feat: add independent managed SSH agent packages
Managed SSH previously tied remote Agent and Runtime artifacts to desktop packaging and Host activation. Settings now manages verified Linux x64 and arm64 .gbagent packages explicitly, with source-aligned download and update plus offline import and export. Each package contains the signed Agent, pinned Node, and compatible OpenCode Runtime, and project activation never downloads one automatically. Dedicated native CI and a protected release workflow publish deterministic, signed cumulative catalogs to GitHub and Beijing OSS without replacing the desktop Latest release. Desktop packaging is metadata-only, remains independent of Agent artifacts and signing credentials, and Linux desktop releases add RPM installers. The managed SSH path also keeps model credentials in Main, enforces Ask as read-only, verifies signed Agent and Runtime inputs, preserves ACP recovery, and reports Host update cancellation and failures accurately. Release note: 远程项目现可在“设置”中手动下载、更新或离线导入签名 Agent 包，桌面安装包与远程组件发布相互独立；Linux 桌面版同时新增 RPM 安装包。
This commit is contained in:
mesalogo
@@ -0,0 +1,606 @@
|
||||
name: GoodBuddy Agent Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'agent-v*'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: agent-release-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
authorize:
|
||||
name: Authorize Agent release
|
||||
if: >-
|
||||
github.ref_type == 'tag' &&
|
||||
startsWith(github.ref_name, 'agent-v')
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 5
|
||||
outputs:
|
||||
authorized: ${{ steps.policy.outputs.authorized }}
|
||||
version: ${{ steps.policy.outputs.version }}
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Verify immutable Agent release tag
|
||||
id: policy
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
version="$(node -p "require('./agent-runtime-lock.json').agentVersion")"
|
||||
expected="agent-v$version"
|
||||
test "$GITHUB_REF_NAME" = "$expected"
|
||||
test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag"
|
||||
test "$(git rev-parse "refs/tags/$GITHUB_REF_NAME^{commit}")" = "$GITHUB_SHA"
|
||||
git fetch --no-tags origin main
|
||||
git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main
|
||||
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
||||
echo "version=$version" >> "$GITHUB_OUTPUT"
|
||||
|
||||
build:
|
||||
name: Build Linux ${{ matrix.arch }} compound package
|
||||
needs: authorize
|
||||
if: needs.authorize.outputs.authorized == 'true'
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- arch: x64
|
||||
runner: ubuntu-24.04
|
||||
- arch: arm64
|
||||
runner: ubuntu-24.04-arm
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 25
|
||||
environment:
|
||||
name: agent-signing
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
cache: npm
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Resolve locked native inputs
|
||||
id: inputs
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node - <<'NODE'
|
||||
const { appendFileSync } = require('node:fs')
|
||||
const { createHash } = require('node:crypto')
|
||||
const agent = require('./agent-runtime-lock.json')
|
||||
const remote = require('./remote-runtime-lock.json')
|
||||
const node = agent.node?.targets?.[`linux-${process.env.AGENT_ARCH}`]
|
||||
const runtime = remote.runtimes?.opencode
|
||||
const opencode = runtime?.targets?.[process.env.AGENT_ARCH]
|
||||
if (
|
||||
!node ||
|
||||
!opencode ||
|
||||
!/^[A-Za-z0-9._-]+\.tar\.gz$/u.test(node.archive) ||
|
||||
!/^[a-f0-9]{64}$/u.test(node.sha256) ||
|
||||
!/^[a-z0-9][a-z0-9._-]*$/u.test(opencode.package) ||
|
||||
!/^sha512-[A-Za-z0-9+/]+={0,2}$/u.test(opencode.integrity)
|
||||
) {
|
||||
throw new Error('Locked native Agent package inputs are invalid')
|
||||
}
|
||||
const nodeUrl = new URL(node.archive, agent.node.source)
|
||||
if (
|
||||
nodeUrl.protocol !== 'https:' ||
|
||||
nodeUrl.hostname !== 'nodejs.org' ||
|
||||
nodeUrl.username ||
|
||||
nodeUrl.password ||
|
||||
nodeUrl.search ||
|
||||
nodeUrl.hash
|
||||
) {
|
||||
throw new Error('Agent Node runtime must use the official HTTPS origin')
|
||||
}
|
||||
const opencodeArchive =
|
||||
`${opencode.package}-${runtime.version}.tgz`
|
||||
appendFileSync(
|
||||
process.env.GITHUB_OUTPUT,
|
||||
[
|
||||
`node-archive=${node.archive}`,
|
||||
`node-sha256=${node.sha256}`,
|
||||
`node-url=${nodeUrl.href}`,
|
||||
`opencode-package=${opencode.package}`,
|
||||
`opencode-version=${runtime.version}`,
|
||||
`opencode-integrity=${opencode.integrity}`,
|
||||
`opencode-archive=${opencodeArchive}`,
|
||||
`cache-key=${createHash('sha256')
|
||||
.update(`${node.sha256}:${opencode.integrity}`)
|
||||
.digest('hex')}`,
|
||||
''
|
||||
].join('\n')
|
||||
)
|
||||
NODE
|
||||
|
||||
- name: Cache verified native inputs
|
||||
uses: actions/cache@v6
|
||||
with:
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-release-inputs
|
||||
key: goodbuddy-agent-release-${{ matrix.arch }}-${{ steps.inputs.outputs.cache-key }}
|
||||
|
||||
- name: Acquire and verify native inputs
|
||||
shell: bash
|
||||
env:
|
||||
NODE_ARCHIVE: ${{ steps.inputs.outputs.node-archive }}
|
||||
NODE_SHA256: ${{ steps.inputs.outputs.node-sha256 }}
|
||||
NODE_URL: ${{ steps.inputs.outputs.node-url }}
|
||||
OPENCODE_ARCHIVE: ${{ steps.inputs.outputs.opencode-archive }}
|
||||
OPENCODE_INTEGRITY: ${{ steps.inputs.outputs.opencode-integrity }}
|
||||
OPENCODE_PACKAGE: ${{ steps.inputs.outputs.opencode-package }}
|
||||
OPENCODE_VERSION: ${{ steps.inputs.outputs.opencode-version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
directory="$RUNNER_TEMP/goodbuddy-agent-release-inputs"
|
||||
mkdir -p "$directory"
|
||||
node_archive="$directory/$NODE_ARCHIVE"
|
||||
if [[ ! -f "$node_archive" ]]; then
|
||||
curl --proto '=https' --tlsv1.2 \
|
||||
--fail --silent --show-error --location \
|
||||
--retry 3 --retry-all-errors \
|
||||
--connect-timeout 15 --max-time 300 \
|
||||
--max-filesize 104857600 \
|
||||
"$NODE_URL" --output "$node_archive.partial"
|
||||
mv "$node_archive.partial" "$node_archive"
|
||||
fi
|
||||
printf '%s %s\n' "$NODE_SHA256" "$node_archive" |
|
||||
sha256sum --check --strict -
|
||||
|
||||
opencode_archive="$directory/$OPENCODE_ARCHIVE"
|
||||
if [[ ! -f "$opencode_archive" ]]; then
|
||||
npm pack \
|
||||
--ignore-scripts \
|
||||
--registry https://registry.npmjs.org/ \
|
||||
--pack-destination "$directory" \
|
||||
"$OPENCODE_PACKAGE@$OPENCODE_VERSION"
|
||||
fi
|
||||
node - "$opencode_archive" "$OPENCODE_INTEGRITY" <<'NODE'
|
||||
const { createHash } = require('node:crypto')
|
||||
const { readFileSync, statSync } = require('node:fs')
|
||||
const [archive, expected] = process.argv.slice(2)
|
||||
const size = statSync(archive).size
|
||||
if (size <= 0 || size > 536870912) {
|
||||
throw new Error('OpenCode Runtime archive exceeds its safety limit')
|
||||
}
|
||||
const actual = `sha512-${createHash('sha512')
|
||||
.update(readFileSync(archive))
|
||||
.digest('base64')}`
|
||||
if (actual !== expected) {
|
||||
throw new Error('OpenCode Runtime archive integrity mismatch')
|
||||
}
|
||||
NODE
|
||||
|
||||
- name: Preflight production signing identities
|
||||
shell: bash
|
||||
env:
|
||||
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
|
||||
GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node build/agent-bundle.cjs preflight
|
||||
node build/remote-runtime-bundle.cjs preflight
|
||||
|
||||
- name: Build production compound Agent package
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
|
||||
GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
|
||||
GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID }}
|
||||
GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY }}
|
||||
NODE_ARCHIVE: ${{ steps.inputs.outputs.node-archive }}
|
||||
OPENCODE_ARCHIVE: ${{ steps.inputs.outputs.opencode-archive }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
output="$RUNNER_TEMP/goodbuddy-agent-output"
|
||||
mkdir -p "$output"
|
||||
node build/agent-package.cjs build \
|
||||
--arch "$AGENT_ARCH" \
|
||||
--minimum-desktop-version "$(node -p "require('./package.json').version")" \
|
||||
--node-archive "$RUNNER_TEMP/goodbuddy-agent-release-inputs/$NODE_ARCHIVE" \
|
||||
--runtime-archive "$RUNNER_TEMP/goodbuddy-agent-release-inputs/$OPENCODE_ARCHIVE" \
|
||||
--output "$output/goodbuddy-agent-$AGENT_VERSION-linux-$AGENT_ARCH.gbagent" \
|
||||
> "$output/result.json"
|
||||
node - "$output/result.json" "$AGENT_ARCH" "$AGENT_VERSION" <<'NODE'
|
||||
const { readFileSync } = require('node:fs')
|
||||
const [resultPath, architecture, version] = process.argv.slice(2)
|
||||
const result = JSON.parse(readFileSync(resultPath, 'utf8'))
|
||||
if (
|
||||
result.descriptor?.architecture !== architecture ||
|
||||
result.descriptor?.version !== version ||
|
||||
result.archive !==
|
||||
`goodbuddy-agent-${version}-linux-${architecture}.gbagent` ||
|
||||
!/^[a-f0-9]{64}$/u.test(result.sha256)
|
||||
) {
|
||||
throw new Error('Production Agent package result is invalid')
|
||||
}
|
||||
NODE
|
||||
|
||||
- name: Upload verified compound package
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: goodbuddy-agent-package-linux-${{ matrix.arch }}
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-output/goodbuddy-agent-*.gbagent
|
||||
if-no-files-found: error
|
||||
compression-level: 0
|
||||
retention-days: 7
|
||||
|
||||
catalog:
|
||||
name: Sign cumulative Agent catalog
|
||||
needs:
|
||||
- authorize
|
||||
- build
|
||||
if: needs.authorize.outputs.authorized == 'true'
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 10
|
||||
environment:
|
||||
name: agent-signing
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Download compound packages
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
pattern: goodbuddy-agent-package-linux-*
|
||||
path: dist/agent-release
|
||||
merge-multiple: true
|
||||
|
||||
- name: Fetch previous signed catalog when available
|
||||
id: previous
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
root="https://goodbuddy.oss-cn-beijing.aliyuncs.com/agent-releases"
|
||||
current_catalog_status="$(
|
||||
curl --silent --show-error \
|
||||
--output dist/agent-release/previous.json \
|
||||
--write-out '%{http_code}' \
|
||||
"$root/v$AGENT_VERSION/agent-catalog.json"
|
||||
)"
|
||||
current_signature_status="$(
|
||||
curl --silent --show-error \
|
||||
--output dist/agent-release/previous.sig \
|
||||
--write-out '%{http_code}' \
|
||||
"$root/v$AGENT_VERSION/agent-catalog.sig"
|
||||
)"
|
||||
if [[ "$current_catalog_status" == 200 && "$current_signature_status" == 200 ]]; then
|
||||
echo "arguments=--previous-catalog dist/agent-release/previous.json --previous-signature dist/agent-release/previous.sig" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
if [[ "$current_catalog_status" != 404 || "$current_signature_status" != 404 ]]; then
|
||||
echo "Current Agent catalog objects are inconsistent: $current_catalog_status / $current_signature_status" >&2
|
||||
exit 1
|
||||
fi
|
||||
rm -f dist/agent-release/previous.json dist/agent-release/previous.sig
|
||||
pointer_status="$(
|
||||
curl --silent --show-error \
|
||||
--output dist/agent-release/previous-pointer.json \
|
||||
--write-out '%{http_code}' \
|
||||
"$root/latest.json"
|
||||
)"
|
||||
if [[ "$pointer_status" == 200 ]]; then
|
||||
readarray -t paths < <(
|
||||
node - dist/agent-release/previous-pointer.json <<'NODE'
|
||||
const { readFileSync } = require('node:fs')
|
||||
const pointer = JSON.parse(readFileSync(process.argv[2], 'utf8'))
|
||||
if (
|
||||
pointer?.formatVersion !== 1 ||
|
||||
!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(pointer.version) ||
|
||||
pointer.catalog !== `v${pointer.version}/agent-catalog.json` ||
|
||||
pointer.signature !== `v${pointer.version}/agent-catalog.sig`
|
||||
) {
|
||||
throw new Error('Previous Agent catalog pointer is invalid')
|
||||
}
|
||||
process.stdout.write(`${pointer.catalog}\n${pointer.signature}\n`)
|
||||
NODE
|
||||
)
|
||||
curl --fail --silent --show-error \
|
||||
"$root/${paths[0]}" \
|
||||
--output dist/agent-release/previous.json
|
||||
curl --fail --silent --show-error \
|
||||
"$root/${paths[1]}" \
|
||||
--output dist/agent-release/previous.sig
|
||||
echo "arguments=--previous-catalog dist/agent-release/previous.json --previous-signature dist/agent-release/previous.sig" >> "$GITHUB_OUTPUT"
|
||||
elif [[ "$pointer_status" == 404 ]]; then
|
||||
rm -f dist/agent-release/previous-pointer.json
|
||||
echo "arguments=" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "Agent catalog pointer request failed: $pointer_status" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Sign cumulative Agent catalog
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
PREVIOUS_ARGUMENTS: ${{ steps.previous.outputs.arguments }}
|
||||
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
|
||||
GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
generated_at="$(git show -s --format=%cI "$GITHUB_SHA")"
|
||||
read -r -a previous <<< "$PREVIOUS_ARGUMENTS"
|
||||
node build/agent-catalog.cjs create \
|
||||
--x64-package "dist/agent-release/goodbuddy-agent-$AGENT_VERSION-linux-x64.gbagent" \
|
||||
--arm64-package "dist/agent-release/goodbuddy-agent-$AGENT_VERSION-linux-arm64.gbagent" \
|
||||
"${previous[@]}" \
|
||||
--catalog dist/agent-release/agent-catalog.json \
|
||||
--signature dist/agent-release/agent-catalog.sig \
|
||||
--generated-at "$generated_at"
|
||||
node build/agent-catalog.cjs verify \
|
||||
--catalog dist/agent-release/agent-catalog.json \
|
||||
--signature dist/agent-release/agent-catalog.sig
|
||||
|
||||
- name: Upload signed release set
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: goodbuddy-agent-release-${{ needs.authorize.outputs.version }}
|
||||
path: |
|
||||
dist/agent-release/goodbuddy-agent-*.gbagent
|
||||
dist/agent-release/agent-catalog.json
|
||||
dist/agent-release/agent-catalog.sig
|
||||
if-no-files-found: error
|
||||
compression-level: 0
|
||||
retention-days: 7
|
||||
|
||||
publish:
|
||||
name: Publish Agent to GitHub and OSS
|
||||
needs:
|
||||
- authorize
|
||||
- catalog
|
||||
if: needs.authorize.outputs.authorized == 'true'
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 25
|
||||
environment:
|
||||
name: aliyun-oss-release
|
||||
permissions:
|
||||
contents: write
|
||||
actions: read
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
|
||||
- name: Install verification dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Download signed release set
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: goodbuddy-agent-release-${{ needs.authorize.outputs.version }}
|
||||
path: dist/agent-release
|
||||
|
||||
- name: Verify signed release set
|
||||
run: |
|
||||
node build/agent-catalog.cjs verify \
|
||||
--catalog dist/agent-release/agent-catalog.json \
|
||||
--signature dist/agent-release/agent-catalog.sig
|
||||
|
||||
- name: Verify OSS release configuration
|
||||
shell: bash
|
||||
env:
|
||||
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
||||
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
||||
OIDC_PROVIDER_ARN: ${{ vars.ALIYUN_OIDC_PROVIDER_ARN }}
|
||||
ROLE_ARN: ${{ vars.ALIYUN_ROLE_ARN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
test "$OSS_BUCKET" = "goodbuddy"
|
||||
test "$OSS_ENDPOINT" = "https://oss-cn-beijing.aliyuncs.com"
|
||||
case "$OIDC_PROVIDER_ARN" in
|
||||
acs:ram::*:oidc-provider/*) ;;
|
||||
*) echo "OIDC Provider ARN 无效" >&2; exit 1 ;;
|
||||
esac
|
||||
case "$ROLE_ARN" in
|
||||
acs:ram::*:role/*) ;;
|
||||
*) echo "RAM Role ARN 无效" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
- name: Authenticate to Alibaba Cloud
|
||||
uses: aliyun/configure-aliyun-credentials-action@v1
|
||||
with:
|
||||
role-to-assume: ${{ vars.ALIYUN_ROLE_ARN }}
|
||||
oidc-provider-arn: ${{ vars.ALIYUN_OIDC_PROVIDER_ARN }}
|
||||
role-session-name: goodbuddy-agent-${{ github.run_id }}
|
||||
role-session-expiration: 3600
|
||||
audience: sts.aliyuncs.com
|
||||
|
||||
- name: Install ossutil
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
version="2.3.0"
|
||||
archive="$RUNNER_TEMP/ossutil.zip"
|
||||
directory="$RUNNER_TEMP/ossutil"
|
||||
curl --fail --silent --show-error --location \
|
||||
"https://gosspublic.alicdn.com/ossutil/v2/$version/ossutil-$version-linux-amd64.zip" \
|
||||
--output "$archive"
|
||||
mkdir "$directory"
|
||||
unzip -q "$archive" -d "$directory"
|
||||
binary="$(find "$directory" -type f -name ossutil -print -quit)"
|
||||
test -n "$binary"
|
||||
chmod +x "$binary"
|
||||
echo "$(dirname "$binary")" >> "$GITHUB_PATH"
|
||||
|
||||
- name: Upload immutable Agent release to OSS
|
||||
id: oss
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
||||
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
export OSS_ACCESS_KEY_ID="$ALIBABA_CLOUD_ACCESS_KEY_ID"
|
||||
export OSS_ACCESS_KEY_SECRET="$ALIBABA_CLOUD_ACCESS_KEY_SECRET"
|
||||
export OSS_SESSION_TOKEN="$ALIBABA_CLOUD_SECURITY_TOKEN"
|
||||
endpoint_host="${OSS_ENDPOINT#https://}"
|
||||
region="${endpoint_host#oss-}"
|
||||
region="${region%.aliyuncs.com}"
|
||||
test "$region" = "cn-beijing"
|
||||
for file in dist/agent-release/*; do
|
||||
name="$(basename "$file")"
|
||||
ossutil cp "$file" \
|
||||
"oss://${OSS_BUCKET}/agent-releases/v${AGENT_VERSION}/${name}" \
|
||||
--endpoint "$OSS_ENDPOINT" \
|
||||
--region "$region" \
|
||||
--update
|
||||
done
|
||||
echo "region=$region" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Verify public immutable OSS packages
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
root="https://goodbuddy.oss-cn-beijing.aliyuncs.com/agent-releases/v$AGENT_VERSION"
|
||||
for architecture in x64 arm64; do
|
||||
name="goodbuddy-agent-$AGENT_VERSION-linux-$architecture.gbagent"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$root/$name" --output "$RUNNER_TEMP/$name"
|
||||
cmp "dist/agent-release/$name" "$RUNNER_TEMP/$name"
|
||||
done
|
||||
for name in agent-catalog.json agent-catalog.sig; do
|
||||
curl --fail --silent --show-error --location \
|
||||
"$root/$name" --output "$RUNNER_TEMP/immutable-$name"
|
||||
cmp "dist/agent-release/$name" \
|
||||
"$RUNNER_TEMP/immutable-$name"
|
||||
done
|
||||
|
||||
- name: Publish non-Latest GitHub Agent release
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tag="agent-v$AGENT_VERSION"
|
||||
title="GoodBuddy Agent $AGENT_VERSION"
|
||||
notes="$RUNNER_TEMP/agent-release-notes.md"
|
||||
cat > "$notes" <<EOF
|
||||
GoodBuddy Agent $AGENT_VERSION
|
||||
|
||||
此版本供 GoodBuddy 的“设置 > 平台功能 > 远程项目”手动下载。软件包包含 Agent、固定 Node 和 GoodBuddy 适配的远端 OpenCode Runtime。
|
||||
|
||||
This release is downloaded manually from GoodBuddy Settings > Platform Features > Remote Projects. Each package contains the Agent, pinned Node, and the GoodBuddy-adapted remote OpenCode Runtime.
|
||||
EOF
|
||||
if gh release view "$tag" >/dev/null 2>&1; then
|
||||
is_draft="$(gh release view "$tag" --json isDraft --jq .isDraft)"
|
||||
if [[ "$is_draft" == true ]]; then
|
||||
gh release edit "$tag" \
|
||||
--title "$title" \
|
||||
--notes-file "$notes" \
|
||||
--latest=false
|
||||
gh release upload "$tag" dist/agent-release/* --clobber
|
||||
gh release edit "$tag" --draft=false --latest=false
|
||||
else
|
||||
verify="$RUNNER_TEMP/github-agent-release"
|
||||
mkdir "$verify"
|
||||
gh release download "$tag" --dir "$verify"
|
||||
for file in dist/agent-release/*; do
|
||||
cmp "$file" "$verify/$(basename "$file")"
|
||||
done
|
||||
fi
|
||||
else
|
||||
gh release create "$tag" \
|
||||
--draft \
|
||||
--verify-tag \
|
||||
--title "$title" \
|
||||
--notes-file "$notes" \
|
||||
--latest=false
|
||||
gh release upload "$tag" dist/agent-release/* --clobber
|
||||
gh release edit "$tag" --draft=false --latest=false
|
||||
fi
|
||||
test "$(gh api repos/mesalogo/goodbuddy/releases/latest --jq .tag_name)" != "$tag"
|
||||
|
||||
- name: Point OSS Agent catalog to published release
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
||||
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
||||
OSS_REGION: ${{ steps.oss.outputs.region }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
export OSS_ACCESS_KEY_ID="$ALIBABA_CLOUD_ACCESS_KEY_ID"
|
||||
export OSS_ACCESS_KEY_SECRET="$ALIBABA_CLOUD_ACCESS_KEY_SECRET"
|
||||
export OSS_SESSION_TOKEN="$ALIBABA_CLOUD_SECURITY_TOKEN"
|
||||
node - "$AGENT_VERSION" > dist/agent-release/latest.json <<'NODE'
|
||||
const version = process.argv[2]
|
||||
process.stdout.write(`${JSON.stringify({
|
||||
formatVersion: 1,
|
||||
version,
|
||||
catalog: `v${version}/agent-catalog.json`,
|
||||
signature: `v${version}/agent-catalog.sig`
|
||||
}, null, 2)}\n`)
|
||||
NODE
|
||||
ossutil cp dist/agent-release/latest.json \
|
||||
"oss://${OSS_BUCKET}/agent-releases/latest.json" \
|
||||
--endpoint "$OSS_ENDPOINT" \
|
||||
--region "$OSS_REGION" \
|
||||
--force
|
||||
|
||||
- name: Verify public Agent catalogs
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mirror="https://goodbuddy.oss-cn-beijing.aliyuncs.com/agent-releases"
|
||||
github="https://github.com/mesalogo/goodbuddy/releases/download/agent-v$AGENT_VERSION"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$mirror/latest.json" --output "$RUNNER_TEMP/mirror-pointer.json"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$mirror/v$AGENT_VERSION/agent-catalog.json" \
|
||||
--output "$RUNNER_TEMP/mirror.json"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$mirror/v$AGENT_VERSION/agent-catalog.sig" \
|
||||
--output "$RUNNER_TEMP/mirror.sig"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$github/agent-catalog.json" --output "$RUNNER_TEMP/github.json"
|
||||
curl --fail --silent --show-error --location \
|
||||
"$github/agent-catalog.sig" --output "$RUNNER_TEMP/github.sig"
|
||||
cmp dist/agent-release/latest.json "$RUNNER_TEMP/mirror-pointer.json"
|
||||
cmp dist/agent-release/agent-catalog.json "$RUNNER_TEMP/mirror.json"
|
||||
cmp dist/agent-release/agent-catalog.sig "$RUNNER_TEMP/mirror.sig"
|
||||
cmp dist/agent-release/agent-catalog.json "$RUNNER_TEMP/github.json"
|
||||
cmp dist/agent-release/agent-catalog.sig "$RUNNER_TEMP/github.sig"
|
||||
@@ -0,0 +1,313 @@
|
||||
name: GoodBuddy Agents
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
paths:
|
||||
- '.github/workflows/agents.yml'
|
||||
- 'agent-runtime-lock.json'
|
||||
- 'build/agent-bundle.cjs'
|
||||
- 'build/agent-package.cjs'
|
||||
- 'build/agent-ci-bundle.cjs'
|
||||
- 'build/file-hash.cjs'
|
||||
- 'build/remote-runtime-bundle.cjs'
|
||||
- 'build/signing-key-preflight.cjs'
|
||||
- 'package-lock.json'
|
||||
- 'package.json'
|
||||
- 'resources/agent-release-keys.json'
|
||||
- 'remote-runtime-lock.json'
|
||||
- 'src/agent-daemon/**'
|
||||
- 'src/shared/**'
|
||||
- 'tests/agent-bundle.test.ts'
|
||||
- 'tests/agent-package.test.ts'
|
||||
- 'tests/agents-workflow.test.ts'
|
||||
- 'tests/remote-runtime-bundle.test.ts'
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- '.github/workflows/agents.yml'
|
||||
- 'agent-runtime-lock.json'
|
||||
- 'build/agent-bundle.cjs'
|
||||
- 'build/agent-package.cjs'
|
||||
- 'build/agent-ci-bundle.cjs'
|
||||
- 'build/file-hash.cjs'
|
||||
- 'build/remote-runtime-bundle.cjs'
|
||||
- 'build/signing-key-preflight.cjs'
|
||||
- 'package-lock.json'
|
||||
- 'package.json'
|
||||
- 'resources/agent-release-keys.json'
|
||||
- 'remote-runtime-lock.json'
|
||||
- 'src/agent-daemon/**'
|
||||
- 'src/shared/**'
|
||||
- 'tests/agent-bundle.test.ts'
|
||||
- 'tests/agent-package.test.ts'
|
||||
- 'tests/agents-workflow.test.ts'
|
||||
- 'tests/remote-runtime-bundle.test.ts'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: agents-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
validate:
|
||||
name: Validate Agent source
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
cache: npm
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Validate Agent source and workflow
|
||||
run: |
|
||||
npm test -- \
|
||||
tests/agent-bundle.test.ts \
|
||||
tests/agent-package.test.ts \
|
||||
tests/remote-runtime-bundle.test.ts \
|
||||
tests/agents-workflow.test.ts
|
||||
npm run typecheck
|
||||
|
||||
build:
|
||||
name: Build Linux ${{ matrix.arch }} Agent
|
||||
needs: validate
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- arch: x64
|
||||
runner: ubuntu-24.04
|
||||
- arch: arm64
|
||||
runner: ubuntu-24.04-arm
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 20
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
cache: npm
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Resolve locked official Node runtime
|
||||
id: runtime
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node - <<'NODE'
|
||||
const { appendFileSync } = require('node:fs')
|
||||
const lock = require('./agent-runtime-lock.json')
|
||||
const target = lock.node?.targets?.[`linux-${process.env.AGENT_ARCH}`]
|
||||
if (
|
||||
!target ||
|
||||
!/^[A-Za-z0-9._-]+\.tar\.gz$/u.test(target.archive) ||
|
||||
!/^[a-f0-9]{64}$/u.test(target.sha256)
|
||||
) {
|
||||
throw new Error('Locked Agent Node runtime metadata is invalid')
|
||||
}
|
||||
const url = new URL(target.archive, lock.node.source)
|
||||
if (
|
||||
url.protocol !== 'https:' ||
|
||||
url.hostname !== 'nodejs.org' ||
|
||||
url.username ||
|
||||
url.password ||
|
||||
url.search ||
|
||||
url.hash
|
||||
) {
|
||||
throw new Error('Agent Node runtime must use the official HTTPS origin')
|
||||
}
|
||||
appendFileSync(
|
||||
process.env.GITHUB_OUTPUT,
|
||||
[
|
||||
`archive=${target.archive}`,
|
||||
`sha256=${target.sha256}`,
|
||||
`url=${url.href}`,
|
||||
''
|
||||
].join('\n')
|
||||
)
|
||||
NODE
|
||||
|
||||
- name: Cache verified Node runtime input
|
||||
uses: actions/cache@v6
|
||||
with:
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-node
|
||||
key: goodbuddy-agent-ci-node-${{ matrix.arch }}-${{ steps.runtime.outputs.sha256 }}
|
||||
|
||||
- name: Acquire and verify locked Node runtime
|
||||
shell: bash
|
||||
env:
|
||||
NODE_ARCHIVE: ${{ steps.runtime.outputs.archive }}
|
||||
NODE_SHA256: ${{ steps.runtime.outputs.sha256 }}
|
||||
NODE_URL: ${{ steps.runtime.outputs.url }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
directory="$RUNNER_TEMP/goodbuddy-agent-node"
|
||||
archive="$directory/$NODE_ARCHIVE"
|
||||
mkdir -p "$directory"
|
||||
if [[ ! -f "$archive" ]]; then
|
||||
rm -f "$archive.partial"
|
||||
curl --proto '=https' --tlsv1.2 \
|
||||
--fail --silent --show-error --location \
|
||||
--retry 3 --retry-all-errors \
|
||||
--connect-timeout 15 --max-time 300 \
|
||||
--max-filesize 104857600 \
|
||||
"$NODE_URL" --output "$archive.partial"
|
||||
mv "$archive.partial" "$archive"
|
||||
fi
|
||||
printf '%s %s\n' "$NODE_SHA256" "$archive" |
|
||||
sha256sum --check --strict -
|
||||
|
||||
- name: Resolve locked OpenCode Runtime
|
||||
id: opencode
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node - <<'NODE'
|
||||
const { appendFileSync } = require('node:fs')
|
||||
const { createHash: hash } = require('node:crypto')
|
||||
const lock = require('./remote-runtime-lock.json')
|
||||
const runtime = lock.runtimes?.opencode
|
||||
const target = runtime?.targets?.[process.env.AGENT_ARCH]
|
||||
if (
|
||||
!runtime ||
|
||||
!target ||
|
||||
!/^[a-z0-9][a-z0-9._-]*$/u.test(target.package) ||
|
||||
!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(runtime.version) ||
|
||||
!/^sha512-[A-Za-z0-9+/]+={0,2}$/u.test(target.integrity)
|
||||
) {
|
||||
throw new Error('Locked OpenCode Runtime metadata is invalid')
|
||||
}
|
||||
const archive = `${target.package}-${runtime.version}.tgz`
|
||||
appendFileSync(
|
||||
process.env.GITHUB_OUTPUT,
|
||||
[
|
||||
`package=${target.package}`,
|
||||
`version=${runtime.version}`,
|
||||
`integrity=${target.integrity}`,
|
||||
`archive=${archive}`,
|
||||
`cache-key=${hash('sha256').update(target.integrity).digest('hex')}`,
|
||||
''
|
||||
].join('\n')
|
||||
)
|
||||
NODE
|
||||
|
||||
- name: Cache verified OpenCode Runtime input
|
||||
uses: actions/cache@v6
|
||||
with:
|
||||
path: ${{ runner.temp }}/goodbuddy-opencode-runtime
|
||||
key: goodbuddy-agent-ci-opencode-${{ matrix.arch }}-${{ steps.opencode.outputs.cache-key }}
|
||||
|
||||
- name: Acquire and verify locked OpenCode Runtime
|
||||
shell: bash
|
||||
env:
|
||||
OPENCODE_ARCHIVE: ${{ steps.opencode.outputs.archive }}
|
||||
OPENCODE_INTEGRITY: ${{ steps.opencode.outputs.integrity }}
|
||||
OPENCODE_PACKAGE: ${{ steps.opencode.outputs.package }}
|
||||
OPENCODE_VERSION: ${{ steps.opencode.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
directory="$RUNNER_TEMP/goodbuddy-opencode-runtime"
|
||||
archive="$directory/$OPENCODE_ARCHIVE"
|
||||
mkdir -p "$directory"
|
||||
if [[ ! -f "$archive" ]]; then
|
||||
npm pack \
|
||||
--ignore-scripts \
|
||||
--registry https://registry.npmjs.org/ \
|
||||
--pack-destination "$directory" \
|
||||
"$OPENCODE_PACKAGE@$OPENCODE_VERSION"
|
||||
fi
|
||||
node - "$archive" "$OPENCODE_INTEGRITY" <<'NODE'
|
||||
const { createHash } = require('node:crypto')
|
||||
const { readFileSync, statSync } = require('node:fs')
|
||||
const [archive, expected] = process.argv.slice(2)
|
||||
const size = statSync(archive).size
|
||||
if (size <= 0 || size > 536870912) {
|
||||
throw new Error('OpenCode Runtime archive exceeds its safety limit')
|
||||
}
|
||||
const actual = `sha512-${createHash('sha512')
|
||||
.update(readFileSync(archive))
|
||||
.digest('base64')}`
|
||||
if (actual !== expected) {
|
||||
throw new Error('OpenCode Runtime archive integrity mismatch')
|
||||
}
|
||||
NODE
|
||||
|
||||
- name: Run native Agent regressions
|
||||
run: |
|
||||
npm test -- \
|
||||
src/agent-daemon/model-bridge.test.ts \
|
||||
src/agent-daemon/lifecycle.test.ts
|
||||
|
||||
- name: Build and verify ephemeral signed compound Agent package twice
|
||||
id: agent
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
NODE_ARCHIVE: ${{ steps.runtime.outputs.archive }}
|
||||
OPENCODE_ARCHIVE: ${{ steps.opencode.outputs.archive }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
directory="$RUNNER_TEMP/goodbuddy-agent-ci"
|
||||
rm -rf "$directory"
|
||||
mkdir -p "$directory"
|
||||
agent_version="$(node -p "require('./agent-runtime-lock.json').agentVersion")"
|
||||
node build/agent-ci-bundle.cjs \
|
||||
--arch "$AGENT_ARCH" \
|
||||
--node-archive "$RUNNER_TEMP/goodbuddy-agent-node/$NODE_ARCHIVE" \
|
||||
--opencode-archive "$RUNNER_TEMP/goodbuddy-opencode-runtime/$OPENCODE_ARCHIVE" \
|
||||
--output-directory "$directory/bundle" \
|
||||
--archive "$directory/goodbuddy-agent-$agent_version-linux-$AGENT_ARCH.gbagent" |
|
||||
tee "$directory/result.json"
|
||||
node - <<'NODE'
|
||||
const { appendFileSync, readFileSync } = require('node:fs')
|
||||
const result = JSON.parse(
|
||||
readFileSync(
|
||||
`${process.env.RUNNER_TEMP}/goodbuddy-agent-ci/result.json`,
|
||||
'utf8'
|
||||
)
|
||||
)
|
||||
if (
|
||||
result.architecture !== process.env.AGENT_ARCH ||
|
||||
!/^[a-f0-9]{64}$/u.test(result.archiveSha256)
|
||||
) {
|
||||
throw new Error('Agent CI result is invalid')
|
||||
}
|
||||
appendFileSync(
|
||||
process.env.GITHUB_OUTPUT,
|
||||
`sha256=${result.archiveSha256}\n`
|
||||
)
|
||||
NODE
|
||||
|
||||
- name: Record verified Agent build
|
||||
shell: bash
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
AGENT_SHA256: ${{ steps.agent.outputs.sha256 }}
|
||||
run: |
|
||||
{
|
||||
echo "### Linux $AGENT_ARCH Agent"
|
||||
echo
|
||||
echo "Native compound Agent, Node, and OpenCode Runtime build, test-signature verification, launch smoke, and deterministic archive comparison passed."
|
||||
echo
|
||||
echo "Archive SHA-256: \`$AGENT_SHA256\`"
|
||||
echo
|
||||
echo "The ephemeral CI key and bundle are not published."
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
+13
-195
@@ -60,8 +60,8 @@ jobs:
|
||||
if-no-files-found: error
|
||||
retention-days: 1
|
||||
|
||||
authorize-agent-signing:
|
||||
name: Authorize production Agent signing
|
||||
authorize-release:
|
||||
name: Authorize desktop packaging
|
||||
if: >-
|
||||
github.ref_type == 'tag' ||
|
||||
(github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
|
||||
@@ -106,194 +106,21 @@ jobs:
|
||||
test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"
|
||||
;;
|
||||
*)
|
||||
echo "Production Agent signing is limited to immutable version-tag pushes or a manual run of refs/heads/main." >&2
|
||||
echo "Desktop packaging is limited to immutable version-tag pushes or a manual run of refs/heads/main." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
||||
|
||||
agent-runtime:
|
||||
name: Acquire Linux ${{ matrix.arch }} Agent runtime
|
||||
if: >-
|
||||
needs.authorize-agent-signing.result == 'success' &&
|
||||
needs.authorize-agent-signing.outputs.authorized == 'true'
|
||||
needs:
|
||||
- validate
|
||||
- authorize-agent-signing
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- arch: x64
|
||||
node-url: https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.gz
|
||||
node-archive: node-v24.19.0-linux-x64.tar.gz
|
||||
node-sha256: f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4
|
||||
- arch: arm64
|
||||
node-url: https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.gz
|
||||
node-archive: node-v24.19.0-linux-arm64.tar.gz
|
||||
node-sha256: d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 10
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- name: Verify locked Node runtime metadata
|
||||
env:
|
||||
AGENT_ARCH: ${{ matrix.arch }}
|
||||
NODE_ARCHIVE: ${{ matrix.node-archive }}
|
||||
NODE_SHA256: ${{ matrix.node-sha256 }}
|
||||
NODE_URL: ${{ matrix.node-url }}
|
||||
run: |
|
||||
node - <<'NODE'
|
||||
const lock = require('./agent-runtime-lock.json')
|
||||
const input = lock.node?.targets?.[`linux-${process.env.AGENT_ARCH}`]
|
||||
const expectedUrl = `${lock.node?.source ?? ''}${input?.archive ?? ''}`
|
||||
if (
|
||||
input?.archive !== process.env.NODE_ARCHIVE ||
|
||||
input?.sha256 !== process.env.NODE_SHA256 ||
|
||||
expectedUrl !== process.env.NODE_URL ||
|
||||
!expectedUrl.startsWith('https://')
|
||||
) {
|
||||
throw new Error('Agent runtime acquisition metadata does not match agent-runtime-lock.json')
|
||||
}
|
||||
NODE
|
||||
|
||||
- name: Restore verified Node runtime cache
|
||||
id: node-runtime-cache
|
||||
uses: actions/cache/restore@v6
|
||||
with:
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-node
|
||||
key: goodbuddy-agent-node-${{ matrix.arch }}-${{ matrix.node-sha256 }}
|
||||
|
||||
- name: Download locked official Node runtime
|
||||
if: steps.node-runtime-cache.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
env:
|
||||
NODE_ARCHIVE: ${{ matrix.node-archive }}
|
||||
NODE_URL: ${{ matrix.node-url }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
directory="$RUNNER_TEMP/goodbuddy-agent-node"
|
||||
archive="$directory/$NODE_ARCHIVE"
|
||||
mkdir -p "$directory"
|
||||
curl --proto '=https' --tlsv1.2 \
|
||||
--fail --silent --show-error --location \
|
||||
--retry 3 --retry-all-errors \
|
||||
--connect-timeout 15 --max-time 300 \
|
||||
--max-filesize 104857600 \
|
||||
"$NODE_URL" --output "$archive.partial"
|
||||
mv "$archive.partial" "$archive"
|
||||
|
||||
- name: Verify locked Node runtime digest
|
||||
shell: bash
|
||||
env:
|
||||
NODE_ARCHIVE: ${{ matrix.node-archive }}
|
||||
NODE_SHA256: ${{ matrix.node-sha256 }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
archive="$RUNNER_TEMP/goodbuddy-agent-node/$NODE_ARCHIVE"
|
||||
test -f "$archive"
|
||||
printf '%s %s\n' "$NODE_SHA256" "$archive" |
|
||||
sha256sum --check --strict -
|
||||
|
||||
- name: Save verified Node runtime cache
|
||||
if: steps.node-runtime-cache.outputs.cache-hit != 'true'
|
||||
uses: actions/cache/save@v6
|
||||
with:
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-node
|
||||
key: goodbuddy-agent-node-${{ matrix.arch }}-${{ matrix.node-sha256 }}
|
||||
|
||||
- name: Upload verified Node runtime input
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: goodbuddy-agent-node-${{ matrix.arch }}
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-node/${{ matrix.node-archive }}
|
||||
if-no-files-found: error
|
||||
compression-level: 0
|
||||
retention-days: 1
|
||||
|
||||
agent-signing:
|
||||
name: Linux ${{ matrix.arch }} signed Agent bundle
|
||||
if: >-
|
||||
needs.authorize-agent-signing.result == 'success' &&
|
||||
needs.authorize-agent-signing.outputs.authorized == 'true'
|
||||
needs:
|
||||
- validate
|
||||
- authorize-agent-signing
|
||||
- agent-runtime
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- arch: x64
|
||||
runner: ubuntu-24.04
|
||||
node-archive: node-v24.19.0-linux-x64.tar.gz
|
||||
node-sha256: f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4
|
||||
- arch: arm64
|
||||
runner: ubuntu-24.04-arm
|
||||
node-archive: node-v24.19.0-linux-arm64.tar.gz
|
||||
node-sha256: d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 20
|
||||
environment:
|
||||
name: agent-signing
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24.19.0
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Preflight production Agent signing registry
|
||||
env:
|
||||
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
|
||||
run: node build/agent-bundle.cjs preflight
|
||||
|
||||
- name: Download verified official Node runtime input
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: goodbuddy-agent-node-${{ matrix.arch }}
|
||||
path: ${{ runner.temp }}/goodbuddy-agent-node
|
||||
|
||||
- name: Build and sign Agent bundle
|
||||
shell: bash
|
||||
env:
|
||||
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
|
||||
GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
set +x
|
||||
node build/agent-bundle.cjs build \
|
||||
--arch "${{ matrix.arch }}" \
|
||||
--runtime-archive "$RUNNER_TEMP/goodbuddy-agent-node/${{ matrix.node-archive }}" \
|
||||
--archive "dist/agent-bundles/goodbuddy-agent-linux-${{ matrix.arch }}.tar"
|
||||
|
||||
- name: Upload signed Agent bundle
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: goodbuddy-agent-linux-${{ matrix.arch }}
|
||||
path: dist/agent-bundles/goodbuddy-agent-linux-${{ matrix.arch }}.tar
|
||||
if-no-files-found: error
|
||||
compression-level: 0
|
||||
retention-days: 1
|
||||
|
||||
package:
|
||||
name: ${{ matrix.platform }} ${{ matrix.arch }}
|
||||
if: >-
|
||||
needs.authorize-agent-signing.result == 'success' &&
|
||||
needs.authorize-agent-signing.outputs.authorized == 'true'
|
||||
needs.authorize-release.result == 'success' &&
|
||||
needs.authorize-release.outputs.authorized == 'true'
|
||||
needs:
|
||||
- validate
|
||||
- authorize-agent-signing
|
||||
- agent-signing
|
||||
- authorize-release
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
@@ -347,23 +174,14 @@ jobs:
|
||||
name: goodbuddy-production-bundle
|
||||
path: out
|
||||
|
||||
- name: Download signed Agent bundles
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
pattern: goodbuddy-agent-linux-*
|
||||
path: dist/agent-downloads
|
||||
merge-multiple: true
|
||||
|
||||
- name: Import and verify both Agent bundles
|
||||
- name: Install RPM packaging tools
|
||||
if: matrix.platform == 'linux'
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node build/agent-bundle.cjs import \
|
||||
--arch x64 \
|
||||
--archive dist/agent-downloads/goodbuddy-agent-linux-x64.tar
|
||||
node build/agent-bundle.cjs import \
|
||||
--arch arm64 \
|
||||
--archive dist/agent-downloads/goodbuddy-agent-linux-arm64.tar
|
||||
sudo apt-get update
|
||||
sudo apt-get install --no-install-recommends --yes rpm
|
||||
rpmbuild --version
|
||||
|
||||
- name: Resolve macOS signing mode
|
||||
id: macos-signing
|
||||
@@ -482,9 +300,9 @@ jobs:
|
||||
if: >-
|
||||
github.event_name == 'push' &&
|
||||
github.ref_type == 'tag' &&
|
||||
needs.authorize-agent-signing.outputs.authorized == 'true'
|
||||
needs.authorize-release.outputs.authorized == 'true'
|
||||
needs:
|
||||
- authorize-agent-signing
|
||||
- authorize-release
|
||||
- package
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 35
|
||||
|
||||
Reference in New Issue
Block a user