synology-wireguard/.github/workflows/build.yml

# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com) and contributors
# SPDX-FileContributor: Sebastian Thomschke, Vegard IT GmbH
# SPDX-License-Identifier: Apache-2.0
#
# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
name: Build

on:
  push:
    branches:    # build all branches
    - '**'
    tags-ignore: # but don't build tags
    - '**'
    paths-ignore:
    - '**/*.adoc'
    - '**/*.md'
    - '.editorconfig'
    - '.git*'
    - '**/*.rst'
    - '.github/*.yml'
  pull_request:
    paths-ignore:
    - '**/*.adoc'
    - '**/*.md'
    - '.editorconfig'
    - '.git*'
    - '**/*.rst'
    - '.github/*.yml'
  workflow_dispatch:
    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
    inputs:
      DSM_VERSION:
        description: 'DSM Version'
        required: true
        default: '7.1'

defaults:
  run:
    shell: bash

env:
  DSM_VERSION: '7.1'

jobs:

  ###########################################################
  build:
  ###########################################################
    strategy:
      fail-fast: false
      matrix:
        # see https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have
        PACKAGE_ARCH:
        - apollolake # e.g. DS918+
        - broadwellnk
        - denverton # e.g. RS2418+
        - geminilake
        - r1000
        - v1000

    runs-on: ubuntu-latest

    steps:
    - name: Git checkout
      uses: actions/checkout@v3 #https://github.com/actions/checkout

    - name: Set effective DSM version
      run: |
        set -eux

        if [[ -n "${{ github.event.inputs.DSM_VERSION }}" ]]; then
          echo "DSM_VERSION=${{ github.event.inputs.DSM_VERSION }}" >> $GITHUB_ENV
        fi        

    - name: Build synobuild Docker image
      run: |
        set -eux

        docker build -t synobuild .        

    - uses: actions/cache@v3
      if: github.ref_name == 'master'
      with:
        path: toolkit_tarballs/ds.*
        key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_${{ matrix.PACKAGE_ARCH }}

    - uses: actions/cache@v3
      with:
        path: toolkit_tarballs/base_env-*
        key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_base_env

    - name: Download Synology Toolkit tarballs
      run: |
        set -eux

        mkdir -p toolkit_tarballs
        pushd toolkit_tarballs/

        archive_base_url="https://global.download.synology.com/download/ToolChain/toolkit/$DSM_VERSION"

        archive=base_env-${DSM_VERSION}.txz
        [[ -f $archive ]] || curl -sSf "$archive_base_url/base/$archive" -o $archive

        archive=ds.${{ matrix.PACKAGE_ARCH }}-$DSM_VERSION.dev.txz
        [[ -f $archive ]] || curl -sSf "$archive_base_url/${{ matrix.PACKAGE_ARCH }}/$archive" -o $archive

        archive=ds.${{ matrix.PACKAGE_ARCH }}-$DSM_VERSION.env.txz
        [[ -f $archive ]] || curl -sSf "$archive_base_url/${{ matrix.PACKAGE_ARCH }}/$archive" -o $archive
        popd        

    - name: Build SPK files
      continue-on-error: true
      run: |
        set -eux

        mkdir artifacts
        docker run --rm --privileged \
          --env PACKAGE_ARCH=${{ matrix.PACKAGE_ARCH }} \
          --env DSM_VER=${DSM_VERSION} \
          -v $(pwd)/artifacts:/result_spk \
          -v $(pwd)/toolkit_tarballs:/toolkit_tarballs \
          synobuild
        ls -l artifacts
        ls -l artifacts/*

        for spk in artifacts/*/*.spk; do
            sudo mv "$spk" "${spk%.spk}_DSM${DSM_VERSION}.spk"
        done        

    - name: Upload SPKs
      if: github.ref == 'refs/heads/master'
      uses: actions/upload-artifact@v3
      with:
        name: artifacts-${{ matrix.PACKAGE_ARCH }}
        path: artifacts/**


  ###########################################################
  publish-release:
  ###########################################################
    runs-on: ubuntu-latest
    needs: 
      - build
    if: github.ref == 'refs/heads/master'
    concurrency: publish-latest-release # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency

    steps:
    - name: Git checkout 
      # only required by "hub release create" to prevent "fatal: Not a git repository"
      uses: actions/checkout@v3 #https://github.com/actions/checkout

    - name: Download build artifacts
      uses: actions/download-artifact@v3

    - name: Set effective DSM version
      run: |
        set -eux

        if [[ -n "${{ github.event.inputs.DSM_VERSION }}" ]]; then
          echo "DSM_VERSION=${{ github.event.inputs.DSM_VERSION }}" >> $GITHUB_ENV
        fi        

    - name: Set effective WireGuard version
      run: |
        set -eux

        spks=($(ls artifacts-*/WireGuard-*/*.spk))
        [[ ${spks[0]} =~ ([0-9.]+) ]] && echo "${BASH_REMATCH[1]}"
        echo "WG_VERSION=${BASH_REMATCH[1]}" >> $GITHUB_ENV        

    - name: "Delete previous release"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        set -eux

        api_base_url="$GITHUB_API_URL/repos/$GITHUB_REPOSITORY"

        release_name=WireGuard-${WG_VERSION}-DSM${DSM_VERSION}

        # https://hub.github.com/hub-release.1.html
        hub release delete "${release_name}" || true

        # delete git tag
        tag_url="$api_base_url/git/refs/tags/${release_name}"
        if curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -fsLo /dev/null --head "$tag_url"; then
           echo "Deleting tag [$tag_url]..."
           curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -fsSL -X DELETE "$tag_url"
        fi        

    - name: "Create release"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        set -eux

        release_name=WireGuard-${WG_VERSION}-DSM${DSM_VERSION}

        spks=($(ls artifacts-*/WireGuard-*/*.spk))

        # https://hub.github.com/hub-release.1.html
        hub release create "${release_name}" \
          --message "${release_name}" \
          --message "**Use at your own risk. We are not responsible if this breaks your NAS. Realistically it should not result in data loss, but it could render your NAS inaccessible if something goes wrong.**" \
          --message "" \
          --message "**Especially if you are not comfortable with removing the hard drives from your NAS and manually recovering the data, this is not for you.**" \
          --message "" \
          --message "See https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have to find the right architecture of your NAS" \
          ${spks[@]/#/--attach }        

    - name: "Delete intermediate build artifacts"
      uses: geekyeggo/delete-artifact@v2 # https://github.com/GeekyEggo/delete-artifact/
      with:
        name: "*"
        failOnError: false