mostlymatter/.gitlab-ci.yml

---
image: debian:bookworm
stages:
  - build
  - publish

variables:
  DEBIAN_FRONTEND: noninteractive
  PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/go/bin:/usr/local/go/bin
  GO_VERSION: 1.25.8
  GO_HASHSUM: ceb5e041bbc3893846bd1614d76cb4681c91dadee579426cf21a63f2d7e03be6

build:
  stage: build
  before_script:
    - mkdir artifacts
    - apt update
    - apt install -qq -y build-essential libpng-dev libpng16-16 wget curl git
    - ulimit -n 8096
    - cd /tmp
    - wget -q "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
    - >
      echo \
        "${GO_HASHSUM}  go${GO_VERSION}.linux-amd64.tar.gz" \
        > "go${GO_VERSION}.linux-amd64.tar.gz.sha256sum"
    - sha256sum -c "go${GO_VERSION}.linux-amd64.tar.gz.sha256sum"
    - tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
    - cd -
  script:
    - >
      sed -e "s/^\(BUILD_NUMBER\) ?= .*/\1 = $CI_JOB_ID/" \
          -e "s/^\(BUILD_HASH = \).*/\1$(git rev-parse HEAD)/" \
          -i server/Makefile
    - git apply limitless.patch
    - cd server
    - make validate-go-version
    - make setup-go-work
    - make build-linux-arm64
    - make build-linux-amd64
    - cd -
    - >
      mv server/bin/mostlymatter \
         "mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless)"
    - >
      mv server/bin/linux_arm64/mostlymatter \
         "mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless)"
  cache:
    key: "$CI_COMMIT_TAG"
    policy: push
    paths:
      - "mostlymatter-*"
  rules:
    - if: '$CI_COMMIT_TAG =~ /limitless/'

# Release
publish:
  stage: publish
  image: framasoft/upload-packages:latest
  needs:
    - build
  before_script:
    - mkdir -p ~/.minisign
    - chmod 700 ~/.minisign
    - >
      echo 'untrusted comment: minisign encrypted secret key' \
          > ~/.minisign/minisign.key
    - echo "$MINISIG_KEY" >> ~/.minisign/minisign.key
    - chmod 600 ~/.minisign/minisign.key
    - >
      echo "$MINISIG_PWD" |
        minisign -Sm "mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless)"
    - >
      sha512sum "mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless)" \
                > "mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless).sha512"
    - >
      echo "$MINISIG_PWD" |
        minisign -Sm "mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless)"
    - >
      sha512sum "mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless)" \
                > "mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless).sha512"
  script:
    - eval $(ssh-agent -s)
    - ssh-add <(echo "${DEPLOYEMENT_KEY}" | base64 --decode -i)
    - >
      echo "put mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless)"         |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      echo "put mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless).minisig" |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      echo "put mostlymatter-amd64-$(basename "$CI_COMMIT_TAG" -limitless).sha512"  |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      echo "put mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless)"         |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      echo "put mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless).minisig" |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      echo "put mostlymatter-arm64-$(basename "$CI_COMMIT_TAG" -limitless).sha512"  |
        sftp -o "VerifyHostKeyDNS yes" \
             -o "StrictHostKeyChecking accept-new" \
             ${DEPLOYEMENT_USER}@${DEPLOYEMENT_HOST}:public/
    - >
      cat <<EOF
               ================================================================================================
               == mostlymatter-$(basename "$CI_COMMIT_TAG" -limitless) published on https://packages.framasoft.org/projects/mostlymatter/ ==
               ================================================================================================
      EOF
  cache:
    key: "$CI_COMMIT_TAG"
    policy: pull
    paths:
      - "mostlymatter-amd64-$CI_COMMIT_TAG"
      - "mostlymatter-arm64-$CI_COMMIT_TAG"
  rules:
    - if: '$DEPLOYEMENT_HOST && $DEPLOYEMENT_USER && $DEPLOYEMENT_KEY && $MINISIG_KEY && $MINISIG_PWD && $CI_COMMIT_TAG =~ /limitless/'