING="dist"
mkdir -p "${STAGING}/DEBIAN"
mkdir -p "${STAGING}/usr/share/truenas-proxmox"
# Generate control file from template
sed "s/\${VERSION}/${VERSION}/" packaging/DEBIAN/control.j2 \
> "${STAGING}/DEBIAN/control"
# Maintainer scripts
cp packaging/DEBIAN/postinst "${STAGING}/DEBIAN/postinst"
cp packaging/DEBIAN/postrm "${STAGING}/DEBIAN/postrm"
chmod 0755 "${STAGING}/DEBIAN/postinst" "${STAGING}/DEBIAN/postrm"
# Plugin files (postinst copies these to their final destinations)
cp perl5/PVE/Storage/Custom/TrueNAS.pm "${STAGING}/usr/share/truenas-proxmox/TrueNAS.pm"
cp ui/truenas-storage.js "${STAGING}/usr/share/truenas-proxmox/truenas-storage.js"
cp ui/truenas-storage-help.html "${STAGING}/usr/share/truenas-proxmox/truenas-storage-help.html"
echo "==> Package contents:"
find "${STAGING}" | sort
- name: Assemble transitional package staging directory
run: |
VERSION="${{ steps.vars.outputs.version }}"
STAGING="dist-transitional"
mkdir -p "${STAGING}/DEBIAN"
sed "s/\${VERSION}/${VERSION}/" packaging/DEBIAN-transitional/control.j2 \
> "${STAGING}/DEBIAN/control"
cp packaging/DEBIAN-transitional/postinst "${STAGING}/DEBIAN/postinst"
chmod 0755 "${STAGING}/DEBIAN/postinst"
echo "==> Transitional package contents:"
find "${STAGING}" | sort
- name: Build .deb packages
run: |
sudo dpkg-deb -Zgzip --build dist "${{ steps.vars.outputs.deb_file }}"
sudo dpkg-deb -Zgzip --build dist-transitional "${{ steps.vars.outputs.transitional_deb_file }}"
- name: Verify .deb packages
run: |
echo "==> Package info (truenas-proxmox):"
dpkg-deb --info "${{ steps.vars.outputs.deb_file }}"
echo ""
echo "==> Package contents (truenas-proxmox):"
dpkg-deb --contents "${{ steps.vars.outputs.deb_file }}"
echo ""
echo "==> Package info (freenas-proxmox transitional):"
dpkg-deb --info "${{ steps.vars.outputs.transitional_deb_file }}"
- name: Upload package artifacts
uses: actions/upload-artifact@v4
with:
name: packages-${{ steps.vars.outputs.version }}
path: |
${{ steps.vars.outputs.deb_file }}
${{ steps.vars.outputs.transitional_deb_file }}
retention-days: 30
# ── Job 3: Security scan ─────────────────────────────────────────────────────
security:
name: Security Scan
runs-on: ubuntu-latest
needs: build
steps:
- uses: actions/checkout@v4.3.1
- name: Run Trivy (repo scan — secrets + misconfig)
uses: aquasecurity/trivy-action@master
with:
scan-type: fs
scan-ref: .
scanners: secret,misconfig
severity: HIGH,CRITICAL
exit-code: 1
format: table
- name: Download built packages
uses: actions/download-artifact@v4
with:
name: packages-${{ needs.build.outputs.version }}
- name: Extract and scan .deb contents
run: |
mkdir -p deb-contents
dpkg-deb --extract "${{ needs.build.outputs.deb_file }}" deb-contents/
- name: Run Trivy (package contents — vuln + secret)
uses: aquasecurity/trivy-action@master
with:
scan-type: fs
scan-ref: deb-contents
scanners: vuln,secret
severity: HIGH,CRITICAL
exit-code: 1
format: table
# ── Job 4: Publish ───────────────────────────────────────────────────────────
publish:
name: Publish
runs-on: ubuntu-latest
needs: [build, security]
# Only publish on direct pushes (not PRs) to tracked branches or tags
if: github.event_name == 'push' && needs.build.outputs.channel != 'none'
steps:
- uses: actions/checkout@v4.3.1
- name: Download built packages
uses: actions/download-artifact@v4
with:
name: packages-${{ needs.build.outputs.version }}
- name: Publish truenas-proxmox to Cloudsmith
# Cloudsmith now serves v2.x stable only. v3+ stable → GitHub Pages.
# beta/alpha → GitHub Pages testing dist (see step below).
if: >-
startsWith(needs.build.outputs.version, '2.') &&
needs.build.outputs.channel == 'stable'
uses: cloudsmith-io/action@v0.6.14
with:
api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
command: push
format: deb
owner: ksatechnologies
repo: ${{ needs.build.outputs.cloudsmith_repo }}
distro: debian
release: any-version
file: ${{ needs.build.outputs.deb_file }}
- name: Publish transitional freenas-proxmox to Cloudsmith
if: >-
startsWith(needs.build.outputs.version, '2.') &&
needs.build.outputs.channel == 'stable'
uses: cloudsmith-io/action@v0.6.14
with:
api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
command: push
format: deb
owner: ksatechnologies
repo: ${{ needs.build.outputs.cloudsmith_repo }}
distro: debian
release: any-version
file: ${{ needs.build.outputs.transitional_deb_file }}
- name: Publish to GitHub Pages APT repo
if: needs.build.outputs.is_release == 'true'
env:
APT_SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }}
APT_SIGNING_KEY_PASSPHRASE: ${{ secrets.APT_SIGNING_KEY_PASSPHRASE }}
GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
run: |
# Abort clearly if signing key not configured
if [[ -z "$APT_SIGNING_KEY" ]]; then
echo "::error::APT_SIGNING_KEY secret is not set — run scripts/setup-apt-signing-key.sh and add the secret"
exit 1
fi
# Determine major version from package version (e.g. 3.0.0-1 → 3)
VERSION="${{ needs.build.outputs.version }}"
MAJOR="${VERSION%%.*}"
# Import GPG signing key
echo "$APT_SIGNING_KEY" | base64 -d | gpg --batch --import
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons 2>/dev/null \
| awk -F: '/^sec/{print $5; exit}')"
# Checkout gh-pages branch into a temp directory
PAGES_DIR="$(mktemp -d)"
git clone --branch gh-pages \
"https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" \
"$PAGES_DIR"
# Add .deb files to the versioned pool directory
mkdir -p "${PAGES_DIR}/pool/v${MAJOR}"
cp "${{ needs.build.outputs.deb_file }}" "${PAGES_DIR}/pool/v${MAJOR}/"
cp "${{ needs.build.outputs.transitional_deb_file }}" "${PAGES_DIR}/pool/v${MAJOR}/"
# Install apt tooling
sudo apt-get install -y --no-install-recommends dpkg-dev apt-utils
# Determine which dists to update
# v2.x: update v2, main (alias), and v2 (explicit)
# v3.x and above: update only the versioned dist
if [[ "$MAJOR" == "2" ]]; then
DISTS="v2 main"
else
DISTS="v${MAJOR}"
fi
for DIST in $DISTS; do
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-all"
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-amd64"
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-arm64"
# Generate Packages file (paths relative to repo root)
dpkg-scanpackages --multiversion "${PAGES_DIR}/pool/v${MAJOR}" \
| sed "s|^Filename: ${PAGES_DIR}/||" \
> "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
# Empty arch-specific Packages — all our packages are Architecture: all;
# these files silence the apt "doesn't support architecture" warning on
# amd64 and arm64 hosts without duplicating package entries.
touch "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
touch "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
# Generate Release file
apt-ftparchive \
-o "APT::FTPArchive::Release::Origin=truenas-proxmox" \
-o "APT::FTPArchive::Release::Label=truenas-proxmox" \
-o "APT::FTPArchive::Release::Suite=${DIST}" \
-o "APT::FTPArchive::Release::Codename=${DIST}" \
-o "APT::FTPArchive::Release::Components=main" \
-o "APT::FTPArchive::Release::Architectures=all amd64 arm64" \
release "${PAGES_DIR}/dists/${DIST}" \
> "${PAGES_DIR}/dists/${DIST}/Release"
# Sign → InRelease
gpg --batch --yes \
--passphrase "${APT_SIGNING_KEY_PASSPHRASE}" \
--default-key "${GPG_KEY_ID}" \
--clearsign \
-o "${PAGES_DIR}/dists/${DIST}/InRelease" \
"${PAGES_DIR}/dists/${DIST}/Release"
done
# Commit and push
cd "$PAGES_DIR"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add .
git diff --staged --quiet || \
git commit -m "apt: publish ${VERSION} to dist(s): ${DISTS}"
git push
- name: Publish to GitHub Pages testing dist
if: >-
needs.build.outputs.channel == 'beta' ||
needs.build.outputs.channel == 'alpha'
env:
APT_SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }}
APT_SIGNING_KEY_PASSPHRASE: ${{ secrets.APT_SIGNING_KEY_PASSPHRASE }}
GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
run: |
if [[ -z "$APT_SIGNING_KEY" ]]; then
echo "::error::APT_SIGNING_KEY secret is not set"
exit 1
fi
VERSION="${{ needs.build.outputs.version }}"
echo "$APT_SIGNING_KEY" | base64 -d | gpg --batch --import
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons 2>/dev/null \
| awk -F: '/^sec/{print $5; exit}')"
PAGES_DIR="$(mktemp -d)"
git clone --branch gh-pages \
"https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" \
"$PAGES_DIR"
# Replace pool/testing/ contents with the latest build only
rm -rf "${PAGES_DIR}/pool/testing"
mkdir -p "${PAGES_DIR}/pool/testing"
cp "${{ needs.build.outputs.deb_file }}" "${PAGES_DIR}/pool/testing/"
cp "${{ needs.build.outputs.transitional_deb_file }}" "${PAGES_DIR}/pool/testing/"
sudo apt-get install -y --no-install-recommends dpkg-dev apt-utils
DIST="testing"
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-all"
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-amd64"
mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-arm64"
dpkg-scanpackages --multiversion "${PAGES_DIR}/pool/testing" \
| sed "s|^Filename: ${PAGES_DIR}/||" \
> "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
touch "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
touch "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
apt-ftparchive \
-o "APT::FTPArchive::Release::Origin=truenas-proxmox" \
-o "APT::FTPArchive::Release::Label=truenas-proxmox" \
-o "APT::FTPArchive::Release::Suite=${DIST}" \
-o "APT::FTPArchive::Release::Codename=${DIST}" \
-o "APT::FTPArchive::Release::Components=main" \
-o "APT::FTPArchive::Release::Architectures=all amd64 arm64" \
release "${PAGES_DIR}/dists/${DIST}" \
> "${PAGES_DIR}/dists/${DIST}/Release"
gpg --batch --yes \
--passphrase "${APT_SIGNING_KEY_PASSPHRASE}" \
--default-key "${GPG_KEY_ID}" \
--clearsign \
-o "${PAGES_DIR}/dists/${DIST}/InRelease" \
"${PAGES_DIR}/dists/${DIST}/Release"
cd "$PAGES_DIR"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add .
git diff --staged --quiet || \
git commit -m "apt: publish ${VERSION} to testing dist"
git push
- name: Create draft GitHub Release
if: needs.build.outputs.is_release == 'true'
uses: softprops/action-gh-release@v3
with:
name: "v${{ needs.build.outputs.version }}"
draft: true
files: |
${{ needs.build.outputs.deb_file }}
${{ needs.build.outputs.transitional_deb_file }}
generate_release_notes: false
body: |
## truenas-proxmox v${{ needs.build.outputs.version }}
> **Edit before publishing** — fill in tested versions before publishing.
### Compatibility
| Proxmox VE | Status |
|:-----------|:-------|
| **PVE 9+** | ✅ Supported |
| **PVE 8.x** | ✅ Supported (EOL 2026-08-31 — plan upgrade to PVE 9) |
| **PVE 7 or older** | ❌ Not supported — use v2.x |
### Tested Proxmox VE Versions
- Proxmox VE 8.4.x (tested: )
- Proxmox VE 9.x (tested: )
### Tested TrueNAS Versions
- TrueNAS CORE 13.x (tested: )
- TrueNAS SCALE 24.10.x (tested: )
### Installation
See [README → Installation](https://github.com/TheGrandWazoo/truenas-proxmox#installation).
### Changes
See [CHANGELOG.md](https://github.com/TheGrandWazoo/truenas-proxmox/blob/release/3.x/CHANGELOG.md).
Reference in New Issue View Git Blame Copy Permalink