fix(flux): allow coold JWT primitive capabilities #73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: nightly-${{ github.sha }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| jobs: | |
| prep: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| tag: ${{ steps.meta.outputs.tag }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Compute tag | |
| id: meta | |
| run: echo "tag=nightly-$(date -u +%Y%m%d)-$(git rev-parse --short=8 HEAD)" >> "$GITHUB_OUTPUT" | |
| build: | |
| needs: prep | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-24.04 | |
| target: x86_64-unknown-linux-gnu | |
| musl_target: x86_64-unknown-linux-musl | |
| musl_cc_env: CC_x86_64_unknown_linux_musl | |
| arch: amd64 | |
| - runner: ubuntu-24.04-arm | |
| target: aarch64-unknown-linux-gnu | |
| musl_target: aarch64-unknown-linux-musl | |
| musl_cc_env: CC_aarch64_unknown_linux_musl | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| env: | |
| COOLIFY_COOLD_VERSION: ${{ needs.prep.outputs.tag }} | |
| COOLIFY_FLUX_VERSION: ${{ needs.prep.outputs.tag }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }},${{ matrix.musl_target }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: ${{ matrix.target }} | |
| cache-all-crates: true | |
| cache-on-failure: true | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - name: Install build dependencies | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler musl-tools | |
| - name: Build workspace | |
| run: cargo build --workspace --release --locked --target ${{ matrix.target }} | |
| - name: Package coold | |
| run: | | |
| mkdir -p dist | |
| cp target/${{ matrix.target }}/release/coold dist/coold | |
| tar -czf dist/coold-linux-${{ matrix.arch }}.tar.gz -C dist coold | |
| rm dist/coold | |
| (cd dist && sha256sum coold-linux-${{ matrix.arch }}.tar.gz > coold-linux-${{ matrix.arch }}.tar.gz.sha256) | |
| - name: Package flux | |
| run: | | |
| cp target/${{ matrix.target }}/release/flux dist/flux | |
| tar -czf dist/flux-linux-${{ matrix.arch }}.tar.gz -C dist flux | |
| rm dist/flux | |
| (cd dist && sha256sum flux-linux-${{ matrix.arch }}.tar.gz > flux-linux-${{ matrix.arch }}.tar.gz.sha256) | |
| - name: Build Alpine-compatible Flux and coolify | |
| env: | |
| MUSL_CC_ENV: ${{ matrix.musl_cc_env }} | |
| run: | | |
| echo "${MUSL_CC_ENV}=musl-gcc" >> "$GITHUB_ENV" | |
| export "${MUSL_CC_ENV}=musl-gcc" | |
| cargo build -p flux --release --locked --target ${{ matrix.musl_target }} | |
| cargo build -p coolify-cli --release --locked --target ${{ matrix.musl_target }} | |
| - name: Package Alpine-compatible flux | |
| run: | | |
| cp target/${{ matrix.musl_target }}/release/flux dist/flux | |
| tar -czf dist/flux-linux-musl-${{ matrix.arch }}.tar.gz -C dist flux | |
| rm dist/flux | |
| (cd dist && sha256sum flux-linux-musl-${{ matrix.arch }}.tar.gz > flux-linux-musl-${{ matrix.arch }}.tar.gz.sha256) | |
| - name: Package builder | |
| run: | | |
| cp target/${{ matrix.target }}/release/builder dist/builder | |
| tar -czf dist/builder-linux-${{ matrix.arch }}.tar.gz -C dist builder | |
| rm dist/builder | |
| (cd dist && sha256sum builder-linux-${{ matrix.arch }}.tar.gz > builder-linux-${{ matrix.arch }}.tar.gz.sha256) | |
| - name: Package coolify | |
| run: | | |
| cp target/${{ matrix.target }}/release/coolify dist/coolify | |
| tar -czf dist/coolify-linux-${{ matrix.arch }}.tar.gz -C dist coolify | |
| rm dist/coolify | |
| (cd dist && sha256sum coolify-linux-${{ matrix.arch }}.tar.gz > coolify-linux-${{ matrix.arch }}.tar.gz.sha256) | |
| - name: Package Alpine-compatible coolify | |
| run: | | |
| cp target/${{ matrix.musl_target }}/release/coolify dist/coolify | |
| tar -czf dist/coolify-linux-musl-${{ matrix.arch }}.tar.gz -C dist coolify | |
| rm dist/coolify | |
| (cd dist && sha256sum coolify-linux-musl-${{ matrix.arch }}.tar.gz > coolify-linux-musl-${{ matrix.arch }}.tar.gz.sha256) | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: coold-linux-${{ matrix.arch }} | |
| path: dist/* | |
| retention-days: 7 | |
| build-macos: | |
| needs: prep | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: macos-14 | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| env: | |
| COOLIFY_COOLD_VERSION: ${{ needs.prep.outputs.tag }} | |
| COOLIFY_FLUX_VERSION: ${{ needs.prep.outputs.tag }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: darwin-${{ matrix.arch }} | |
| cache-all-crates: true | |
| cache-on-failure: true | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - name: Build coolify CLI | |
| run: cargo build -p coolify-cli --release --locked | |
| - name: Package coolify CLI | |
| run: | | |
| mkdir -p dist | |
| cp target/release/coolify dist/coolify | |
| tar -czf dist/coolify-darwin-${{ matrix.arch }}.tar.gz -C dist coolify | |
| rm dist/coolify | |
| (cd dist && shasum -a 256 coolify-darwin-${{ matrix.arch }}.tar.gz > coolify-darwin-${{ matrix.arch }}.tar.gz.sha256) | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: coolify-darwin-${{ matrix.arch }} | |
| path: dist/* | |
| retention-days: 7 | |
| release: | |
| needs: [prep, build, build-macos] | |
| runs-on: ubuntu-24.04 | |
| env: | |
| TAG: ${{ needs.prep.outputs.tag }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Compose release notes | |
| id: notes | |
| run: | | |
| PREV=$(git tag --list 'nightly-*' --sort=-creatordate | head -n1) | |
| { | |
| echo "body<<EOF" | |
| echo "Automated nightly build from \`${GITHUB_SHA}\`." | |
| echo | |
| echo "**Version:** \`${TAG}\`" | |
| echo "**Commit:** $(git log -1 --pretty=format:'%s')" | |
| echo | |
| echo "### Artifacts" | |
| echo "- \`coold\` — per-host agent (holds the single gRPC stream to flux; spawns builder subprocess per BuildRequest when COOLIFY_COOLD_BUILDER_ENABLED=1)" | |
| echo "- \`flux\` — central-side gRPC stream router (single listener on :6443; capability-aware routing; musl artifacts are Alpine-compatible)" | |
| echo "- \`builder\` — short-lived build subprocess invoked by coold under a \`systemd-run --scope\` transient unit" | |
| echo "- \`coolify\` — provisioning CLI for WireGuard, Podman mesh networks, Corrosion, coold, builder, and firewall rules" | |
| echo | |
| if [ -n "$PREV" ]; then | |
| echo "### Changes since $PREV" | |
| git log --pretty=format:'- %s (%h)' "$PREV"..HEAD | |
| echo | |
| fi | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Create per-commit release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ env.TAG }} | |
| name: Nightly ${{ env.TAG }} | |
| body: ${{ steps.notes.outputs.body }} | |
| prerelease: true | |
| make_latest: false | |
| files: | | |
| dist/coold-linux-amd64.tar.gz | |
| dist/coold-linux-amd64.tar.gz.sha256 | |
| dist/coold-linux-arm64.tar.gz | |
| dist/coold-linux-arm64.tar.gz.sha256 | |
| dist/flux-linux-amd64.tar.gz | |
| dist/flux-linux-amd64.tar.gz.sha256 | |
| dist/flux-linux-arm64.tar.gz | |
| dist/flux-linux-arm64.tar.gz.sha256 | |
| dist/flux-linux-musl-amd64.tar.gz | |
| dist/flux-linux-musl-amd64.tar.gz.sha256 | |
| dist/flux-linux-musl-arm64.tar.gz | |
| dist/flux-linux-musl-arm64.tar.gz.sha256 | |
| dist/builder-linux-amd64.tar.gz | |
| dist/builder-linux-amd64.tar.gz.sha256 | |
| dist/builder-linux-arm64.tar.gz | |
| dist/builder-linux-arm64.tar.gz.sha256 | |
| dist/coolify-linux-amd64.tar.gz | |
| dist/coolify-linux-amd64.tar.gz.sha256 | |
| dist/coolify-linux-arm64.tar.gz | |
| dist/coolify-linux-arm64.tar.gz.sha256 | |
| dist/coolify-linux-musl-amd64.tar.gz | |
| dist/coolify-linux-musl-amd64.tar.gz.sha256 | |
| dist/coolify-linux-musl-arm64.tar.gz | |
| dist/coolify-linux-musl-arm64.tar.gz.sha256 | |
| dist/coolify-darwin-arm64.tar.gz | |
| dist/coolify-darwin-arm64.tar.gz.sha256 | |
| - name: Refresh rolling nightly release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release delete nightly --yes --cleanup-tag 2>/dev/null || true | |
| gh release create nightly \ | |
| --prerelease \ | |
| --title "Nightly (latest)" \ | |
| --target "${GITHUB_SHA}" \ | |
| --notes "Latest nightly build — mirrors [${TAG}](../../releases/tag/${TAG})." \ | |
| dist/coold-linux-amd64.tar.gz \ | |
| dist/coold-linux-amd64.tar.gz.sha256 \ | |
| dist/coold-linux-arm64.tar.gz \ | |
| dist/coold-linux-arm64.tar.gz.sha256 \ | |
| dist/flux-linux-amd64.tar.gz \ | |
| dist/flux-linux-amd64.tar.gz.sha256 \ | |
| dist/flux-linux-arm64.tar.gz \ | |
| dist/flux-linux-arm64.tar.gz.sha256 \ | |
| dist/flux-linux-musl-amd64.tar.gz \ | |
| dist/flux-linux-musl-amd64.tar.gz.sha256 \ | |
| dist/flux-linux-musl-arm64.tar.gz \ | |
| dist/flux-linux-musl-arm64.tar.gz.sha256 \ | |
| dist/builder-linux-amd64.tar.gz \ | |
| dist/builder-linux-amd64.tar.gz.sha256 \ | |
| dist/builder-linux-arm64.tar.gz \ | |
| dist/builder-linux-arm64.tar.gz.sha256 \ | |
| dist/coolify-linux-amd64.tar.gz \ | |
| dist/coolify-linux-amd64.tar.gz.sha256 \ | |
| dist/coolify-linux-arm64.tar.gz \ | |
| dist/coolify-linux-arm64.tar.gz.sha256 \ | |
| dist/coolify-linux-musl-amd64.tar.gz \ | |
| dist/coolify-linux-musl-amd64.tar.gz.sha256 \ | |
| dist/coolify-linux-musl-arm64.tar.gz \ | |
| dist/coolify-linux-musl-arm64.tar.gz.sha256 \ | |
| dist/coolify-darwin-arm64.tar.gz \ | |
| dist/coolify-darwin-arm64.tar.gz.sha256 |