fix(suidhelper): close_range via raw syscall for aarch64-musl portabi… #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| # Least privilege by default; jobs that push the version bump or touch the | |
| # GitHub release escalate to contents: write at the job level. | |
| permissions: | |
| contents: read | |
| # Never cancel a release mid-flight (a cancelled publish can leave a half-done | |
| # release); serialise per-ref instead. | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| prepare-release: | |
| name: Bump version from tag | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| # The release version (tag minus its leading "v") and the SHA of the bump | |
| # commit. Every downstream job checks out `sha` so it builds/publishes the | |
| # bumped tree exactly, regardless of where main moves afterwards. | |
| version: ${{ steps.bump.outputs.version }} | |
| sha: ${{ steps.bump.outputs.sha }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main | |
| - name: Write tag version into manifests and push to main | |
| id: bump | |
| run: | | |
| version="${GITHUB_REF_NAME#v}" | |
| # The tag is the single source of truth: stamp it into every package | |
| # manifest. `0,/re/` rewrites only the first match, which for each | |
| # Cargo.toml is its own `[package] version` (xtask is intentionally | |
| # left at 0.0.0 — it is publish = false). | |
| for m in native/suidhelper/Cargo.toml native/suidhelper/meta/Cargo.toml native/guest-agent/Cargo.toml; do | |
| sed -i -E "0,/^version = \"[^\"]*\"/s//version = \"${version}\"/" "$m" | |
| done | |
| sed -i -E "0,/version: \"[^\"]*\"/s//version: \"${version}\"/" mix.exs | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add native/suidhelper/Cargo.toml native/suidhelper/meta/Cargo.toml native/guest-agent/Cargo.toml mix.exs | |
| # Idempotent: a re-run after the bump already landed has nothing to commit. | |
| if git diff --cached --quiet; then | |
| echo "manifests already at ${version}; nothing to commit" | |
| else | |
| git commit -m "release: v${version}" | |
| git push origin HEAD:main | |
| fi | |
| echo "version=${version}" >> "$GITHUB_OUTPUT" | |
| echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| build-suidhelper: | |
| name: Build suidhelper (${{ matrix.target }}) | |
| needs: prepare-release | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| target: | |
| - x86_64-unknown-linux-musl | |
| - aarch64-unknown-linux-musl | |
| defaults: | |
| run: | |
| working-directory: native/suidhelper | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare-release.outputs.sha }} | |
| # rustup reads native/suidhelper/rust-toolchain.toml on the first cargo | |
| # call and installs the pinned nightly + both musl targets. | |
| - name: Show toolchain | |
| run: rustup show | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: native/suidhelper | |
| - name: Build release binary | |
| run: cargo build --release --target ${{ matrix.target }} | |
| - name: Stage renamed artifact | |
| run: | | |
| v="${{ needs.prepare-release.outputs.version }}" | |
| out="hyper-suidhelper-${v}-${{ matrix.target }}" | |
| mkdir -p dist | |
| cp "target/${{ matrix.target }}/release/hyper-suidhelper" "dist/${out}" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: suidhelper-${{ matrix.target }} | |
| path: native/suidhelper/dist/* | |
| if-no-files-found: error | |
| build-hex: | |
| name: Build Hex package | |
| needs: prepare-release | |
| runs-on: ubuntu-latest | |
| env: | |
| MIX_ENV: dev | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare-release.outputs.sha }} | |
| - uses: erlef/setup-beam@v1 | |
| id: beam | |
| with: | |
| elixir-version: "1.20" | |
| otp-version: "28" | |
| - name: Cache deps and _build | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| deps | |
| _build | |
| key: ${{ runner.os }}-release-mix-${{ steps.beam.outputs.otp-version }}-${{ steps.beam.outputs.elixir-version }}-${{ hashFiles('mix.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-release-mix-${{ steps.beam.outputs.otp-version }}-${{ steps.beam.outputs.elixir-version }}- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| # The gitignored gRPC/guest-agent/suidhelper artifacts are regenerated by | |
| # Mix compilers on every compile; hex.build compiles, so the runner needs | |
| # their toolchain. Mirrors ci.yml. | |
| - name: Install protoc | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler | |
| - name: Install protoc-gen-elixir | |
| run: mix escript.install hex protobuf 0.17.0 --force | |
| - name: Install musl target for the guest-agent build | |
| run: rustup target add x86_64-unknown-linux-musl | |
| - name: Build package tarball | |
| run: mix hex.build --output "hypervm-${{ needs.prepare-release.outputs.version }}.tar" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: hex-package | |
| path: hypervm-*.tar | |
| if-no-files-found: error | |
| github-release: | |
| name: Draft GitHub release | |
| needs: [build-suidhelper, build-hex] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: artifacts | |
| - name: Collect assets and compute checksums | |
| run: | | |
| mkdir -p release | |
| find artifacts -type f \( -name 'hyper-suidhelper-*' -o -name 'hypervm-*.tar' \) \ | |
| -exec cp {} release/ \; | |
| ( cd release && sha256sum hyper-suidhelper-* hypervm-*.tar > SHA256SUMS ) | |
| ls -la release | |
| - name: Create draft release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| draft: true | |
| tag_name: ${{ github.ref_name }} | |
| name: ${{ github.ref_name }} | |
| generate_release_notes: true | |
| files: release/* | |
| publish-hex: | |
| name: Publish to Hex | |
| needs: [prepare-release, build-hex, github-release] | |
| runs-on: ubuntu-latest | |
| environment: release | |
| env: | |
| MIX_ENV: dev | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare-release.outputs.sha }} | |
| - uses: erlef/setup-beam@v1 | |
| with: | |
| elixir-version: "1.20" | |
| otp-version: "28" | |
| - name: Install dependencies | |
| run: mix deps.get | |
| # The gitignored gRPC/guest-agent/suidhelper artifacts are regenerated by | |
| # Mix compilers on every compile; hex.build compiles, so the runner needs | |
| # their toolchain. Mirrors ci.yml. | |
| - name: Install protoc | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler | |
| - name: Install protoc-gen-elixir | |
| run: mix escript.install hex protobuf 0.17.0 --force | |
| - name: Install musl target for the guest-agent build | |
| run: rustup target add x86_64-unknown-linux-musl | |
| # HEX_API_KEY authenticates non-interactively; --yes skips the prompt. | |
| # Publishes both the package and its docs. | |
| - name: hex publish | |
| env: | |
| HEX_API_KEY: ${{ secrets.HEX_API_KEY }} | |
| run: mix hex.publish --yes | |
| finalize-release: | |
| name: Publish GitHub release | |
| needs: [publish-hex] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| # Flip the draft (created earlier) to live only after both registries | |
| # have the new version. github.token has the contents:write granted above. | |
| - name: Mark release as published | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release edit "${{ github.ref_name }}" --draft=false |