fix(connect): WS port preflight aborts under set -e when port is free… #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release.install-script | |
| # Publishes scripts/connect*.sh to the CDN behind https://get.doublezero.xyz/connect | |
| # (and /connect-testnet, /connect-devnet). Uploads to the SAME doublezero-install S3 | |
| # bucket + CloudFront distribution that serves the doublezero installer (managed in | |
| # the doublezero infra repo), under the connect* keys. Auth is GitHub OIDC into the | |
| # main-only deploy role (no static keys). | |
| # | |
| # PREREQUISITE: the deploy role's OIDC trust policy must be extended to also trust | |
| # this repo (repo:malbeclabs/doublezero-edge-connect:*); until then the | |
| # configure-aws-credentials step fails. See the design doc / infra runbook. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "scripts/connect.sh" | |
| - "scripts/connect-testnet.sh" | |
| - "scripts/connect-devnet.sh" | |
| - ".github/workflows/release.install-script.yml" | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write # assume the AWS deploy role via OIDC | |
| contents: read | |
| env: | |
| AWS_REGION: us-east-1 | |
| BUCKET: doublezero-install | |
| # Account-scoped infra (deploy-role ARN incl. the AWS account ID, and the CloudFront | |
| # distribution id) lives in repo Actions Variables so it is not baked into a public | |
| # workflow. Set both under Settings -> Secrets and variables -> Actions -> Variables: | |
| # DEPLOY_ROLE = arn:aws:iam::<account-id>:role/github-doublezero-install-deploy | |
| # DISTRIBUTION_ID = <cloudfront-distribution-id> | |
| DEPLOY_ROLE: ${{ vars.DEPLOY_ROLE }} | |
| DISTRIBUTION_ID: ${{ vars.DISTRIBUTION_ID }} | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1 | |
| with: | |
| role-to-assume: ${{ env.DEPLOY_ROLE }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Upload connect scripts | |
| run: | | |
| for variant in "connect:connect.sh" "connect-testnet:connect-testnet.sh" "connect-devnet:connect-devnet.sh"; do | |
| key="${variant%%:*}"; file="scripts/${variant##*:}" | |
| aws s3 cp "$file" "s3://${BUCKET}/${key}" \ | |
| --content-type text/x-shellscript \ | |
| --cache-control "public,max-age=120" | |
| done | |
| - name: Invalidate CloudFront cache | |
| run: | | |
| aws cloudfront create-invalidation \ | |
| --distribution-id "$DISTRIBUTION_ID" \ | |
| --paths '/connect' '/connect-testnet' '/connect-devnet' |