ci(release): shared, opt-in release workflow from PDAT/ci-workflows (after build hook support) #1

New Issue

2026-09-29T16:49:11Z

claude_bot Bot commented

2026-09-29 16:49:11 +00:00

On 2026-09-29 we compared the release workflows of all 13 repositories that publish to repo.pda.cz. Each is a copy that has drifted. PDAT/ci-workflows now provides one shared, opt-in reusable workflow, deb-release.yml (v1.0.0), and PDAT/pda-seal already uses it (PDAT/pda-seal#125).

Why not right away: this repo packages .deb with nfpm, while the shared workflow can do only GoReleaser so far. Support for a custom build command (build, which produces dist/*.deb with the version from RELEASE_VERSION) is tracked in PDAT/ci-workflows#2.

Differences in .gitea/workflows/auto-tag.yml in this repo, worth fixing now:

Token in argv: PDA_REPO_TOKEN goes to curl as an argument (-H "Authorization: Bearer …"), so it is visible in the runner's process list. Better:
curl … -H @- -F "file=@${deb}" <<<"Authorization: Bearer $PDA_REPO_TOKEN".
Unchecked upload: nothing checks the sha256 that repo.pda.cz returns in its JSON. Compare it with sha256sum "$deb", for example with python3 -I -c 'import json,sys; print(json.load(sys.stdin).get("sha256",""))'.
Older actions pinned by tag: it uses the older actions/checkout@v4 and actions/setup-go@v5. Better: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0, actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0.
No checks: the release installs nfpm on every run and checks nothing before it publishes.

Once PDAT/ci-workflows#2 is in, the whole release can switch to the shared workflow (build: = nfpm), keeping reserved tags, the token on stdin and the checksum check. The shared workflow is opt-in: you can keep your own.

On 2026-09-29 we compared the release workflows of all 13 repositories that publish to repo.pda.cz. Each is a copy that has drifted. [PDAT/ci-workflows](https://git.pda.cz/PDAT/ci-workflows) now provides one shared, **opt-in** reusable workflow, `deb-release.yml` (v1.0.0), and PDAT/pda-seal already uses it (PDAT/pda-seal#125). **Why not right away:** this repo packages `.deb` with nfpm, while the shared workflow can do only GoReleaser so far. Support for a custom build command (`build`, which produces `dist/*.deb` with the version from `RELEASE_VERSION`) is tracked in PDAT/ci-workflows#2. **Differences in `.gitea/workflows/auto-tag.yml` in this repo, worth fixing now:** - **Token in argv:** `PDA_REPO_TOKEN` goes to `curl` as an argument (`-H "Authorization: Bearer …"`), so it is visible in the runner's process list. Better: `curl … -H @- -F "file=@${deb}" <<<"Authorization: Bearer $PDA_REPO_TOKEN"`. - **Unchecked upload:** nothing checks the `sha256` that repo.pda.cz returns in its JSON. Compare it with `sha256sum "$deb"`, for example with `python3 -I -c 'import json,sys; print(json.load(sys.stdin).get("sha256",""))'`. - **Older actions pinned by tag:** it uses the older `actions/checkout@v4` and `actions/setup-go@v5`. Better: `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0`, `actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0`. - **No checks:** the release installs nfpm on every run and checks nothing before it publishes. Once PDAT/ci-workflows#2 is in, the whole release can switch to the shared workflow (`build:` = nfpm), keeping reserved tags, the token on stdin and the checksum check. The shared workflow is **opt-in**: you can keep your own.

claude_bot Bot commented

2026-10-08 15:37:10 +00:00

The build hook exists now (PDAT/ci-workflows#10), so this repo can use the shared release. Callers use @main (ci-workflows#9). This repo fits it almost as-is:

jobs:
  release:
    uses: PDAT/ci-workflows/.gitea/workflows/deb-release.yml@main
    with:
      go-version: '1.26'
      verify: for f in profiles/*.json; do python3 -m json.tool "$f" >/dev/null; done
      build: |
        go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.41.3
        mkdir -p dist
        VERSION="$RELEASE_VERSION" "$(go env GOPATH)/bin/nfpm" pkg --packager deb --target dist/ -f nfpm.yaml
    secrets:
      PDA_REPO_TOKEN: ${{ secrets.PDA_REPO_TOKEN }}

Notes

go-version installs Go for nfpm only. Without a go.mod, the module steps are skipped.
Checked against this repo's real nfpm.yaml with nfpm v2.41.3:
- a release builds with exactly the release version
- a dry run builds a ~dryrun.g<sha> snapshot
verify adds the JSON check before anything is published. Today nothing runs before publishing.
Release path in every PR: a second call with dry-run: true checks it.
Why now: today ${{ secrets.PDA_REPO_TOKEN }} is written straight into the curl command, so the token lands in the generated script file and on curl's command line. The shared workflow passes it on stdin, checks the SHA-256 after upload, and pins actions to SHAs instead of @v4/@v5.

It's opt-in and your call. Questions go to PDAT/ci-workflows.

**The `build` hook exists now** (PDAT/ci-workflows#10), so this repo can use the shared release. Callers use `@main` (ci-workflows#9). This repo fits it almost as-is: ```yaml jobs: release: uses: PDAT/ci-workflows/.gitea/workflows/deb-release.yml@main with: go-version: '1.26' verify: for f in profiles/*.json; do python3 -m json.tool "$f" >/dev/null; done build: | go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.41.3 mkdir -p dist VERSION="$RELEASE_VERSION" "$(go env GOPATH)/bin/nfpm" pkg --packager deb --target dist/ -f nfpm.yaml secrets: PDA_REPO_TOKEN: ${{ secrets.PDA_REPO_TOKEN }} ``` **Notes** - **`go-version`** installs Go for nfpm only. Without a `go.mod`, the module steps are skipped. - **Checked against this repo's real `nfpm.yaml`** with nfpm v2.41.3: - a release builds with exactly the release version - a dry run builds a `~dryrun.g<sha>` snapshot - **`verify`** adds the JSON check before anything is published. Today nothing runs before publishing. - **Release path in every PR:** a second call with `dry-run: true` checks it. - **Why now:** today `${{ secrets.PDA_REPO_TOKEN }}` is written straight into the curl command, so the token lands in the generated script file and on curl's command line. The shared workflow passes it on stdin, checks the SHA-256 after upload, and pins actions to SHAs instead of `@v4`/`@v5`. It's opt-in and your call. Questions go to PDAT/ci-workflows.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: PDAT/pda-fieldbus-profiles#1