Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion .github/renovate.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,32 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended"
"config:recommended",
"helpers:pinGitHubActionDigestsToSemver"
],
"platformAutomerge": true,
"internalChecksFilter": "strict",
"customManagers": [
{
"customType": "regex",
"managerFilePatterns": ["/^build\\.sh$/"],
"matchStrings": ["PHP_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
"depNameTemplate": "php/php-src",
"datasourceTemplate": "github-releases",
"extractVersionTemplate": "^php-(?<version>8\\.5\\.\\d+)$"
}
],
"packageRules": [
{
"description": "Automerge GitHub Actions updates, including majors, when checks pass",
"matchManagers": ["github-actions"],
"automerge": true
},
{
"description": "Automerge PHP 8.5 patch releases in build.sh when checks pass",
"matchPackageNames": ["php/php-src"],
"matchUpdateTypes": ["patch"],
"automerge": true
}
]
}
97 changes: 97 additions & 0 deletions .github/scripts/test-package.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
#!/usr/bin/env bash
# Build the worker deb, install it, and check PHP 8.5 plus the modules it depends on.
set -euo pipefail

root=$(cd "$(dirname "$0")/../.." && pwd)
cd "$root"

if [ "$(id -u)" -eq 0 ]; then
asroot() { "$@"; }
else
asroot() { sudo "$@"; }
fi

export DEBIAN_FRONTEND=noninteractive
php_min=$(sed -n 's/^PHP_VERSION=//p' build.sh)
[ -n "$php_min" ] || { echo "PHP_VERSION is missing from build.sh" >&2; exit 1; }
echo "required php >= ${php_min}"

asroot apt-get update
asroot apt-get install -y ruby ruby-dev build-essential fakeroot git curl ca-certificates gnupg software-properties-common
# GitHub's Ubuntu image ships PHP 8.3. Workers only use 8.5.
mapfile -t php83 < <(dpkg-query -W -f '${Package}\n' 'php8.3*' 2>/dev/null || true)
if [ "${#php83[@]}" -gt 0 ]; then
echo "removing preinstalled php 8.3: ${php83[*]}"
asroot apt-get purge -y "${php83[@]}"
asroot apt-get autoremove -y
fi
# A mounted checkout can be owned by another user. This only affects this job.
git config --global --add safe.directory "$root"
asroot gem install --no-document fpm

rm -f notifiarr-worker_*.deb
bash build.sh
deb=$(echo notifiarr-worker_*.deb)
[ -f "$deb" ] || { echo "deb was not built" >&2; exit 1; }
echo "built ${deb}"
dpkg-deb -I "$deb"

depends=$(dpkg-deb -f "$deb" Depends)
for pkg in cli curl mbstring mysql xml; do
needle="php8.5-${pkg} (>= ${php_min})"
if ! grep -F -q "$needle" <<<"$depends"; then
echo "missing dependency: ${needle}" >&2
echo "$depends" >&2
exit 1
fi
done
for pkg in memcached redis; do
if ! grep -Eq "(^|, )php8\.5-${pkg}(,|$)" <<<"$depends"; then
echo "missing dependency: php8.5-${pkg}" >&2
echo "$depends" >&2
exit 1
fi
done
if grep -q 'php8.3' <<<"$depends"; then
echo "package still depends on php8.3" >&2
exit 1
fi

asroot install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://repos.influxdata.com/influxdata-archive.key | gpg --dearmor | asroot tee /etc/apt/keyrings/influxdata-archive.gpg >/dev/null
echo "deb [signed-by=/etc/apt/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main" | asroot tee /etc/apt/sources.list.d/influxdata.list >/dev/null
asroot add-apt-repository -y ppa:ondrej/php
asroot apt-get update
asroot apt-get install -y "./${deb}"

php -v
PHP_MIN="$php_min" php -r 'exit(version_compare(PHP_VERSION, getenv("PHP_MIN"), ">=") ? 0 : 1);'
echo "php $(php -r 'echo PHP_VERSION;') satisfies >= ${php_min}"
if dpkg-query -W -f '${Package}\n' 'php8.3*' 2>/dev/null | grep -q .; then

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It didn't. If this happens in a workflow, that's a weird problem. Not worried about this.

echo "php 8.3 is still installed" >&2
dpkg-query -W -f '${Package} ${Version}\n' 'php8.3*' >&2 || true
exit 1
fi

for mod in curl mbstring memcached mysqli redis xml; do
if ! php -m | grep -qx "$mod"; then
echo "php module ${mod} is not loaded" >&2
php -m >&2
exit 1
fi
echo "php module ${mod} ok"
done

check() {
if ! asroot "$@"; then
echo "check failed: $*" >&2
exit 1
fi
}
check test -f /etc/sudoers.d/workers
check test -f /etc/systemd/system/supervisor.service.d/notifiarr.conf
check test -f /etc/telegraf/telegraf.d/notifiarr.conf
check test -x /config/supervisor/prestart.sh
check test -f /home/abc/.ssh/authorized_keys
check id abc
echo "package install ok"
32 changes: 21 additions & 11 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,36 +8,46 @@ on:
- v*
pull_request:
branches:
- main
- unstable
- main
- unstable
permissions:
contents: read
jobs:
test:
name: test
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: "0"
- name: Build and install package
run: bash .github/scripts/test-package.sh

release:
# description: "Builds all the Notifiarr client binaries and packages for a release."
if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/unstable' || github.ref == 'refs/heads/main'
needs: test
outputs:
version: ${{ steps.release.outputs.version }}
name: Make Release Assets
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
env:
GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# we need the whole thing so we can count commits.
fetch-depth: '0'
fetch-depth: "0"
- name: make-release
id: release
run: |
sudo apt install -y fakeroot zip debsigs gnupg jq
sudo apt install -y fakeroot zip debsigs gnupg jq
sudo gem install --no-document fpm
echo "${GPG_SIGNING_KEY}" | gpg --import -
bash build.sh
mkdir release
mv *.deb release
- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: release
path: release
Expand All @@ -46,13 +56,13 @@ jobs:
if: startsWith(github.ref, 'refs/tags/v')
needs: release
name: Deploy Nonpublic PackageCloud
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- name: Download release files
uses: actions/download-artifact@v8
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: release
- uses: golift/upload-packagecloud@v1.1
- uses: golift/upload-packagecloud@eb0067369b59340b04dce218010960ebe74720b2 # v1.1.1
with:
userrepo: golift/nonpublic
apitoken: ${{ secrets.PACKAGECLOUD_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ There's nothing very useful in this repo for the public.

GitHub Actions runs the [build.sh](build.sh) script which turns the [root/](root/) folder into a deb package and uploads it to package cloud.

- The package installs a number of dependencies, including `telegraf`, `php`, `supervisor` and `nfs-client`.
- The package installs a number of dependencies, including `telegraf`, PHP 8.5 (>= 8.5.12), `supervisor` and `nfs-client`.
- Also installed is a user named `abc` with an [authorized_keys ssh](root/home/abc/.ssh/authorized_keys)
file and a [sudoers](root/etc/sudoers.d/workers) entry that allows the website to restart supervisor.
- The [systemd unit override](root/etc/systemd/system/supervisor.service.d/notifiarr.conf)
Expand Down
6 changes: 4 additions & 2 deletions after-install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ if [ -d ~abc/.ssh ]; then
chown -R abc: ~abc
fi

if [ -x "/bin/systemctl" ]; then
if [ -d /run/systemd/system ]; then
/bin/systemctl daemon-reload

if [ -d "/share/websites/www" ]; then
Expand All @@ -29,5 +29,7 @@ if [ -d "/share/workers/defaults/ssh/$(hostname -s)" ] && \
then
echo "SSH Host keys updated. Restarting SSH daemon!"
cp -r "/share/workers/defaults/ssh/$(hostname -s)/ssh_host_*" /etc/ssh/
/bin/systemctl restart sshd
if [ -d /run/systemd/system ]; then
/bin/systemctl restart sshd
fi
fi
2 changes: 1 addition & 1 deletion before-remove.sh
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,6 @@ if [ -L /config/log ]; then
rm -f /config/log
fi

if [ -x "/bin/systemctl" ]; then
if [ -d /run/systemd/system ]; then
/bin/systemctl stop supervisor
fi
16 changes: 9 additions & 7 deletions build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,20 @@ BRANCH="${GIT_BRANCH:-${GITHUB_REF_NAME}}"
#
SIGNING_KEY=B93DD66EF98E54E2EAE025BA0166AD34ABC5A57C
PACKAGE_NAME="notifiarr-worker"
# Minimum PHP 8.5 release. Renovate bumps this from php/php-src tags.
PHP_VERSION=8.5.12
##

read -r -d '' DEPENDS <<- DEPENDS
--depends mysql-client-core-8.0
--depends nfs-client
--depends php8.3-cli
--depends php8.3-curl
--depends php8.3-mbstring
--depends php8.3-memcached
--depends php8.3-mysql
--depends php8.3-redis
--depends php8.3-xml
--depends 'php8.5-cli (>= ${PHP_VERSION})'
--depends 'php8.5-curl (>= ${PHP_VERSION})'
--depends 'php8.5-mbstring (>= ${PHP_VERSION})'
--depends php8.5-memcached
--depends 'php8.5-mysql (>= ${PHP_VERSION})'
--depends php8.5-redis
--depends 'php8.5-xml (>= ${PHP_VERSION})'
--depends software-properties-common
--depends sudo
--depends cron
Expand Down