自动更新 sing-box eBPF 内核 #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 自动更新 sing-box eBPF 内核 | |
| # 定时跟踪 CHIZI-0618/sing-box 的 testing-ref1nd 分支。 | |
| # 上游变化时只构建 Android arm64，直接更新模块内核并触发本仓库 CI。 | |
| on: | |
| schedule: | |
| - cron: '*/10 * * * *' | |
| workflow_dispatch: | |
| inputs: | |
| force: | |
| description: 即使上游提交未变化也重新构建 | |
| required: false | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: update-sing-box | |
| cancel-in-progress: true | |
| env: | |
| UPSTREAM_REPOSITORY: CHIZI-0618/sing-box | |
| UPSTREAM_BRANCH: testing-ref1nd | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| MARKER_FILE: .github/upstream/sing-box-testing-ref1nd.sha | |
| TARGET_FILE: src/module/bin/sing-box | |
| GO_VERSION: 1.25.12 | |
| NDK_VERSION: r25c | |
| BUILD_TAGS: with_gvisor,with_quic,with_dhcp,with_utls,with_clash_api,with_tailscale,badlinkname,tfogo_checklinkname0,with_provider,with_ebpf | |
| jobs: | |
| check: | |
| name: 检查上游提交 | |
| runs-on: ubuntu-latest | |
| outputs: | |
| changed: ${{ steps.compare.outputs.changed }} | |
| upstream_sha: ${{ steps.compare.outputs.upstream_sha }} | |
| short_sha: ${{ steps.compare.outputs.short_sha }} | |
| steps: | |
| - name: 拉取当前仓库 | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ env.DEFAULT_BRANCH }} | |
| persist-credentials: false | |
| - name: 比较上游提交 | |
| id: compare | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| FORCE_UPDATE: ${{ inputs.force || false }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| upstream_sha="$(gh api "repos/${UPSTREAM_REPOSITORY}/commits/${UPSTREAM_BRANCH}" --jq '.sha')" | |
| current_sha="" | |
| if [[ -f "$MARKER_FILE" ]]; then | |
| current_sha="$(tr -d '[:space:]' < "$MARKER_FILE")" | |
| fi | |
| changed=false | |
| if [[ "$FORCE_UPDATE" == "true" || "$upstream_sha" != "$current_sha" ]]; then | |
| changed=true | |
| fi | |
| echo "changed=$changed" >> "$GITHUB_OUTPUT" | |
| echo "upstream_sha=$upstream_sha" >> "$GITHUB_OUTPUT" | |
| echo "short_sha=${upstream_sha:0:8}" >> "$GITHUB_OUTPUT" | |
| { | |
| echo "### sing-box 上游检查" | |
| echo "- 当前记录：\`${current_sha:-未记录}\`" | |
| echo "- 上游提交：\`$upstream_sha\`" | |
| echo "- 需要更新：\`$changed\`" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| build: | |
| name: 构建 Android arm64 eBPF 内核 | |
| needs: check | |
| if: needs.check.outputs.changed == 'true' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 拉取上游源码 | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: ${{ env.UPSTREAM_REPOSITORY }} | |
| ref: ${{ needs.check.outputs.upstream_sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: 配置 Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: 配置 Android NDK | |
| id: setup-ndk | |
| uses: nttld/setup-ndk@v1 | |
| with: | |
| ndk-version: ${{ env.NDK_VERSION }} | |
| - name: 构建内核 | |
| env: | |
| TAGS: ${{ env.BUILD_TAGS }} | |
| CGO_ENABLED: '1' | |
| GOOS: android | |
| GOARCH: arm64 | |
| CC: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang | |
| BPF_CLANG: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang | |
| run: make build | |
| - name: 检查构建产物 | |
| run: | | |
| set -euo pipefail | |
| test -s sing-box | |
| file sing-box | grep -q 'ARM aarch64' | |
| chmod 0755 sing-box | |
| sha256sum sing-box | |
| - name: 上传构建产物 | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sing-box-android-arm64-${{ needs.check.outputs.short_sha }} | |
| path: sing-box | |
| if-no-files-found: error | |
| retention-days: 1 | |
| update: | |
| name: 更新模块并直接提交 | |
| needs: | |
| - check | |
| - build | |
| if: needs.check.outputs.changed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: write | |
| contents: write | |
| steps: | |
| - name: 拉取当前仓库 | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ env.DEFAULT_BRANCH }} | |
| fetch-depth: 0 | |
| - name: 下载构建产物 | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sing-box-android-arm64-${{ needs.check.outputs.short_sha }} | |
| path: .artifacts/sing-box | |
| - name: 替换内核并提交 | |
| id: commit | |
| env: | |
| UPSTREAM_SHA: ${{ needs.check.outputs.upstream_sha }} | |
| SHORT_SHA: ${{ needs.check.outputs.short_sha }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| git pull --ff-only origin "$DEFAULT_BRANCH" | |
| install -m 0755 .artifacts/sing-box/sing-box "$TARGET_FILE" | |
| mkdir -p "$(dirname "$MARKER_FILE")" | |
| printf '%s\n' "$UPSTREAM_SHA" > "$MARKER_FILE" | |
| git add -- "$TARGET_FILE" "$MARKER_FILE" | |
| if git diff --cached --quiet; then | |
| echo "updated=false" >> "$GITHUB_OUTPUT" | |
| echo "构建产物与仓库内容一致，无需提交。" >> "$GITHUB_STEP_SUMMARY" | |
| exit 0 | |
| fi | |
| git diff --cached --check | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git commit \ | |
| -m "chore(core): 更新 sing-box eBPF 内核至 ${SHORT_SHA}" \ | |
| -m "上游提交: https://github.com/${UPSTREAM_REPOSITORY}/commit/${UPSTREAM_SHA}" | |
| git push origin "HEAD:${DEFAULT_BRANCH}" | |
| echo "updated=true" >> "$GITHUB_OUTPUT" | |
| echo "commit_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| - name: 触发模块持续集成 | |
| if: steps.commit.outputs.updated == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh workflow run ci.yml --ref "$DEFAULT_BRANCH" | |
| - name: 写入更新摘要 | |
| if: steps.commit.outputs.updated == 'true' | |
| env: | |
| COMMIT_SHA: ${{ steps.commit.outputs.commit_sha }} | |
| UPSTREAM_SHA: ${{ needs.check.outputs.upstream_sha }} | |
| run: | | |
| { | |
| echo "### sing-box 内核已更新" | |
| echo "- 上游提交：[$UPSTREAM_SHA](https://github.com/${UPSTREAM_REPOSITORY}/commit/$UPSTREAM_SHA)" | |
| echo "- 本仓库提交：[$COMMIT_SHA](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/$COMMIT_SHA)" | |
| echo "- 后续操作：已触发模块持续集成" | |
| } >> "$GITHUB_STEP_SUMMARY" |