agentrt-linux/.github/workflows/release.yml at main · openairymax/agentrt-linux · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# ===========================================================================
# agentrt-linux (AirymaxOS) CI Pipeline
# release tag 流水线（L7 发布验证）
# 重组为 2 jobs：build-and-sign（SBOM + 构建签名）+ publish-release（发布渠道）
# ===========================================================================
# Authority: docs/AirymaxOS/70-build-system/03-ci-cd-pipeline.md
# Constraint: 管理仓每个 workflow 最多 2 条流水线
# ===========================================================================

name: release
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'        # 稳定版 v0.2.8
      - 'v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+' # 候选版 v0.2.8-rc1
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag'
        required: true

jobs:
  build-and-sign:
    name: Build + SBOM + Sign (L7)
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4
        with: { submodules: recursive }
      - name: Generate SPDX SBOM
        run: |
          # 内核态：扫描 vmlinux + 模块符号
          syft kernel/ -o spdx-json > sbom-kernel.spdx.json
          # 用户态：扫描 8 子仓依赖
          for repo in memory security cognition services system cloudnative tests-linux; do
            syft "$repo/" -o spdx-json > "sbom-${repo}.spdx.json"
          done
          # 合并为统一 SBOM
          if [ -f agentrt-linux/tools/merge-sbom.py ]; then
            python3 agentrt-linux/tools/merge-sbom.py \
              --output sbom-agentrt-linux-${{ github.ref_name }}.spdx.json \
              sbom-*.spdx.json
          else
            echo "SKIP: merge-sbom.py not yet implemented"
          fi
      - name: Build kernel image + modules
        working-directory: kernel
        run: |
          make ARCH=x86_64 -j$(nproc) binrpm-pkg
      - name: Import GPG signing key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Sign kernel image + modules (GPG)
        run: |
          gpg --batch --yes --detach-sign --armor \
            -o agentrt-linux-kernel-${{ github.ref_name }}.rpm.asc \
            agentrt-linux-kernel-${{ github.ref_name }}.rpm
      - name: Sign OCI image (cosign)
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          cosign sign --key env://COSIGN_KEY \
            ghcr.io/spharx/agentrt-linux:${{ github.ref_name }}
      - name: Build SDK tarball + sign
        run: |
          tar czf agentrt-linux-sdk-${{ github.ref_name }}.tar.gz sdk/
          gpg --batch --yes --detach-sign --armor \
            -o agentrt-linux-sdk-${{ github.ref_name }}.tar.gz.asc \
            agentrt-linux-sdk-${{ github.ref_name }}.tar.gz
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-artifacts-${{ github.ref_name }}
          path: |
            sbom-agentrt-linux-${{ github.ref_name }}.spdx.json
            agentrt-linux-kernel-*.rpm
            agentrt-linux-kernel-*.rpm.asc
            agentrt-linux-sdk-*.tar.gz
            agentrt-linux-sdk-*.tar.gz.asc

  publish-release:
    name: Publish + GitHub Release (L7)
    runs-on: ubuntu-latest
    needs: build-and-sign
    steps:
      - uses: actions/checkout@v4
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-artifacts-${{ github.ref_name }}
      - name: Publish dnf repo
        run: |
          createrepo agentrt-linux-repo/${{ github.ref_name }}/
          rsync -avz agentrt-linux-repo/ ${{ secrets.DNF_REPO_HOST }}:/var/www/agentrt-linux-repo/
      - name: Publish OCI image
        run: |
          docker build -t ghcr.io/spharx/agentrt-linux:${{ github.ref_name }} .
          docker push ghcr.io/spharx/agentrt-linux:${{ github.ref_name }}
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            agentrt-linux-kernel-*.rpm
            agentrt-linux-kernel-*.rpm.asc
            agentrt-linux-sdk-*.tar.gz
            agentrt-linux-sdk-*.tar.gz.asc
            sbom-agentrt-linux-*.spdx.json
          generate_release_notes: true