alpine-packages/.gitea/workflows/build.yml

name: Build Alpine Packages

on:
  push:
    branches:
      - "**"
    tags:
      - "*"
  pull_request:
  workflow_dispatch:

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - alpine_version: "3.24"
            alpine_registry_branch: "v3.24"
    container:
      image: "alpine:${{ matrix.alpine_version }}"
    env:
      ALPINE_VERSION: "${{ matrix.alpine_version }}"
      ALPINE_ARCHES: "x86_64 aarch64"
      ALPINE_REGISTRY_BRANCH: "${{ matrix.alpine_registry_branch }}"
      ALPINE_REGISTRY_REPOSITORY: "${{ vars.PACKAGE_NAME }}"
      INSTANCE_URL: "${{ vars.INSTANCE_URL }}"
      PACKAGE_OWNER: "${{ vars.PACKAGE_OWNER }}"
      PACKAGE_USER: "${{ secrets.PACKAGE_USER }}"
      PACKAGE_TOKEN: "${{ secrets.PACKAGE_TOKEN }}"
      PACKAGER: "${{ gitea.repository_owner }}"
      ALPINE_APK_REPO_CACHE: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/apk-repo"
      ALPINE_RUST_CACHE_ROOT: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/rust"
      TRIVY_VERSION: "0.74.0"
      TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
    steps:
      - name: Prepare Environment
        run: |
          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
          apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git jq nodejs rsync shellcheck sudo tar
          trivy_archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
          curl -fsSL -o "/tmp/${trivy_archive}" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${trivy_archive}"
          echo "${TRIVY_SHA256}  /tmp/${trivy_archive}" | sha256sum -c -
          tar -xzf "/tmp/${trivy_archive}" -C /usr/local/bin trivy
          mkdir -p "$ALPINE_APK_REPO_CACHE" "$ALPINE_RUST_CACHE_ROOT"
          chown -R 1000:1000 /cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}

      - name: Checkout
        uses: actions/checkout@v3

      - name: Select packages
        run: |
          scripts/apk/clean.sh
          find packaging/alpine/local -mindepth 2 -maxdepth 2 -name APKBUILD -exec apkbuild-lint {} +
          scripts/apk/lint-shell.sh
          scripts/apk/outdated.sh | tee update-check.txt
          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
            {
              echo "## Upstream update check"
              echo
              echo '```text'
              cat update-check.txt
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Prepare package cache
        id: package-selection
        run: |
          scripts/apk/ci-package-cache.sh prepare

      - name: Build packages
        run: |
          scripts/apk/ci-build.sh
          if [ -d packages/local ]; then
            scripts/apk/list-packages.sh
          fi

      - name: Export GreptimeDB CI assets
        if: steps.package-selection.outputs.greptimedb_selected == 'true'
        run: scripts/apk/export-ci-assets.sh

      - name: Check artifact upload support
        id: artifact-upload
        run: |
          if [ -n "${ACTIONS_RUNTIME_TOKEN:-}" ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "available=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload generated CI assets
        if: steps.package-selection.outputs.greptimedb_selected == 'true' && steps.artifact-upload.outputs.available == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: greptimedb-musl-binaries-${{ matrix.alpine_registry_branch }}
          path: packages/ci-assets/

      - name: Upload local Alpine registry
        if: steps.package-selection.outputs.packages_selected == 'true' && steps.artifact-upload.outputs.available == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: alpine-local-registry-${{ matrix.alpine_registry_branch }}-${{ github.sha }}
          path: packages/local/
          retention-days: 30

      - name: Smoke test
        run: scripts/apk/ci-smoke.sh

      - name: Generate security reports
        if: env.ALPINE_SKIP_BUILD != '1'
        run: |
          scripts/apk/security-report.sh
          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
            find packages/security-reports -name summary.md -type f -print | sort | while IFS= read -r summary; do
              cat "$summary"
            done >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload security reports
        if: env.ALPINE_SKIP_BUILD != '1' && steps.artifact-upload.outputs.available == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: apk-security-reports-${{ matrix.alpine_registry_branch }}
          path: packages/security-reports/

      - name: Runtime test
        if: env.ALPINE_SKIP_BUILD != '1'
        run: scripts/apk/runtime-test.sh

      - name: Publish Alpine packages
        if: github.ref == 'refs/heads/main' && env.ALPINE_SKIP_BUILD != '1'
        run: scripts/apk/publish-gitea.sh