From b7af0fa8036a7f8653060476e62791479e7b2e20 Mon Sep 17 00:00:00 2001 From: Uladzislau Muraveika Date: Mon, 29 Jun 2026 12:17:45 +0300 Subject: [PATCH 1/4] refactor(github_ci): remove test build, remove everything connected with darwin, it is not supported by github ci now, add ubuntu arm runner, fix zizmore autofixable issues --- .github/workflows/ci-release.yml | 165 +++++++++++++++++ .github/workflows/hmybuild.yml | 299 ------------------------------- .github/workflows/test-build.yml | 107 ----------- 3 files changed, 165 insertions(+), 406 deletions(-) create mode 100644 .github/workflows/ci-release.yml delete mode 100644 .github/workflows/hmybuild.yml delete mode 100644 .github/workflows/test-build.yml diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml new file mode 100644 index 0000000..69f7e96 --- /dev/null +++ b/.github/workflows/ci-release.yml @@ -0,0 +1,165 @@ +name: release hmy + +on: + push: + tags: + - 'v*' + +env: + GOPATH: ${{ github.workspace }} + GOBIN: ${{ github.workspace }}/bin + +permissions: {} +jobs: + build: + name: Build hmy binary + runs-on: ${{ matrix.os }} + permissions: + contents: read + strategy: + matrix: + os: [ ubuntu-24.04, ubuntu-24.04-arm ] + + steps: + - name: Checkout hmy code + uses: actions/checkout@v4 + with: + path: go-sdk + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go-sdk/go.mod + cache: false + + - name: Checkout dependence repo + uses: actions/checkout@v4 + with: + repository: harmony-one/mcl + path: ${{ github.workspace }}/src/github.com/harmony-one/mcl + ref: master + fetch-depth: 0 + persist-credentials: false + + - name: Checkout dependence repo + uses: actions/checkout@v4 + with: + repository: harmony-one/bls + path: ${{ github.workspace }}/src/github.com/harmony-one/bls + ref: master + fetch-depth: 0 + persist-credentials: false + + - name: Checkout dependence code + uses: actions/checkout@v4 + with: + repository: harmony-one/harmony + path: ${{ github.workspace }}/src/github.com/harmony-one/harmony + ref: main + fetch-depth: 0 + persist-credentials: false + + - name: Get latest version and release + run: | + VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) + RELEASE=$(git describe --long | cut -f2 -d-) + echo "build_version=$VERSION" >> $GITHUB_ENV + echo "build_release=$RELEASE" >> $GITHUB_ENV + working-directory: go-sdk + + - name: Build hmy binary for Linux + run: | + make static + working-directory: go-sdk + + - name: Upload artifact + uses: actions/upload-artifact@v4 + with: + name: hmy + path: ${{ github.workspace }}/go-sdk/dist/* + retention-days: 1 + release-page: + name: Sign binary and create and publish release page + needs: [ build-x86_64 ] + runs-on: ubuntu-22.04 + steps: + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@v6 + with: + gpg_private_key: ${{ secrets.HMY_GPG_PRIVATE_KEY }} + passphrase: ${{ secrets.HMY_GPG_PRIVATE_KEY_PASS }} + + - name: Checkout hmy core code + uses: actions/checkout@v4 + with: + path: go-sdk + persist-credentials: false + + - name: Get latest version + run: | + VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) + VERSION_LONG=$(git describe --always --long --dirty) + RELEASE=$(git describe --long | cut -f2 -d-) + echo "build_version=$VERSION" >> $GITHUB_ENV + echo "build_version_long=$VERSION_LONG" >> $GITHUB_ENV + echo "build_release=$RELEASE" >> $GITHUB_ENV + working-directory: go-sdk + + - name: Download artifact + uses: actions/download-artifact@v4 + with: + name: hmy + + - name: Download artifact + uses: actions/download-artifact@v4 + with: + name: hmy-darwin-x86_64 + + - name: Display structure of downloaded files + run: ls -R + + - name: Signed darwin x86_64 hmy binary + run: | + gpg --detach-sign hmy-darwin-x86_64 + sha256sum hmy-darwin-x86_64 >> hmy-darwin-x86_64.sha256 + + - name: Get tag message + env: + TAG_SHA: ${{ github.event.after }} + run: | + touch ./tag_message.md + echo -e "$TAG_SHA\n\nThe released version: $build_version_long" >> ./tag_message.md + working-directory: go-sdk + + - name: Create Release + id: create_release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: ${{ github.ref }} + release_name: Mainnet Release ${{ env.build_version }} + draft: true + prerelease: false + body_path: ${{ github.workspace }}/go-sdk/tag_message.md + + - name: Upload hmy binary for Linux (x86_64) + uses: actions/upload-release-asset@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + upload_url: ${{ steps.create_release.outputs.upload_url }} + asset_path: ./hmy + asset_name: hmy + asset_content_type: application/octet-stream + + - name: Upload hmy binary darwin-x86_64 + uses: actions/upload-release-asset@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + upload_url: ${{ steps.create_release.outputs.upload_url }} + asset_path: ./hmy-darwin-x86_64 + asset_name: hmy-darwin-x86_64 + asset_content_type: application/octet-stream diff --git a/.github/workflows/hmybuild.yml b/.github/workflows/hmybuild.yml deleted file mode 100644 index 18adcea..0000000 --- a/.github/workflows/hmybuild.yml +++ /dev/null @@ -1,299 +0,0 @@ -name: release hmy - -on: - push: - tags: - - v* - -env: - GOPATH: ${{ github.workspace }} - GOBIN: ${{ github.workspace }}/bin - -jobs: - build-x86_64: - name: Build hmy binary for x86_64 - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ ubuntu-22.04, macos-latest ] - - steps: - - name: Checkout hmy code - uses: actions/checkout@v4 - with: - path: go-sdk - - - name: Set up Go - uses: actions/setup-go@v5 - with: - go-version-file: go-sdk/go.mod - - - name: Checkout dependence repo - uses: actions/checkout@v4 - with: - repository: harmony-one/mcl - path: ${{ github.workspace }}/src/github.com/harmony-one/mcl - ref: master - fetch-depth: 0 - - - name: Checkout dependence repo - uses: actions/checkout@v4 - with: - repository: harmony-one/bls - path: ${{ github.workspace }}/src/github.com/harmony-one/bls - ref: master - fetch-depth: 0 - - - name: Checkout dependence code - uses: actions/checkout@v4 - with: - repository: harmony-one/harmony - path: ${{ github.workspace }}/src/github.com/harmony-one/harmony - ref: main - fetch-depth: 0 - - - name: Get latest version and release - run: | - VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) - RELEASE=$(git describe --long | cut -f2 -d-) - echo "build_version=$VERSION" >> $GITHUB_ENV - echo "build_release=$RELEASE" >> $GITHUB_ENV - working-directory: go-sdk - - - name: Debug - run: | - pwd - echo ${HOME} - echo ${GITHUB_WORKSPACE} - echo ${GOPATH} - echo ${GOROOT} - - - name: Build hmy binary for Linux - if: matrix.os == 'ubuntu-22.04' - run: | - make static - working-directory: go-sdk - - - name: Build libs for macos-latest - if: matrix.os == 'macos-latest' - run: | - brew install gmp - brew install openssl - sudo mkdir -p /opt/homebrew/opt/ - sudo ln -sf /usr/local/opt/openssl@1.1 /opt/homebrew/opt/openssl@1.1 - echo "ls -l /opt/homebrew/opt/openssl@1.1"; ls -l /opt/homebrew/opt/openssl@1.1 - make libs - working-directory: ${{ github.workspace }}/src/github.com/harmony-one/harmony - - - name: Build hmy binary for macos-latest x86_64 - if: matrix.os == 'macos-latest' - run: | - make all - mv dist/hmy dist/hmy-darwin-x86_64 - working-directory: go-sdk - - - name: Upload artifact - if: matrix.os != 'macos-latest' - uses: actions/upload-artifact@v4 - with: - name: hmy - path: ${{ github.workspace }}/go-sdk/dist/* - retention-days: 1 - - - name: Upload artifact darwin - if: matrix.os == 'macos-latest' - uses: actions/upload-artifact@v4 - with: - name: hmy-darwin-x86_64 - path: ${{ github.workspace }}/go-sdk/dist/hmy-darwin-x86_64 - retention-days: 1 - - # build-arm64: - # name: Build hmy binary - # runs-on: ${{ matrix.os }} - # strategy: - # matrix: - # os: [ [ self-hosted,linux,ARM64 ] ] - - # steps: - - # - name: Set up Go 1.16.5 - # uses: actions/setup-go@v2 - # with: - # go-version: 1.16.5 - - - # - name: Checkout hmy code - # uses: actions/checkout@v2 - # with: - # path: go/src/github.com/harmony-one/go-sdk - - # - name: Debug - # run: | - # pwd - # echo ${HOME} - # echo ${GITHUB_WORKSPACE} - # echo ${GOPATH} - # echo ${GOROOT} - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - # - name: Checkout dependence repo - # uses: actions/checkout@v2 - # with: - # repository: harmony-one/mcl - # path: go/src/github.com/harmony-one/mcl - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - # - name: Checkout dependence repo - # uses: actions/checkout@v2 - # with: - # repository: harmony-one/bls - # path: go/src/github.com/harmony-one/bls - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - # - name: Checkout dependence code - # uses: actions/checkout@v2 - # with: - # repository: harmony-one/harmony - # path: go/src/github.com/harmony-one/harmony - # ref: main - # fetch-depth: 0 - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - # - name: Build hmy binary for Arm - # run: | - # make static - # mv dist/hmy dist/hmy-arm64 - # chmod +x dist/hmy-arm64 - # working-directory: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go/src/github.com/harmony-one/go-sdk - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - # - name: Upload artifact - # uses: actions/upload-artifact@v4 - # with: - # name: hmy-arm64 - # path: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go/src/github.com/harmony-one/go-sdk/dist/* - # retention-days: 1 - # env: - # GOPATH: /home/ubuntu/actions-runner/_work/go-sdk/go-sdk/go - - release-page: - name: Sign binary and create and publish release page - needs: [ build-x86_64 ] - runs-on: ubuntu-22.04 - steps: - - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v6 - with: - gpg_private_key: ${{ secrets.HMY_GPG_PRIVATE_KEY }} - passphrase: ${{ secrets.HMY_GPG_PRIVATE_KEY_PASS }} - - - name: Checkout hmy core code - uses: actions/checkout@v4 - with: - path: go-sdk - - - name: Get latest version - run: | - VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) - VERSION_LONG=$(git describe --always --long --dirty) - RELEASE=$(git describe --long | cut -f2 -d-) - echo "build_version=$VERSION" >> $GITHUB_ENV - echo "build_version_long=$VERSION_LONG" >> $GITHUB_ENV - echo "build_release=$RELEASE" >> $GITHUB_ENV - working-directory: go-sdk - - - name: Download artifact - uses: actions/download-artifact@v4 - with: - name: hmy - - - name: Download artifact - uses: actions/download-artifact@v4 - with: - name: hmy-darwin-x86_64 - - - name: Display structure of downloaded files - run: ls -R - - - name: Signed darwin x86_64 hmy binary - run: | - gpg --detach-sign hmy-darwin-x86_64 - sha256sum hmy-darwin-x86_64 >> hmy-darwin-x86_64.sha256 - - - name: Get tag message - env: - TAG_SHA: ${{ github.event.after }} - run: | - touch ./tag_message.md - echo -e "$TAG_SHA\n\nThe released version: $build_version_long" >> ./tag_message.md - working-directory: go-sdk - - - name: Create Release - id: create_release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: ${{ github.ref }} - release_name: Mainnet Release ${{ env.build_version }} - draft: true - prerelease: false - body_path: ${{ github.workspace }}/go-sdk/tag_message.md - - - name: Upload hmy binary for Linux (x86_64) - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./hmy - asset_name: hmy - asset_content_type: application/octet-stream - - - name: Upload hmy binary darwin-x86_64 - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./hmy-darwin-x86_64 - asset_name: hmy-darwin-x86_64 - asset_content_type: application/octet-stream - - - # - name: Upload hmy binary for ARM64 - # uses: actions/upload-release-asset@v1 - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # GOPATH: /home/runner/work/go-sdk/go-sdk/go - # with: - # upload_url: ${{ steps.create_release.outputs.upload_url }} - # asset_path: ./hmy-arm64 - # asset_name: hmy-arm64 - # asset_content_type: application/octet-stream - - # - name: Upload sha256 signature of hmy arm64 binary - # uses: actions/upload-release-asset@v1 - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # with: - # upload_url: ${{ steps.create_release.outputs.upload_url }} - # asset_path: ./hmy-arm64.sha256 - # asset_name: hmy-arm64.sha256 - # asset_content_type: text/plain - - # - name: Upload gpg signature of hmy arm64 binary - # uses: actions/upload-release-asset@v1 - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # with: - # upload_url: ${{ steps.create_release.outputs.upload_url }} - # asset_path: ./hmy-arm64.sig - # asset_name: hmy-arm64.sig - # asset_content_type: application/octet-stream diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml deleted file mode 100644 index 04e548d..0000000 --- a/.github/workflows/test-build.yml +++ /dev/null @@ -1,107 +0,0 @@ -name: test build - -on: - push: - -env: - GOPATH: ${{ github.workspace }} - GOBIN: ${{ github.workspace }}/bin - -jobs: - build-x86_64: - name: Build hmy binary for x86_64 - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ ubuntu-22.04, macos-latest ] - - steps: - - name: Checkout hmy code - uses: actions/checkout@v4 - with: - path: go-sdk - - - name: Set up Go - uses: actions/setup-go@v4 - with: - go-version-file: go-sdk/go.mod - - - name: Checkout dependence repo - uses: actions/checkout@v4 - with: - repository: harmony-one/mcl - path: ${{ github.workspace }}/src/github.com/harmony-one/mcl - ref: master - fetch-depth: 0 - - - name: Checkout dependence repo - uses: actions/checkout@v4 - with: - repository: harmony-one/bls - path: ${{ github.workspace }}/src/github.com/harmony-one/bls - ref: master - fetch-depth: 0 - - - name: Checkout dependence code - uses: actions/checkout@v4 - with: - repository: harmony-one/harmony - path: ${{ github.workspace }}/src/github.com/harmony-one/harmony - ref: main - fetch-depth: 0 - - - name: Get latest version and release - run: | - VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) - RELEASE=$(git describe --long | cut -f2 -d-) - echo "build_version=$VERSION" >> $GITHUB_ENV - echo "build_release=$RELEASE" >> $GITHUB_ENV - working-directory: go-sdk - - - name: Debug - run: | - pwd - echo ${HOME} - echo ${GITHUB_WORKSPACE} - echo ${GOPATH} - echo ${GOROOT} - ls ${{ github.workspace }}/src/github.com/harmony-one/ - - - name: Build hmy binary for linux ubuntu - if: matrix.os == 'ubuntu-22.04' - run: | - make static - working-directory: go-sdk - - - name: Build libs for macos-latest - if: matrix.os == 'macos-latest' - run: | - brew install gmp - brew install openssl - sudo mkdir -p /opt/homebrew/opt/ - sudo ln -sf /usr/local/opt/openssl@1.1 /opt/homebrew/opt/openssl@1.1 - echo "ls -l /opt/homebrew/opt/openssl@1.1"; ls -l /opt/homebrew/opt/openssl@1.1 - make libs - working-directory: ${{ github.workspace }}/src/github.com/harmony-one/harmony - - - name: Build hmy binary for macos-latest x86_64 - if: matrix.os == 'macos-latest' - run: | - make all - working-directory: go-sdk - - - name: Upload artifact for linux - uses: actions/upload-artifact@v4 - if: matrix.os == 'ubuntu-22.04' - with: - name: hmy-linux - path: ${{ github.workspace }}/go-sdk/dist/* - retention-days: 1 - - - name: Upload artifact for darwin - uses: actions/upload-artifact@v4 - if: matrix.os == 'macos-latest' - with: - name: hmy-darwin - path: ${{ github.workspace }}/go-sdk/dist/* - retention-days: 1 From 1f3ff65f88eb4b0fb76bb01390a47a335ed8fcdf Mon Sep 17 00:00:00 2001 From: Uladzislau Muraveika Date: Mon, 29 Jun 2026 12:27:57 +0300 Subject: [PATCH 2/4] refactor(github_ci): pin used actions by hash --- .github/workflows/ci-release.yml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml index 69f7e96..d9da42a 100644 --- a/.github/workflows/ci-release.yml +++ b/.github/workflows/ci-release.yml @@ -22,19 +22,19 @@ jobs: steps: - name: Checkout hmy code - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: path: go-sdk persist-credentials: false - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 #v6.5.0 with: go-version-file: go-sdk/go.mod cache: false - name: Checkout dependence repo - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/mcl path: ${{ github.workspace }}/src/github.com/harmony-one/mcl @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Checkout dependence repo - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/bls path: ${{ github.workspace }}/src/github.com/harmony-one/bls @@ -52,7 +52,7 @@ jobs: persist-credentials: false - name: Checkout dependence code - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/harmony path: ${{ github.workspace }}/src/github.com/harmony-one/harmony @@ -74,14 +74,14 @@ jobs: working-directory: go-sdk - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 with: name: hmy path: ${{ github.workspace }}/go-sdk/dist/* retention-days: 1 release-page: name: Sign binary and create and publish release page - needs: [ build-x86_64 ] + needs: build runs-on: ubuntu-22.04 steps: - name: Import GPG key @@ -91,7 +91,7 @@ jobs: passphrase: ${{ secrets.HMY_GPG_PRIVATE_KEY_PASS }} - name: Checkout hmy core code - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: path: go-sdk persist-credentials: false @@ -107,12 +107,12 @@ jobs: working-directory: go-sdk - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 with: name: hmy - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 with: name: hmy-darwin-x86_64 From 37b7235efd72c9e6b32b42e0308707369c594df6 Mon Sep 17 00:00:00 2001 From: Uladzislau Muraveika Date: Mon, 29 Jun 2026 13:12:20 +0300 Subject: [PATCH 3/4] refactor(github_ci): sync the workflow with main repo workflow, use sparse checkout to get exactly one file --- .github/workflows/ci-release.yml | 370 ++++++++++++++++++++++++------- 1 file changed, 286 insertions(+), 84 deletions(-) diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml index d9da42a..3f779cb 100644 --- a/.github/workflows/ci-release.yml +++ b/.github/workflows/ci-release.yml @@ -5,26 +5,103 @@ on: tags: - 'v*' + workflow_dispatch: + inputs: + tag: + description: 'Tag value to create the release, for example v2026.1.0' + required: true + type: string + +permissions: {} + env: GOPATH: ${{ github.workspace }} GOBIN: ${{ github.workspace }}/bin -permissions: {} +defaults: + run: + shell: bash + jobs: + check: + name: Check release tag + runs-on: ubuntu-24.04 + timeout-minutes: 10 + permissions: + contents: read + outputs: + tag: ${{ steps.resolve-tag.outputs.tag }} + + steps: + - name: Resolve release tag + id: resolve-tag + env: + INPUT_TAG: ${{ github.event.inputs.tag || '' }} + run: | + set -euo pipefail + + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then + TAG="${INPUT_TAG}" + else + TAG="${GITHUB_REF_NAME}" + fi + + if [[ ! "${TAG}" =~ ^v[0-9]{4}\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then + echo "::error::invalid release tag: ${TAG}" + echo "::error::expected format: v2026.0.0" + exit 1 + fi + + git check-ref-format "refs/tags/${TAG}" + + echo "tag=${TAG}" >> "$GITHUB_OUTPUT" + + - name: Checkout hmy code + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 + with: + path: go-sdk + ref: refs/tags/${{ steps.resolve-tag.outputs.tag }} + fetch-depth: 1 + persist-credentials: false + + - name: Check tag is annotated + env: + RELEASE_TAG: ${{ steps.resolve-tag.outputs.tag }} + run: | + set -euo pipefail + + git fetch --force --depth=1 origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}" + + if ! git rev-parse -q --verify "${RELEASE_TAG}^{tag}" >/dev/null; then + echo "::error::release tag '${RELEASE_TAG}' is not annotated" + exit 1 + fi + working-directory: go-sdk + build: - name: Build hmy binary + name: Build hmy binary (${{ matrix.arch }}) + needs: check runs-on: ${{ matrix.os }} + timeout-minutes: 60 permissions: contents: read + strategy: + fail-fast: false matrix: - os: [ ubuntu-24.04, ubuntu-24.04-arm ] + include: + - os: ubuntu-24.04 + arch: amd64 + - os: ubuntu-24.04-arm + arch: arm64 steps: - name: Checkout hmy code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: path: go-sdk + ref: refs/tags/${{ needs.check.outputs.tag }} + fetch-depth: 1 persist-credentials: false - name: Set up Go @@ -33,133 +110,258 @@ jobs: go-version-file: go-sdk/go.mod cache: false - - name: Checkout dependence repo + - name: Checkout mcl uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/mcl - path: ${{ github.workspace }}/src/github.com/harmony-one/mcl + path: src/github.com/harmony-one/mcl ref: master - fetch-depth: 0 + fetch-depth: 1 persist-credentials: false - - name: Checkout dependence repo + - name: Checkout bls uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/bls - path: ${{ github.workspace }}/src/github.com/harmony-one/bls + path: src/github.com/harmony-one/bls ref: master - fetch-depth: 0 + fetch-depth: 1 persist-credentials: false - - name: Checkout dependence code + - name: Checkout harmony BLS build flags helper uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: repository: harmony-one/harmony - path: ${{ github.workspace }}/src/github.com/harmony-one/harmony + path: src/github.com/harmony-one/harmony ref: main - fetch-depth: 0 + fetch-depth: 1 persist-credentials: false - - - name: Get latest version and release - run: | - VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) - RELEASE=$(git describe --long | cut -f2 -d-) - echo "build_version=$VERSION" >> $GITHUB_ENV - echo "build_release=$RELEASE" >> $GITHUB_ENV - working-directory: go-sdk + sparse-checkout: | + scripts/setup_bls_build_flags.sh + sparse-checkout-cone-mode: false - name: Build hmy binary for Linux + id: build-hmy run: | + set -euo pipefail + make static + + ARCH="$(dpkg --print-architecture)" + BINARY_NAME="hmy-${ARCH}" + + mkdir -p release + + if [[ -f dist/hmy ]]; then + cp dist/hmy "release/${BINARY_NAME}" + elif [[ -f hmy ]]; then + cp hmy "release/${BINARY_NAME}" + elif [[ -f bin/hmy ]]; then + cp bin/hmy "release/${BINARY_NAME}" + else + echo "::error::could not find built hmy binary" + find . -maxdepth 3 -type f -name 'hmy*' -print + exit 1 + fi + + chmod +x "release/${BINARY_NAME}" + test -x "release/${BINARY_NAME}" + + echo "binary_name=${BINARY_NAME}" >> "$GITHUB_OUTPUT" working-directory: go-sdk - - name: Upload artifact + - name: Upload hmy binary artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 with: - name: hmy - path: ${{ github.workspace }}/go-sdk/dist/* + name: ${{ steps.build-hmy.outputs.binary_name }} + path: go-sdk/release/${{ steps.build-hmy.outputs.binary_name }} retention-days: 1 + if-no-files-found: error + archive: false + release-page: - name: Sign binary and create and publish release page - needs: build - runs-on: ubuntu-22.04 - steps: - - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v6 - with: - gpg_private_key: ${{ secrets.HMY_GPG_PRIVATE_KEY }} - passphrase: ${{ secrets.HMY_GPG_PRIVATE_KEY_PASS }} + name: Sign binaries and create draft release + needs: [check, build] + runs-on: ubuntu-24.04 + timeout-minutes: 30 + permissions: + contents: write - - name: Checkout hmy core code + steps: + - name: Checkout hmy code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 with: path: go-sdk + ref: refs/tags/${{ needs.check.outputs.tag }} + fetch-depth: 1 persist-credentials: false - - name: Get latest version + - name: Get release metadata + env: + RELEASE_TAG: ${{ needs.check.outputs.tag }} run: | - VERSION=$(git tag -l --sort=-v:refname | head -n 1 | tr -d v) - VERSION_LONG=$(git describe --always --long --dirty) - RELEASE=$(git describe --long | cut -f2 -d-) - echo "build_version=$VERSION" >> $GITHUB_ENV - echo "build_version_long=$VERSION_LONG" >> $GITHUB_ENV - echo "build_release=$RELEASE" >> $GITHUB_ENV + set -euo pipefail + + git fetch --force --depth=1 origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}" + + VERSION="${RELEASE_TAG#v}" + COMMIT_SHA="$(git rev-parse --short=12 HEAD)" + VERSION_LONG="${RELEASE_TAG}-${COMMIT_SHA}" + + echo "build_version=${VERSION}" >> "$GITHUB_ENV" + echo "build_version_long=${VERSION_LONG}" >> "$GITHUB_ENV" working-directory: go-sdk - - name: Download artifact + - name: Download hmy binary artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 with: - name: hmy + pattern: hmy-* + path: release-assets + merge-multiple: true - - name: Download artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 - with: - name: hmy-darwin-x86_64 + - name: Verify downloaded artifacts + run: | + set -euo pipefail - - name: Display structure of downloaded files - run: ls -R + test -s release-assets/hmy-amd64 + test -s release-assets/hmy-arm64 - - name: Signed darwin x86_64 hmy binary - run: | - gpg --detach-sign hmy-darwin-x86_64 - sha256sum hmy-darwin-x86_64 >> hmy-darwin-x86_64.sha256 + ls -lah release-assets - - name: Get tag message + - name: Import GPG private key and export public key + id: gpg-key env: - TAG_SHA: ${{ github.event.after }} + GPG_PRIVATE_KEY: ${{ secrets.HMY_GPG_PRIVATE_KEY }} run: | - touch ./tag_message.md - echo -e "$TAG_SHA\n\nThe released version: $build_version_long" >> ./tag_message.md - working-directory: go-sdk + set -euo pipefail + + if [[ -z "${GPG_PRIVATE_KEY}" ]]; then + echo "::error::HMY_GPG_PRIVATE_KEY secret is empty or unavailable" + exit 1 + fi - - name: Create Release - id: create_release - uses: actions/create-release@v1 + install -m 700 -d ~/.gnupg + mkdir -p release-assets + + printf '%s' "${GPG_PRIVATE_KEY}" | gpg --batch --import + + KEY_FINGERPRINT="$( + gpg --batch --with-colons --list-secret-keys \ + | awk -F: '/^fpr:/ { print $10; exit }' + )" + + if [[ -z "${KEY_FINGERPRINT}" ]]; then + echo "::error::GPG private key was not imported" + exit 1 + fi + + gpg --batch --armor --export "${KEY_FINGERPRINT}" \ + > release-assets/HMY_RELEASE_SIGNING_KEY.asc + + test -s release-assets/HMY_RELEASE_SIGNING_KEY.asc + + echo "fingerprint=${KEY_FINGERPRINT}" >> "$GITHUB_OUTPUT" + echo "[INFO] GPG public key exported" + echo "[INFO] GPG signing key fingerprint: ${KEY_FINGERPRINT}" + + - name: Sign binaries and generate checksums env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: ${{ github.ref }} - release_name: Mainnet Release ${{ env.build_version }} - draft: true - prerelease: false - body_path: ${{ github.workspace }}/go-sdk/tag_message.md - - - name: Upload hmy binary for Linux (x86_64) - uses: actions/upload-release-asset@v1 + GPG_PRIVATE_KEY_PASS: ${{ secrets.HMY_GPG_PRIVATE_KEY_PASS }} + GPG_KEY_FINGERPRINT: ${{ steps.gpg-key.outputs.fingerprint }} + run: | + set -euo pipefail + + if [[ -z "${GPG_PRIVATE_KEY_PASS}" ]]; then + echo "::error::HMY_GPG_PRIVATE_KEY_PASS secret is empty or unavailable" + exit 1 + fi + + cd release-assets + + for binary in hmy-amd64 hmy-arm64; do + gpg --batch --yes --pinentry-mode loopback \ + --local-user "${GPG_KEY_FINGERPRINT}" \ + --passphrase-fd 3 \ + --output "${binary}.sig" \ + --detach-sign "${binary}" 3<<<"${GPG_PRIVATE_KEY_PASS}" + + sha256sum "${binary}" > "${binary}.sha256" + done + + - name: Add legacy hmy asset name + run: | + set -euo pipefail + + cp release-assets/hmy-amd64 release-assets/hmy + + - name: Generate release notes from tag message env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./hmy - asset_name: hmy - asset_content_type: application/octet-stream + RELEASE_TAG: ${{ needs.check.outputs.tag }} + GPG_KEY_FINGERPRINT: ${{ steps.gpg-key.outputs.fingerprint }} + run: | + set -euo pipefail + + TAG_MESSAGE="$( + git for-each-ref "refs/tags/${RELEASE_TAG}" \ + --format='%(contents:subject)%0a%0a%(contents:body)' + )" + + if [[ -z "${TAG_MESSAGE}" ]]; then + echo "::error::could not read annotated tag message for ${RELEASE_TAG}" + exit 1 + fi - - name: Upload hmy binary darwin-x86_64 - uses: actions/upload-release-asset@v1 + { + echo "${TAG_MESSAGE}" + echo + echo "The released version: ${build_version_long}" + echo + echo "## Verify release binaries" + echo + echo "GPG signing key fingerprint:" + echo + echo '```text' + echo "${GPG_KEY_FINGERPRINT}" + echo '```' + echo + echo '```bash' + echo "gpg --import HMY_RELEASE_SIGNING_KEY.asc" + echo + echo "gpg --verify hmy-amd64.sig hmy-amd64" + echo "gpg --verify hmy-arm64.sig hmy-arm64" + echo + echo "sha256sum -c hmy-amd64.sha256" + echo "sha256sum -c hmy-arm64.sha256" + echo '```' + } > tag_message.md + working-directory: go-sdk + + - name: Recreate draft release and upload assets env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./hmy-darwin-x86_64 - asset_name: hmy-darwin-x86_64 - asset_content_type: application/octet-stream + GH_TOKEN: ${{ github.token }} + RELEASE_TAG: ${{ needs.check.outputs.tag }} + run: | + set -euo pipefail + + if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then + echo "[INFO] Release ${RELEASE_TAG} already exists, deleting it" + + gh release delete "${RELEASE_TAG}" \ + --repo "${GITHUB_REPOSITORY}" \ + --yes + fi + + gh release create "${RELEASE_TAG}" release-assets/* \ + --repo "${GITHUB_REPOSITORY}" \ + --draft \ + --verify-tag \ + --title "Mainnet Release ${build_version}" \ + --notes-file ./go-sdk/tag_message.md + + - name: Cleanup GPG key + if: always() + run: | + set -euo pipefail + + gpgconf --kill all || true + rm -rf ~/.gnupg From 0aa3e63099da0a252b2cd3f9f6f71f0b79dd0f64 Mon Sep 17 00:00:00 2001 From: Uladzislau Muraveika Date: Mon, 29 Jun 2026 17:12:48 +0300 Subject: [PATCH 4/4] feat(github_ci): add zizmore security scan for the repo --- .github/workflows/zizmor.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..de02f06 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,34 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - master + paths: + - '.github/workflows/**/*.yml' + - '.github/workflows/**/*.yaml' + + pull_request: + branches: ["**"] + paths: + - '.github/workflows/**/*.yml' + - '.github/workflows/**/*.yaml' + +permissions: {} + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 + with: + persist-credentials: false + fetch-depth: 1 + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 + with: + inputs: ./.github/ + advanced-security: false