Merge b9eb1406bb into bbc69f945e

Update release.yml

.github/workflows/release.yml

@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
-      - '[0-9]+.[0-9]+.[0-9]+-*'
   workflow_dispatch:
 
 concurrency:
@@ -13,204 +12,274 @@ concurrency:
 
 permissions:
   contents: read
+  packages: write
 
 env:
   CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: "1"
   BINARY_NAME: telemt
 
 jobs:
-  prepare:
+# ==========================
+# GNU / glibc
+# ==========================
+  build-gnu:
+    name: GNU ${{ matrix.target }}
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.meta.outputs.version }}
-      prerelease: ${{ steps.meta.outputs.prerelease }}
-      release_enabled: ${{ steps.meta.outputs.release_enabled }}
-    steps:
-      - id: meta
-        run: |
-          set -euo pipefail
-
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            VERSION="${GITHUB_REF#refs/tags/}"
-            RELEASE_ENABLED=true
-          else
-            VERSION="manual-${GITHUB_SHA::7}"
-            RELEASE_ENABLED=false
-          fi
-
-          if [[ "$VERSION" == *"-alpha"* || "$VERSION" == *"-beta"* || "$VERSION" == *"-rc"* ]]; then
-            PRERELEASE=true
-          else
-            PRERELEASE=false
-          fi
-
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
-          echo "release_enabled=$RELEASE_ENABLED" >> "$GITHUB_OUTPUT"
-
-  checks:
-    runs-on: ubuntu-latest
-    container:
-      image: debian:trixie
-    steps:
-      - run: |
-          apt-get update
-          apt-get install -y build-essential clang llvm pkg-config curl git
-
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            /github/home/.cargo/registry
-            /github/home/.cargo/git
-            target
-          key: checks-${{ hashFiles('**/Cargo.lock') }}
-
-      - run: cargo fetch --locked
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy
-      - run: cargo test
-
-  build-binaries:
-    needs: [prepare, checks]
-    runs-on: ubuntu-latest
-    container:
-      image: debian:trixie
 
     strategy:
       fail-fast: false
       matrix:
         include:
-          - rust_target: x86_64-unknown-linux-gnu
+          - target: x86_64-unknown-linux-gnu
-            zig_target: x86_64-unknown-linux-gnu.2.28
+            asset: telemt-x86_64-linux-gnu
-            asset_name: telemt-x86_64-linux-gnu
+          - target: aarch64-unknown-linux-gnu
-          - rust_target: aarch64-unknown-linux-gnu
+            asset: telemt-aarch64-linux-gnu
-            zig_target: aarch64-unknown-linux-gnu.2.28
-            asset_name: telemt-aarch64-linux-gnu
-          - rust_target: x86_64-unknown-linux-musl
-            zig_target: x86_64-unknown-linux-musl
-            asset_name: telemt-x86_64-linux-musl
-          - rust_target: aarch64-unknown-linux-musl
-            zig_target: aarch64-unknown-linux-musl
-            asset_name: telemt-aarch64-linux-musl
 
     steps:
-      - run: |
-          apt-get update
-          apt-get install -y clang llvm pkg-config curl git python3 python3-pip file tar xz-utils
-
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: dtolnay/rust-toolchain@v1
         with:
-          targets: ${{ matrix.rust_target }}
+          toolchain: stable
+          targets: |
+            x86_64-unknown-linux-gnu
+            aarch64-unknown-linux-gnu
+
+      - name: Install deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            clang \
+            lld \
+            pkg-config \
+            gcc-aarch64-linux-gnu \
+            g++-aarch64-linux-gnu
 
       - uses: actions/cache@v4
         with:
           path: |
-            /github/home/.cargo/registry
+            ~/.cargo/registry
-            /github/home/.cargo/git
+            ~/.cargo/git
             target
-          key: build-${{ matrix.zig_target }}-${{ hashFiles('**/Cargo.lock') }}
+          key: gnu-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
 
-      - run: |
+      - name: Build
-          python3 -m pip install --user --break-system-packages cargo-zigbuild
+        run: |
-          echo "/github/home/.local/bin" >> "$GITHUB_PATH"
+          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
+            export CC=aarch64-linux-gnu-gcc
+            export CXX=aarch64-linux-gnu-g++
+            export CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
+            export CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++
+            export RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc"
+          else
+            export CC=clang
+            export CXX=clang++
+            export CC_x86_64_unknown_linux_gnu=clang
+            export CXX_x86_64_unknown_linux_gnu=clang++
+            export RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=lld"
+          fi
 
-      - run: cargo fetch --locked
+          cargo build --release --target ${{ matrix.target }}
 
-      - run: |
+      - name: Package
-          cargo zigbuild --release --locked --target "${{ matrix.zig_target }}"
+        run: |
+          mkdir -p dist
+          BIN=target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}
 
-      - run: |
+          cp "$BIN" dist/${{ env.BINARY_NAME }}-${{ matrix.target }}
-          BIN="target/${{ matrix.rust_target }}/release/${BINARY_NAME}"
-          llvm-strip "$BIN" || true
 
-      - run: |
+          cd dist
-          BIN="target/${{ matrix.rust_target }}/release/${BINARY_NAME}"
+          tar -czf ${{ matrix.asset }}.tar.gz ${{ env.BINARY_NAME }}-${{ matrix.target }}
-          OUT="$RUNNER_TEMP/${{ matrix.asset_name }}"
+          sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
-          mkdir -p "$OUT"
-          install -m755 "$BIN" "$OUT/${BINARY_NAME}"
-
-          tar -C "$RUNNER_TEMP" -czf "${{ matrix.asset_name }}.tar.gz" "${{ matrix.asset_name }}"
-          sha256sum "${{ matrix.asset_name }}.tar.gz" > "${{ matrix.asset_name }}.sha256"
 
       - uses: actions/upload-artifact@v4
         with:
-          name: ${{ matrix.asset_name }}
+          name: ${{ matrix.asset }}
           path: |
-            ${{ matrix.asset_name }}.tar.gz
+            dist/${{ matrix.asset }}.tar.gz
-            ${{ matrix.asset_name }}.sha256
+            dist/${{ matrix.asset }}.sha256
 
-  docker-image:
+# ==========================
-    name: Docker ${{ matrix.platform }}
+# MUSL
-    needs: [prepare, build-binaries]
+# ==========================
+  build-musl:
+    name: MUSL ${{ matrix.target }}
     runs-on: ubuntu-latest
 
+    container:
+      image: rust:slim-bookworm
+
     strategy:
+      fail-fast: false
       matrix:
         include:
-          - platform: linux/amd64
+          - target: x86_64-unknown-linux-musl
-            artifact: telemt-x86_64-linux-gnu
+            asset: telemt-x86_64-linux-musl
-          - platform: linux/arm64
+          - target: aarch64-unknown-linux-musl
-            artifact: telemt-aarch64-linux-gnu
+            asset: telemt-aarch64-linux-musl
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install deps
+        run: |
+          apt-get update
+          apt-get install -y \
+            musl-tools \
+            pkg-config \
+            curl
+
+      - uses: actions/cache@v4
+        if: matrix.target == 'aarch64-unknown-linux-musl'
+        with:
+          path: ~/.musl-aarch64
+          key: musl-toolchain-aarch64-v1
+
+      - name: Install aarch64 musl toolchain
+        if: matrix.target == 'aarch64-unknown-linux-musl'
+        run: |
+          set -e
+
+          TOOLCHAIN_DIR="$HOME/.musl-aarch64"
+          ARCHIVE="aarch64-linux-musl-cross.tgz"
+          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
+
+          if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
+            echo "✅ MUSL toolchain already installed"
+          else
+            echo "⬇️ Downloading musl toolchain from Telemt GitHub Releases..."
+
+            curl -fL \
+              --retry 5 \
+              --retry-delay 3 \
+              --connect-timeout 10 \
+              --max-time 120 \
+              -o "$ARCHIVE" "$URL"
+
+            mkdir -p "$TOOLCHAIN_DIR"
+            tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"
+          fi
+
+          echo "$TOOLCHAIN_DIR/bin" >> $GITHUB_PATH
+
+      - name: Add rust target
+        run: rustup target add ${{ matrix.target }}
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            /usr/local/cargo/registry
+            /usr/local/cargo/git
+            target
+          key: musl-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Build
+        run: |
+          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
+            export CC=aarch64-linux-musl-gcc
+            export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
+            export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc"
+          else
+            export CC=musl-gcc
+            export CC_x86_64_unknown_linux_musl=musl-gcc
+            export RUSTFLAGS="-C target-feature=+crt-static"
+          fi
+
+          cargo build --release --target ${{ matrix.target }}
+
+      - name: Package
+        run: |
+          mkdir -p dist
+          BIN=target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}
+
+          cp "$BIN" dist/${{ env.BINARY_NAME }}-${{ matrix.target }}
+
+          cd dist
+          tar -czf ${{ matrix.asset }}.tar.gz ${{ env.BINARY_NAME }}-${{ matrix.target }}
+          sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset }}
+          path: |
+            dist/${{ matrix.asset }}.tar.gz
+            dist/${{ matrix.asset }}.sha256
+
+# ==========================
+# Docker
+# ==========================
+  docker:
+    name: Docker
+    runs-on: ubuntu-latest
+    needs: [build-gnu, build-musl]
+    continue-on-error: true
 
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/download-artifact@v4
         with:
-          name: ${{ matrix.artifact }}
+          path: artifacts
-          path: dist
 
-      - run: |
+      - name: Extract binaries
-          mkdir docker-build
+        run: |
-          tar -xzf dist/*.tar.gz -C docker-build --strip-components=1
+          mkdir dist
+          find artifacts -name "*.tar.gz" -exec tar -xzf {} -C dist \;
 
+          cp dist/telemt-x86_64-unknown-linux-musl dist/telemt || true
+
+      - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
 
-      - name: Login
+      - name: Login to GHCR
-        if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/build-push-action@v6
+      - name: Extract version
-        with:
+        id: vars
-          context: ./docker-build
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-          platforms: ${{ matrix.platform }}
-          push: ${{ needs.prepare.outputs.release_enabled == 'true' }}
-          tags: ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}
-          cache-from: type=gha,scope=telemt-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=telemt-${{ matrix.platform }}
-          provenance: false
-          sbom: false
 
+      - name: Build & Push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
+            ghcr.io/${{ github.repository }}:latest
+          build-args: |
+            BINARY=dist/telemt
+
+# ==========================
+# Release
+# ==========================
   release:
-    if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
+    name: Release
-    needs: [prepare, build-binaries]
     runs-on: ubuntu-latest
+    needs: [build-gnu, build-musl]
+
     permissions:
       contents: write
 
     steps:
       - uses: actions/download-artifact@v4
         with:
-          path: release-artifacts
+          path: artifacts
-          pattern: telemt-*
 
-      - run: |
+      - name: Flatten artifacts
-          mkdir upload
+        run: |
-          find release-artifacts -type f \( -name '*.tar.gz' -o -name '*.sha256' \) -exec cp {} upload/ \;
+          mkdir dist
+          find artifacts -type f -exec cp {} dist/ \;
 
-      - uses: softprops/action-gh-release@v2
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
         with:
-          files: upload/*
+          files: dist/*
           generate_release_notes: true
-          prerelease: ${{ needs.prepare.outputs.prerelease == 'true' }}
+          draft: false
+          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-beta') || contains(github.ref, '-alpha') }}

Dockerfile

@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 # ==========================
 # Stage 1: Build
 # ==========================
@@ -5,36 +7,87 @@ FROM rust:1.88-slim-bookworm AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
+    ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
+# Depcache
 COPY Cargo.toml Cargo.lock* ./
 RUN mkdir src && echo 'fn main() {}' > src/main.rs && \
     cargo build --release 2>/dev/null || true && \
     rm -rf src
 
+# Build
 COPY . .
 RUN cargo build --release && strip target/release/telemt
 
 # ==========================
-# Stage 2: Runtime
+# Stage 2: Compress (strip + UPX)
 # ==========================
-FROM debian:bookworm-slim
+FROM debian:12-slim AS minimal
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    upx \
+    binutils \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /build/target/release/telemt /telemt
+
+RUN strip /telemt || true
+RUN upx --best --lzma /telemt || true
+
+# ==========================
+# Stage 3: Debug base
+# ==========================
+FROM debian:12-slim AS debug-base
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
+    tzdata \
+    curl \
+    iproute2 \
+    busybox \
     && rm -rf /var/lib/apt/lists/*
 
-RUN useradd -r -s /usr/sbin/nologin telemt
+# ==========================
+# Stage 4: Debug image
+# ==========================
+FROM debug-base AS debug
 
 WORKDIR /app
 
-COPY --from=builder /build/target/release/telemt /app/telemt
+COPY --from=minimal /telemt /app/telemt
 COPY config.toml /app/config.toml
 
-RUN chown -R telemt:telemt /app
+USER root
-USER telemt
+
+EXPOSE 443
+EXPOSE 9090
+EXPOSE 9091
+
+ENTRYPOINT ["/app/telemt"]
+CMD ["config.toml"]
+
+# ==========================
+# Stage 5: Production (distroless)
+# ==========================
+FROM gcr.io/distroless/base-debian12 AS prod
+
+WORKDIR /app
+
+COPY --from=minimal /telemt /app/telemt
+COPY config.toml /app/config.toml
+
+# TLS + timezone + shell
+COPY --from=debug-base /etc/ssl/certs /etc/ssl/certs
+COPY --from=debug-base /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=debug-base /bin/busybox /bin/busybox
+
+RUN ["/bin/busybox", "--install", "-s", "/bin"]
+
+# distroless user
+USER nonroot:nonroot
 
 EXPOSE 443
 EXPOSE 9090