feat: parse kube config explicitly (#21) #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update OpenSSH bundles | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| openssh_version: | |
| description: "OpenSSH portable version to use (e.g. 10.0p1). Leave empty for latest." | |
| required: false | |
| default: "" | |
| force_rebuild: | |
| description: "Rebuild even when the repository already targets this version." | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: update-openssh-bundles-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }} | |
| jobs: | |
| resolve: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| current: ${{ steps.openssh.outputs.current }} | |
| tarball_url: ${{ steps.openssh.outputs.tarball_url }} | |
| update_needed: ${{ steps.plan.outputs.update_needed }} | |
| version: ${{ steps.openssh.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event_name == 'workflow_dispatch' && github.event.repository.default_branch || github.ref }} | |
| - name: Resolve OpenSSH version | |
| id: openssh | |
| shell: bash | |
| env: | |
| REQUESTED_OPENSSH_VERSION: ${{ inputs.openssh_version }} | |
| run: | | |
| set -euo pipefail | |
| base_url="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable" | |
| requested="${REQUESTED_OPENSSH_VERSION:-}" | |
| if [ -z "$requested" ] || [ "$requested" = "latest" ]; then | |
| version="$( | |
| curl -fsSL "$base_url/" | | |
| grep -Eo 'openssh-[0-9]+\.[0-9]+p[0-9]+\.tar\.gz' | | |
| sed -E 's/^openssh-//; s/\.tar\.gz$//' | | |
| sort -Vu | | |
| tail -n 1 | |
| )" | |
| else | |
| version="${requested#openssh-}" | |
| version="${version%.tar.gz}" | |
| fi | |
| if ! printf '%s\n' "$version" | grep -Eq '^[0-9]+\.[0-9]+p[0-9]+$'; then | |
| echo "Invalid OpenSSH portable version: $version" >&2 | |
| exit 1 | |
| fi | |
| tarball_url="$base_url/openssh-${version}.tar.gz" | |
| curl -fsSIL "$tarball_url" >/dev/null | |
| current="$(awk '/^OPENSSH_VERSION \?= / {print $3; exit}' Makefile)" | |
| echo "Resolved OpenSSH portable version: $version" | |
| echo "Current Makefile default: ${current:-unknown}" | |
| { | |
| echo "version=$version" | |
| echo "current=$current" | |
| echo "tarball_url=$tarball_url" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Plan update | |
| id: plan | |
| shell: bash | |
| env: | |
| CURRENT_OPENSSH_VERSION: ${{ steps.openssh.outputs.current }} | |
| FORCE_REBUILD: ${{ inputs.force_rebuild }} | |
| OPENSSH_VERSION: ${{ steps.openssh.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$OPENSSH_VERSION" = "$CURRENT_OPENSSH_VERSION" ] && [ "$FORCE_REBUILD" != "true" ]; then | |
| echo "OpenSSH is already $OPENSSH_VERSION; no bundle update needed." | |
| echo "update_needed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "update_needed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| build: | |
| needs: resolve | |
| if: needs.resolve.outputs.update_needed == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event_name == 'workflow_dispatch' && github.event.repository.default_branch || github.ref }} | |
| - name: Update version defaults and rebuild bundle | |
| shell: bash | |
| env: | |
| OPENSSH_VERSION: ${{ needs.resolve.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| perl -0pi -e 's/^ARG OPENSSH_VERSION=.*/ARG OPENSSH_VERSION=$ENV{OPENSSH_VERSION}/m' Dockerfile.bundle | |
| perl -0pi -e 's/^OPENSSH_VERSION \?= .*/OPENSSH_VERSION ?= $ENV{OPENSSH_VERSION}/m' Makefile | |
| make -B bundles ARCHES=${{ matrix.arch }} OPENSSH_VERSION="$OPENSSH_VERSION" | |
| xz -t bundles/sshd_${{ matrix.arch }}.xz | |
| - name: Upload bundle | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: sshd-${{ matrix.arch }} | |
| path: bundles/sshd_${{ matrix.arch }}.xz | |
| prepare_pr: | |
| needs: | |
| - resolve | |
| - build | |
| if: always() && needs.resolve.outputs.update_needed == 'true' && needs.build.result == 'success' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event_name == 'workflow_dispatch' && github.event.repository.default_branch || github.ref }} | |
| - name: Update version defaults | |
| shell: bash | |
| env: | |
| OPENSSH_VERSION: ${{ needs.resolve.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| perl -0pi -e 's/^ARG OPENSSH_VERSION=.*/ARG OPENSSH_VERSION=$ENV{OPENSSH_VERSION}/m' Dockerfile.bundle | |
| perl -0pi -e 's/^OPENSSH_VERSION \?= .*/OPENSSH_VERSION ?= $ENV{OPENSSH_VERSION}/m' Makefile | |
| - name: Download amd64 bundle | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sshd-amd64 | |
| path: bundles | |
| - name: Download arm64 bundle | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sshd-arm64 | |
| path: bundles | |
| - name: Check for changes | |
| id: changes | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| xz -t bundles/sshd_amd64.xz | |
| xz -t bundles/sshd_arm64.xz | |
| git status --short | |
| if git diff --quiet -- Makefile Dockerfile.bundle bundles/sshd_amd64.xz bundles/sshd_arm64.xz; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create pull request | |
| if: github.event_name == 'workflow_dispatch' && steps.changes.outputs.changed == 'true' | |
| shell: bash | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| GH_TOKEN: ${{ github.token }} | |
| OPENSSH_VERSION: ${{ needs.resolve.outputs.version }} | |
| TARBALL_URL: ${{ needs.resolve.outputs.tarball_url }} | |
| run: | | |
| set -euo pipefail | |
| branch="update/openssh-${OPENSSH_VERSION}-bundles" | |
| title="Update OpenSSH bundles to ${OPENSSH_VERSION}" | |
| body_file="$RUNNER_TEMP/update-openssh-bundles-pr.md" | |
| cat > "$body_file" <<EOF | |
| Updates the embedded sshd bundles to OpenSSH portable ${OPENSSH_VERSION}. | |
| Source tarball: ${TARBALL_URL} | |
| Generated by the manual Update OpenSSH bundles workflow: | |
| ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} | |
| EOF | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git checkout -B "$branch" | |
| git add Makefile Dockerfile.bundle bundles/sshd_amd64.xz bundles/sshd_arm64.xz | |
| git commit -m "$title" | |
| git push --force-with-lease origin "HEAD:$branch" | |
| existing_pr="$( | |
| gh pr list \ | |
| --head "$branch" \ | |
| --base "$DEFAULT_BRANCH" \ | |
| --state open \ | |
| --json number \ | |
| --jq '.[0].number // empty' | |
| )" | |
| if [ -n "$existing_pr" ]; then | |
| gh pr edit "$existing_pr" --title "$title" --body-file "$body_file" | |
| else | |
| gh pr create --base "$DEFAULT_BRANCH" --head "$branch" --title "$title" --body-file "$body_file" | |
| fi |