CI: Added release stage (mosty copied from https://docs.gitlab.com/ee/user/project/releases/#cicd-example-of-the-release-keyword )

2025-12-06 10:53:55 +01:00 · 2022-02-21 08:35:14 +01:00
4 changed files with 135 additions and 222 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -1,149 +1,141 @@
---
-include:
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/ssh-config.yml'
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/build_image.yml'
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/python-pkg.yml'
-
-variables:
-  BUILD_CONTEXT: ci_container
-  BUILD_FILE: Dockerfile
-  IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/bullseye
-  TARGET_REPOSITORY: "bullseye"
-
-
 stages:
-  - build_image
-  - build_pkg
-  - debian-package
+    - build
+    - debian-package
+    - release

 .image-buster:
-  variables:
-    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/buster
-    BUILD_FILE: Dockerfile.buster
-    TARGET_REPOSITORY: "buster"
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-buster'

 .image-bullseye:
-  IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/bullseye
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-bullseye'

-.image-jammy:
-  variables:
-    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/jammy
-    BUILD_FILE: Dockerfile.jammy
+.image-focal:
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-focal'

-build_pkg_image_buster:
-  extends:
-    - .image-buster
-    - build_pkg_image
+.code-coverage:
+    stage: build
+    script:
+        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
+        - meson build -Db_coverage=true
+        - cd build
+        - ninja
+        - ninja test
+        - ninja coverage-xml
+        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
+            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
+        - ninja coverage-html
+        - mv meson-logs/coveragereport ../coverage
+    artifacts:
+        paths:
+            - coverage/
+        reports:
+            cobertura: build/meson-logs/coverage.xml

-pkg_buster:
-  extends:
-    - .image-buster
-    - python_pkg
+.build:
+    stage: build
+    script:
+        - which meson
+        - meson build
+        - cd build
+        - ninja
+        - ninja test
+    artifacts:
+        paths:
+            - build/src/libexim-encrypt-dlfunc.so
+            - build/src/libexim-encrypt-dlfunc-genkeys
+            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
+            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox

-build_pkg_image_jammy:
-  extends:
-    - .image-jammy
-    - build_pkg_image
+.debian-package:
+    stage: debian-package
+    script:
+        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
+        - eval $(gpg-agent --batch --sh --disable-scdaemon)
+        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
+        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
+        - gpg-connect-agent /bye
+        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
+        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
+        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
+        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
+    artifacts:
+        paths:
+            - ./*.deb
+            - ./*.dsc
+            - ./*.tar.gz
+            - ./*.changes
+            - ./*.buildinfo

-#.code-coverage:
-#    stage: build
-#    script:
-#        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
-#        - meson build -Db_coverage=true
-#        - cd build
-#        - ninja
-#        - ninja test
-#        - ninja coverage-xml
-#        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
-#            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
-#        - ninja coverage-html
-#        - mv meson-logs/coveragereport ../coverage
-#    artifacts:
-#        paths:
-#            - coverage/
-#        reports:
-#            cobertura: build/meson-logs/coverage.xml
-#
-#.build:
-#    stage: build
-#    script:
-#        - which meson
-#        - meson build
-#        - cd build
-#        - ninja
-#        - ninja test
-#    artifacts:
-#        paths:
-#            - build/src/libexim-encrypt-dlfunc.so
-#            - build/src/libexim-encrypt-dlfunc-genkeys
-#            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
-#            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox
-#
-#.debian-package:
-#    stage: debian-package
-#    script:
-#        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
-#        - eval $(gpg-agent --batch --sh --disable-scdaemon)
-#        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
-#        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
-#        - gpg-connect-agent /bye
-#        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
-#        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
-#        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
-#        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
-#    artifacts:
-#        paths:
-#            - ./*.deb
-#            - ./*.dsc
-#            - ./*.tar.gz
-#            - ./*.changes
-#            - ./*.buildinfo
-#
-#code-coverage:
-#    extends:
-#        - .image-bullseye
-#        - .code-coverage
-#    needs: [ ]
-#
-#build:bullseye:
-#    extends:
-#        - .image-bullseye
-#        - .build
-#        - .code-coverage
-#    needs: [ ]
-#
-#build:focal:
-#    extends:
-#        - .image-focal
-#        - .build
-#    needs: [ ]
-#
-#build:buster:
-#    extends:
-#        - .build
-#        - .image-buster
-#    needs: [ ]
-#
-#debian-package:bullseye:
-#    extends:
-#        - .image-bullseye
-#        - .debian-package
-#    dependencies:
-#        - build:bullseye
-#    needs: [ "build:bullseye" ]
-#
-#debian-package:focal:
-#    extends:
-#        - .image-focal
-#        - .debian-package
-#    dependencies:
-#        - build:focal
-#    needs: [ "build:focal" ]
-#
-#debian-package:buster:
-#    extends:
-#        - .image-buster
-#        - .debian-package
-#    dependencies:
-#        - build:buster
-#    needs: [ "build:buster" ]
+code-coverage:
+    extends:
+        - .image-bullseye
+        - .code-coverage
+    needs: [ ]
+
+build:bullseye:
+    extends:
+        - .image-bullseye
+        - .build
+        - .code-coverage
+    needs: [ ]
+
+build:focal:
+    extends:
+        - .image-focal
+        - .build
+    needs: [ ]
+
+build:buster:
+    extends:
+        - .build
+        - .image-buster
+    needs: [ ]
+
+debian-package:bullseye:
+    extends:
+        - .image-bullseye
+        - .debian-package
+    dependencies:
+        - build:bullseye
+    needs: [ "build:bullseye" ]
+
+debian-package:focal:
+    extends:
+        - .image-focal
+        - .debian-package
+    dependencies:
+        - build:focal
+    needs: [ "build:focal" ]
+
+debian-package:buster:
+    extends:
+        - .image-buster
+        - .debian-package
+    dependencies:
+        - build:buster
+    needs: [ "build:buster" ]
+
+prepare_job:
+  stage: prepare                                              # This stage must run before the release stage
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: never                                             # Do not run this job when a tag is created manually
+#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH             # Run this job when commits are pushed or merged to the default branch
+  script:
+    - echo "TAG=v$(cat VERSION)" >> variables.env             # and append to the variables.env file
+  artifacts:
+    reports:
+      dotenv: variables.env                                   # Use artifacts:reports:dotenv to expose the variables to other jobs
+
+release_job:
+  stage: release
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  rules:
+    - if: $CI_COMMIT_TAG                                      # Run this job when a tag is created manually
+  script:
+    - echo "running release_job"
+  release:
+    name: 'Release $CI_COMMIT_TAG'
+    description: 'Created using the release-cli'
+    tag_name: '$CI_COMMIT_TAG'
+    ref: '$CI_COMMIT_TAG'
--- a/ci_container/Dockerfile
+++ b/ci_container/Dockerfile
@ -18,17 +18,18 @@ RUN apt-get update; \
        openssl \
        pkg-config \
        python3-pip \
-        libxml2-utils \
+        libxml2-utils; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
        debhelper \
        debsigs \
        devscripts \
        dh-make \
        git-buildpackage \
        gpgv1 \
-        meson \
+        meson; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
        less \
        mc \
-        rsync \
        openssh-client \
        vim; \
    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
--- a/ci_container/Dockerfile.buster
+++ b/ci_container/Dockerfile.buster
@ -1,40 +0,0 @@
-FROM debian:latest
-
-LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
-      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
-      org.opencontainers.image.title="exim build container" \
-      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
-      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
-      org.opencontainers.image.licenses="Apache-2.0"
-
-RUN apt-get update; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
-        build-essential \
-        exim4-daemon-heavy \
-        exim4-dev \
-        gcovr \
-        git \
-        libsodium-dev \
-        openssl \
-        pkg-config \
-        python3-pip \
-        libxml2-utils \
-        debhelper \
-        debsigs \
-        devscripts \
-        dh-make \
-        git-buildpackage \
-        gpgv1 \
-        meson \
-        less \
-        mc \
-        rsync \
-        openssh-client \
-        vim; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN pip3 install --upgrade meson ninja; \
-    rm -rf ~/.cache/pip/*;
-
-WORKDIR /mnt/
--- a/ci_container/Dockerfile.jammy
+++ b/ci_container/Dockerfile.jammy
@ -1,40 +0,0 @@
-FROM docker.io/library/ubuntu:jammy
-
-LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
-      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
-      org.opencontainers.image.title="exim build container" \
-      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
-      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
-      org.opencontainers.image.licenses="Apache-2.0"
-
-
-RUN apt-get update; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
-        build-essential \
-        exim4-daemon-heavy \
-        exim4-dev \
-        gcovr \
-        git \
-        libsodium-dev \
-        openssl \
-        pkg-config \
-        python3-pip \
-        libxml2-utils \
-        debhelper \
-        debsigs \
-        devscripts \
-        dh-make \
-        git-buildpackage \
-        gpgv1 \
-        meson \
-        less \
-        mc \
-        openssh-client \
-        vim; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN pip3 install --upgrade meson ninja; \
-    rm -rf ~/.cache/pip/*;
-
-WORKDIR /mnt/