...

Author: sedmicha

.github/workflows/packages.yml

@@ -46,7 +46,11 @@ jobs:
         DEBIAN_FRONTEND: noninteractive
 
     # Checkout repository --------------------------------------------------------------------
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
+
+    # Install GitHub CLI
+    - name: Install GitHub CLI
+      run: .github/workflow/scripts/install-gh-cli.sh
 
     # Checkout release tag (if on release branch)
     - name: Checkout release tag (if on release branch)
@@ -55,7 +59,6 @@ jobs:
         GH_TOKEN: ${{ github.token }}
         IMAGE_NAME: ${{ matrix.image }}
       run: |
-        git config --global --add safe.directory "$PWD"
         git fetch --tags
         latest_tag="$(git tag | grep 'v[0-9]*\.[0-9]*\.[0-9]*' | sort -rn | head -n1)"
         if [ -z "$latest_tag" ]; then
@@ -108,37 +111,23 @@ jobs:
         GH_TOKEN: ${{ github.token }}
         IMAGE_NAME: ${{ matrix.image }}
       run: |
-        curl -sL "$(curl -sL "https://api.github.com/repos/cli/cli/releases" | grep _linux_amd64.tar.gz | grep https | head -n1 | cut -d'"' -f4)" -o gh.tar.gz \
-          && tar xzf gh.tar.gz \
-          && find gh*/ -name gh -exec mv {} /usr/local/bin/ \;
         git config --global --add safe.directory "$PWD" \
           && git tag -f ci-latest HEAD \
           && git push -f origin tag ci-latest
-        find build/ -iname '*.deb' | while read -r f; do
-          newf="$IMAGE_NAME-$(basename "$f")"
-          mv "$f" "$newf"
-          gh release upload --clobber ci-latest "$newf"
-        done
+        TAG_NAME="ci-latest" ./.github/workflows/scripts/upload-packages.sh
 
     - name: Publish DEB packages to GitHub releases (stable)
       if: github.ref == 'refs/heads/ci-release'
       env:
         GH_TOKEN: ${{ github.token }}
         IMAGE_NAME: ${{ matrix.image }}
       run: |
-        curl -sL "$(curl -sL "https://api.github.com/repos/cli/cli/releases" | grep _linux_amd64.tar.gz | grep https | head -n1 | cut -d'"' -f4)" -o gh.tar.gz \
-          && tar xzf gh.tar.gz \
-          && find gh*/ -name gh -exec mv {} /usr/local/bin/ \;
         latest_tag="$(git describe --exact-match --tags)"
         if ! gh release view "$latest_tag"; then
           echo "could not find release for tag $latest_tag"
           exit 1
         fi
-        find build/ -iname '*.deb' | while read -r f; do
-          newf="$IMAGE_NAME-$(basename "$f")"
-          mv "$f" "$newf"
-          gh release upload --clobber "$latest_tag" "$newf"
-        done
+        TAG_NAME="$latest_tag" ./.github/workflows/scripts/upload-packages.sh
 
   rpm:
     # Try to build RPM packages
@@ -211,7 +200,11 @@ jobs:
         yum -y install rpmdevtools
 
     # Checkout repository --------------------------------------------------------------------
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
+
+    # Install GitHub CLI
+    - name: Install GitHub CLI
+      run: .github/workflow/scripts/install-gh-cli.sh
 
     # Checkout release tag (if on release branch)
     - name: Checkout release tag (if on release branch)
@@ -286,47 +279,19 @@ jobs:
         GH_TOKEN: ${{ github.token }}
         IMAGE_NAME: ${{ matrix.image }}
       run: |
-        set -x
-
-        curl -sL "$(curl -sL "https://api.github.com/repos/cli/cli/releases" | grep _linux_amd64.tar.gz | grep https | head -n1 | cut -d'"' -f4)" -o gh.tar.gz \
-          && tar xzf gh.tar.gz \
-          && find gh*/ -name gh -exec mv {} /usr/local/bin/ \;
-
-        git config --global --add safe.directory "$PWD"
         git tag -f ci-latest HEAD
         git push -f origin tag ci-latest
-
-        IFS=$'\n'
-        set +e; assets="$(gh release view ci-latest | grep '^asset:' | cut -f2 | grep -F "${IMAGE_NAME//:/.}")"; set -e
-        files="$(find build/ -iname '*.rpm')"
-        for f in $files; do
-          newf="$IMAGE_NAME-$(basename "$f")"
-          mv "$f" "$newf"
-          gh release upload --clobber ci-latest "$newf"
-          set +e; assets="$(grep -vF "${newf//:/.}" <<<"$assets")"; set -e
-        done
-
-        for asset in $assets; do
-          gh release delete-asset ci-latest "$asset"
-        done
+        TAG_NAME="ci-latest" ./.github/workflows/scripts/upload-packages.sh
 
     - name: Publish RPM packages to GitHub releases (stable)
       if: github.ref == 'refs/heads/ci-release'
       env:
         GH_TOKEN: ${{ github.token }}
         IMAGE_NAME: ${{ matrix.image }}
       run: |
-        curl -sL "$(curl -sL "https://api.github.com/repos/cli/cli/releases" | grep _linux_amd64.tar.gz | grep https | head -n1 | cut -d'"' -f4)" -o gh.tar.gz \
-          && tar xzf gh.tar.gz \
-          && find gh*/ -name gh -exec mv {} /usr/local/bin/ \;
         latest_tag="$(git describe --exact-match --tags)"
         if ! gh release view "$latest_tag"; then
           echo "could not find release for tag $latest_tag"
           exit 1
         fi
-
-        find build/ -iname '*.rpm' | while read -r f; do
-          newf="$IMAGE_NAME-$(basename "$f")"
-          mv "$f" "$newf"
-          gh release upload --clobber "$latest_tag" "$newf"
-        done
+        TAG_NAME="$latest_tag" ./.github/workflows/scripts/upload-packages.sh

.github/workflows/scripts/install-gh-cli.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+set -eu
+tmpdir="$(mktemp -d)"; mkdir "$tmpdir"; cd "$tmpdir"
+curl -sL "$(curl -sL "https://api.github.com/repos/cli/cli/releases" | grep _linux_amd64.tar.gz | grep https | head -n1 | cut -d'"' -f4)" -o gh.tar.gz
+tar xzf gh.tar.gz
+find gh*/ -name gh -exec mv {} /usr/local/bin/ \;
+rm -rf "$tmpdir"

.github/workflows/scripts/upload-packages.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+set -eu
+IFS=$'\n'
+set +e; assets="$(gh release view "$TAG_NAME" | grep '^asset:' | cut -f2 | grep -F "${IMAGE_NAME//:/.}")"; set -e
+files="$(find build/ \( -iname '*.rpm' -or -iname '*.deb' \) )"
+for f in $files; do
+    newf="$IMAGE_NAME-$(basename "$f")"
+    mv "$f" "$newf"
+    gh release upload --clobber ci-latest "$newf"
+    set +e; assets="$(grep -vF "${newf//:/.}" <<<"$assets")"; set -e
+done
+for asset in $assets; do
+    gh release delete-asset "$TAG_NAME" "$asset"
+done