Linux - Build #2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Linux - Build' | ||
| # Controls when the workflow will run | ||
| on: | ||
| # Triggers the workflow on push or pull request events but only for the main branch | ||
| push: | ||
| tags: | ||
| - '*' | ||
| # Allows running this workflow manually from the Actions tab | ||
| workflow_dispatch: | ||
| inputs: | ||
| package-version: | ||
| description: 'The version to give to the packages. Defaults to the current branch or tag.' | ||
| required: false | ||
| default: '' | ||
| lib-repo-ref: | ||
| description: 'The branch, tag or SHA to checkout (lib repo). Defaults to the current branch or tag.' | ||
| required: false | ||
| default: '' | ||
| package-iteration: | ||
| description: 'The iteration to give to the package. RPM calls this the ‘release’. FreeBSD calls it ‘PORTREVISION’. Debian calls this ‘debian_revision’' | ||
| required: false | ||
| default: '1' | ||
| env: | ||
| # we use this to get a (mostly) unique directory, therefore avoiding folder collisions when multiple workflows are running | ||
| BASE_DIR: '${{ github.sha }}-${{ github.run_id }}_${{ github.run_attempt }}' | ||
| # modify the default permissions granted to the GITHUB_TOKEN | ||
| permissions: | ||
| contents: 'read' | ||
| # A workflow run is made up of one or more jobs that can run sequentially or in parallel | ||
| jobs: | ||
| preparations: | ||
| runs-on: | ||
| - 'rhel8' | ||
| - 'self-hosted' | ||
| steps: | ||
| - name: 'Harden Runner' | ||
| uses: 'step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350' # v2.10.3 | ||
| with: | ||
| egress-policy: 'audit' | ||
| - name: 'checkout the monitoring-plugins repo' | ||
| uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4.2.2 | ||
| with: | ||
| path: '${{ env.BASE_DIR }}/repos/monitoring-plugins' | ||
| - name: 'checkout the lib repo' | ||
| uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4.2.2 | ||
| with: | ||
| repository: 'Linuxfabrik/lib' | ||
| ref: '${{ inputs.lib-repo-ref || github.ref_name }}' | ||
| path: '${{ env.BASE_DIR }}/repos/lib' | ||
| - name: 'mkdir ${{ env.BASE_DIR }}/build' | ||
| run: 'mkdir ${{ env.BASE_DIR }}/build' | ||
| build-packages: | ||
| runs-on: | ||
| - 'rhel8' | ||
| - 'self-hosted' | ||
| needs: | ||
| - 'preparations' | ||
| strategy: | ||
| matrix: | ||
| # Debian | ||
| - name: 'Debian 11' | ||
| container: 'docker.io/library/debian:11' | ||
| directory: 'debian11' | ||
| - name: 'Debian 12' | ||
| container: 'docker.io/library/debian:12' | ||
| directory: 'debian12' | ||
| # RHEL | ||
| - name: 'RHEL8' | ||
| container: 'registry.access.redhat.com/ubi8/ubi' | ||
| directory: 'rhel8' | ||
| - name: 'RHEL9' | ||
| container: 'registry.access.redhat.com/ubi9/ubi' | ||
| directory: 'rhel9' | ||
| # Ubuntu | ||
| - name: 'Ubuntu 20.04' | ||
| container: 'docker.io/library/ubuntu:20.04' | ||
| directory: 'ubuntu2004' | ||
| - name: 'Ubuntu 22.04' | ||
| container: 'docker.io/library/ubuntu:22.04' | ||
| directory: 'ubuntu2204' | ||
| - name: 'Ubuntu 24.04' | ||
| container: 'docker.io/library/ubuntu:24.04' | ||
| directory: 'ubuntu2404' | ||
| - name: 'Ubuntu 24.10' | ||
| container: 'docker.io/library/ubuntu:24.10' | ||
| directory: 'ubuntu2410' | ||
| steps: | ||
| - name: 'Harden Runner' | ||
| uses: 'step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350' # v2.10.3 | ||
| with: | ||
| egress-policy: 'audit' | ||
| - name: 'mkdir ${{ env.BASE_DIR }}/build/${{ matrix.directory }}' | ||
| run: 'mkdir ${{ env.BASE_DIR }}/build/${{ matrix.directory }}' | ||
| - name: 'Build for ${{ matrix.name }}' | ||
| run: > | ||
| podman run --rm | ||
| --mount type=bind,source=${{ env.BASE_DIR }}/build/${{ matrix.directory }},destination=/build,relabel=private | ||
| --mount type=bind,source=${{ env.BASE_DIR }}/repos,destination=/repos,relabel=shared,ro=true | ||
| ${{ matrix.container }} | ||
| /bin/bash -x | ||
| /repos/monitoring-plugins/build/${{ matrix.directory }}/build.sh | ||
| ${{ inputs.package-version || github.ref_name }} | ||
| ${{ inputs.package-iteration || '1' }} | ||
| # this would not work on the GitHub-hosted runners, as each job is isolated there, | ||
| # but works when self-hosted (since there are no parallel jobs) | ||
| upload-outputs: | ||
| runs-on: | ||
| - 'rhel8' | ||
| - 'self-hosted' | ||
| needs: # we want this to run after the build jobs | ||
| - 'build-packages' | ||
| if: '${{ always() }}' # however, we want to upload the artifacts even if one of the job fails | ||
| steps: | ||
| - name: 'Harden Runner' | ||
| uses: 'step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350' # v2.10.3 | ||
| with: | ||
| egress-policy: 'audit' | ||
| - name: 'upload the output as monitoring-plugins-linux-packages' | ||
| uses: 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08' # v4.6.0 | ||
| with: | ||
| name: 'monitoring-plugins-linux-packages' | ||
| path: '${{ env.BASE_DIR }}/build/' | ||
| cleanup: | ||
| runs-on: | ||
| - 'rhel8' | ||
| - 'self-hosted' | ||
| needs: # we want this to run after the above jobs | ||
| - 'upload-outputs' | ||
| steps: | ||
| - name: 'Harden Runner' | ||
| uses: 'step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350' # v2.10.3 | ||
| with: | ||
| egress-policy: 'audit' | ||
| - name: 'rm -rf ${{ env.BASE_DIR }}' | ||
| run: 'rm -rf ${{ env.BASE_DIR }}' | ||
