Merge 4d83d02a8f into c4e7f54cbe

.github/workflows/release.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+.[0-9]+-*'
   workflow_dispatch:
 
 concurrency:
@@ -12,274 +13,341 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
 
 env:
   CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
   BINARY_NAME: telemt
 
 jobs:
-# ==========================
+  prepare:
-# GNU / glibc
+    name: Prepare metadata
-# ==========================
-  build-gnu:
-    name: GNU ${{ matrix.target }}
     runs-on: ubuntu-latest
-
+    outputs:
-    strategy:
+      version: ${{ steps.meta.outputs.version }}
-      fail-fast: false
+      prerelease: ${{ steps.meta.outputs.prerelease }}
-      matrix:
+      release_enabled: ${{ steps.meta.outputs.release_enabled }}
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset: telemt-x86_64-linux-gnu
-          - target: aarch64-unknown-linux-gnu
-            asset: telemt-aarch64-linux-gnu
-
     steps:
-      - uses: actions/checkout@v4
+      - name: Derive version
-
+        id: meta
-      - uses: dtolnay/rust-toolchain@v1
+        shell: bash
-        with:
-          toolchain: stable
-          targets: |
-            x86_64-unknown-linux-gnu
-            aarch64-unknown-linux-gnu
-
-      - name: Install deps
         run: |
-          sudo apt-get update
+          set -euo pipefail
-          sudo apt-get install -y \
-            build-essential \
-            clang \
-            lld \
-            pkg-config \
-            gcc-aarch64-linux-gnu \
-            g++-aarch64-linux-gnu
 
-      - uses: actions/cache@v4
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-        with:
+            VERSION="${GITHUB_REF#refs/tags/}"
-          path: |
+            RELEASE_ENABLED=true
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: gnu-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
-
-      - name: Build
-        run: |
-          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
-            export CC=aarch64-linux-gnu-gcc
-            export CXX=aarch64-linux-gnu-g++
-            export CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
-            export CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++
-            export RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc"
           else
-            export CC=clang
+            VERSION="manual-${GITHUB_SHA::7}"
-            export CXX=clang++
+            RELEASE_ENABLED=false
-            export CC_x86_64_unknown_linux_gnu=clang
-            export CXX_x86_64_unknown_linux_gnu=clang++
-            export RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=lld"
           fi
 
-          cargo build --release --target ${{ matrix.target }}
+          if [[ "$VERSION" == *"-alpha"* || "$VERSION" == *"-beta"* || "$VERSION" == *"-rc"* ]]; then
+            PRERELEASE=true
+          else
+            PRERELEASE=false
+          fi
 
-      - name: Package
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-        run: |
+          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
-          mkdir -p dist
+          echo "release_enabled=$RELEASE_ENABLED" >> "$GITHUB_OUTPUT"
-          BIN=target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}
 
-          cp "$BIN" dist/${{ env.BINARY_NAME }}-${{ matrix.target }}
+  checks:
-
+    name: Checks
-          cd dist
-          tar -czf ${{ matrix.asset }}.tar.gz ${{ env.BINARY_NAME }}-${{ matrix.target }}
-          sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.asset }}
-          path: |
-            dist/${{ matrix.asset }}.tar.gz
-            dist/${{ matrix.asset }}.sha256
-
-# ==========================
-# MUSL
-# ==========================
-  build-musl:
-    name: MUSL ${{ matrix.target }}
     runs-on: ubuntu-latest
-
     container:
-      image: rust:slim-bookworm
+      image: debian:trixie
+    steps:
+      - name: Install system dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            ca-certificates \
+            curl \
+            git \
+            build-essential \
+            pkg-config \
+            clang \
+            llvm \
+            python3 \
+            python3-pip
+          update-ca-certificates
 
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            /github/home/.cargo/registry
+            /github/home/.cargo/git
+            target
+          key: checks-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            checks-${{ runner.os }}-
+
+      - name: Cargo fetch
+        shell: bash
+        run: cargo fetch --locked
+
+      - name: Format
+        shell: bash
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        shell: bash
+        run: |
+             cargo clippy
+
+      - name: Tests
+        shell: bash
+        run: cargo test
+
+  build-binaries:
+    name: Build ${{ matrix.asset_name }}
+    needs: [prepare, checks]
+    runs-on: ubuntu-latest
+    container:
+      image: debian:trixie
     strategy:
       fail-fast: false
       matrix:
         include:
-          - target: x86_64-unknown-linux-musl
+          - rust_target: x86_64-unknown-linux-gnu
-            asset: telemt-x86_64-linux-musl
+            zig_target: x86_64-unknown-linux-gnu.2.28
-          - target: aarch64-unknown-linux-musl
+            asset_name: telemt-x86_64-linux-gnu
-            asset: telemt-aarch64-linux-musl
+          - rust_target: aarch64-unknown-linux-gnu
+            zig_target: aarch64-unknown-linux-gnu.2.28
+            asset_name: telemt-aarch64-linux-gnu
+          - rust_target: x86_64-unknown-linux-musl
+            zig_target: x86_64-unknown-linux-musl
+            asset_name: telemt-x86_64-linux-musl
+          - rust_target: aarch64-unknown-linux-musl
+            zig_target: aarch64-unknown-linux-musl
+            asset_name: telemt-aarch64-linux-musl
 
     steps:
+      - name: Install system dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            ca-certificates \
+            curl \
+            git \
+            build-essential \
+            pkg-config \
+            clang \
+            llvm \
+            file \
+            tar \
+            xz-utils \
+            python3 \
+            python3-pip
+          update-ca-certificates
+
       - uses: actions/checkout@v4
 
-      - name: Install deps
+      - uses: dtolnay/rust-toolchain@stable
-        run: |
-          apt-get update
-          apt-get install -y \
-            musl-tools \
-            pkg-config \
-            curl
-
-      - uses: actions/cache@v4
-        if: matrix.target == 'aarch64-unknown-linux-musl'
         with:
-          path: ~/.musl-aarch64
+          targets: ${{ matrix.rust_target }}
-          key: musl-toolchain-aarch64-v1
 
-      - name: Install aarch64 musl toolchain
+      - name: Cache cargo
-        if: matrix.target == 'aarch64-unknown-linux-musl'
+        uses: actions/cache@v4
-        run: |
-          set -e
-
-          TOOLCHAIN_DIR="$HOME/.musl-aarch64"
-          ARCHIVE="aarch64-linux-musl-cross.tgz"
-          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
-
-          if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
-            echo "✅ MUSL toolchain already installed"
-          else
-            echo "⬇️ Downloading musl toolchain from Telemt GitHub Releases..."
-
-            curl -fL \
-              --retry 5 \
-              --retry-delay 3 \
-              --connect-timeout 10 \
-              --max-time 120 \
-              -o "$ARCHIVE" "$URL"
-
-            mkdir -p "$TOOLCHAIN_DIR"
-            tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"
-          fi
-
-          echo "$TOOLCHAIN_DIR/bin" >> $GITHUB_PATH
-
-      - name: Add rust target
-        run: rustup target add ${{ matrix.target }}
-
-      - uses: actions/cache@v4
         with:
           path: |
-            /usr/local/cargo/registry
+            /github/home/.cargo/registry
-            /usr/local/cargo/git
+            /github/home/.cargo/git
             target
-          key: musl-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          key: build-${{ matrix.zig_target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            build-${{ matrix.zig_target }}-
 
-      - name: Build
+      - name: Install cargo-zigbuild + Zig
+        shell: bash
         run: |
-          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
+          set -euo pipefail
-            export CC=aarch64-linux-musl-gcc
+          python3 -m pip install --user --break-system-packages cargo-zigbuild
-            export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
+          echo "/github/home/.local/bin" >> "$GITHUB_PATH"
-            export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc"
-          else
-            export CC=musl-gcc
-            export CC_x86_64_unknown_linux_musl=musl-gcc
-            export RUSTFLAGS="-C target-feature=+crt-static"
-          fi
 
-          cargo build --release --target ${{ matrix.target }}
+      - name: Cargo fetch
+        shell: bash
+        run: cargo fetch --locked
+
+      - name: Build release
+        shell: bash
+        env:
+          CARGO_PROFILE_RELEASE_LTO: "fat"
+          CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
+          CARGO_PROFILE_RELEASE_PANIC: "abort"
+        run: |
+          set -euo pipefail
+          cargo zigbuild --release --locked --target "${{ matrix.zig_target }}"
+
+      - name: Strip binary
+        shell: bash
+        run: |
+          set -euo pipefail
+          llvm-strip "target/${{ matrix.zig_target }}/release/${BINARY_NAME}" || true
+
+      - name: Inspect binary
+        shell: bash
+        run: |
+          set -euo pipefail
+          file "target/${{ matrix.zig_target }}/release/${BINARY_NAME}"
 
       - name: Package
+        shell: bash
         run: |
+          set -euo pipefail
+
+          OUTDIR="$RUNNER_TEMP/pkg/${{ matrix.asset_name }}"
+          mkdir -p "$OUTDIR"
+
+          install -m 0755 "target/${{ matrix.zig_target }}/release/${BINARY_NAME}" "$OUTDIR/${BINARY_NAME}"
+
+          if [[ -f LICENSE ]]; then cp LICENSE "$OUTDIR/"; fi
+          if [[ -f README.md ]]; then cp README.md "$OUTDIR/"; fi
+
+          cat > "$OUTDIR/BUILD-INFO.txt" <<EOF
+          project=${GITHUB_REPOSITORY}
+          version=${{ needs.prepare.outputs.version }}
+          git_ref=${GITHUB_REF}
+          git_sha=${GITHUB_SHA}
+          rust_target=${{ matrix.rust_target }}
+          zig_target=${{ matrix.zig_target }}
+          built_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          EOF
+
           mkdir -p dist
-          BIN=target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}
+          tar -C "$RUNNER_TEMP/pkg" -czf "dist/${{ matrix.asset_name }}.tar.gz" "${{ matrix.asset_name }}"
-
+          sha256sum "dist/${{ matrix.asset_name }}.tar.gz" > "dist/${{ matrix.asset_name }}.sha256"
-          cp "$BIN" dist/${{ env.BINARY_NAME }}-${{ matrix.target }}
-
-          cd dist
-          tar -czf ${{ matrix.asset }}.tar.gz ${{ env.BINARY_NAME }}-${{ matrix.target }}
-          sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
 
       - uses: actions/upload-artifact@v4
         with:
-          name: ${{ matrix.asset }}
+          name: ${{ matrix.asset_name }}
           path: |
-            dist/${{ matrix.asset }}.tar.gz
+            dist/${{ matrix.asset_name }}.tar.gz
-            dist/${{ matrix.asset }}.sha256
+            dist/${{ matrix.asset_name }}.sha256
+          if-no-files-found: error
+          retention-days: 14
 
-# ==========================
+  attest-binaries:
-# Docker
+    name: Attest binary archives
-# ==========================
+    needs: build-binaries
-  docker:
-    name: Docker
     runs-on: ubuntu-latest
-    needs: [build-gnu, build-musl]
+    permissions:
-    continue-on-error: true
+      contents: read
-
+      attestations: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-
       - uses: actions/download-artifact@v4
         with:
-          path: artifacts
+          path: dist
 
-      - name: Extract binaries
+      - name: Flatten artifacts
+        shell: bash
         run: |
-          mkdir dist
+          set -euo pipefail
-          find artifacts -name "*.tar.gz" -exec tar -xzf {} -C dist \;
+          mkdir -p upload
+          find dist -type f \( -name '*.tar.gz' -o -name '*.sha256' \) -exec cp {} upload/ \;
+          ls -lah upload
 
-          cp dist/telemt-x86_64-unknown-linux-musl dist/telemt || true
+      - name: Attest release archives
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: 'upload/*.tar.gz'
 
-      - uses: docker/setup-qemu-action@v3
+  docker-image:
-      - uses: docker/setup-buildx-action@v3
+    name: Build and push GHCR image
+    needs: [prepare, checks]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
+        if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version
+      - name: Docker metadata
-        id: vars
+        id: meta
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=${{ needs.prepare.outputs.version }}
+            type=raw,value=latest,enable=${{ needs.prepare.outputs.prerelease != 'true' && needs.prepare.outputs.release_enabled == 'true' }}
+          labels: |
+            org.opencontainers.image.title=telemt
+            org.opencontainers.image.description=telemt
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
 
-      - name: Build & Push
+      - name: Build and push
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
-          push: true
+          file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
-          tags: |
+          push: ${{ needs.prepare.outputs.release_enabled == 'true' }}
-            ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
+          tags: ${{ steps.meta.outputs.tags }}
-            ghcr.io/${{ github.repository }}:latest
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: mode=max
+          sbom: true
           build-args: |
-            BINARY=dist/telemt
+            TELEMT_VERSION=${{ needs.prepare.outputs.version }}
+            VCS_REF=${{ github.sha }}
 
-# ==========================
-# Release
-# ==========================
   release:
-    name: Release
+    name: Create GitHub Release
+    if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
+    needs: [prepare, build-binaries, attest-binaries, docker-image]
     runs-on: ubuntu-latest
-    needs: [build-gnu, build-musl]
-
     permissions:
       contents: write
 
     steps:
       - uses: actions/download-artifact@v4
         with:
-          path: artifacts
+          path: release-artifacts
 
       - name: Flatten artifacts
+        shell: bash
         run: |
-          mkdir dist
+          set -euo pipefail
-          find artifacts -type f -exec cp {} dist/ \;
+          mkdir -p upload
+          find release-artifacts -type f \( -name '*.tar.gz' -o -name '*.sha256' \) -exec cp {} upload/ \;
+          ls -lah upload
 
-      - name: Create Release
+      - name: Create release
         uses: softprops/action-gh-release@v2
         with:
-          files: dist/*
+          files: upload/*
           generate_release_notes: true
           draft: false
-          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-beta') || contains(github.ref, '-alpha') }}
+          prerelease: ${{ needs.prepare.outputs.prerelease == 'true' }}

Dockerfile

@@ -1,5 +1,3 @@
-# syntax=docker/dockerfile:1
-
 # ==========================
 # Stage 1: Build
 # ==========================
@@ -7,87 +5,36 @@ FROM rust:1.88-slim-bookworm AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
-    ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
-# Depcache
 COPY Cargo.toml Cargo.lock* ./
 RUN mkdir src && echo 'fn main() {}' > src/main.rs && \
     cargo build --release 2>/dev/null || true && \
     rm -rf src
 
-# Build
 COPY . .
 RUN cargo build --release && strip target/release/telemt
 
 # ==========================
-# Stage 2: Compress (strip + UPX)
+# Stage 2: Runtime
 # ==========================
-FROM debian:12-slim AS minimal
+FROM debian:bookworm-slim
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    upx \
-    binutils \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /build/target/release/telemt /telemt
-
-RUN strip /telemt || true
-RUN upx --best --lzma /telemt || true
-
-# ==========================
-# Stage 3: Debug base
-# ==========================
-FROM debian:12-slim AS debug-base
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
-    tzdata \
-    curl \
-    iproute2 \
-    busybox \
     && rm -rf /var/lib/apt/lists/*
 
-# ==========================
+RUN useradd -r -s /usr/sbin/nologin telemt
-# Stage 4: Debug image
-# ==========================
-FROM debug-base AS debug
 
 WORKDIR /app
 
-COPY --from=minimal /telemt /app/telemt
+COPY --from=builder /build/target/release/telemt /app/telemt
 COPY config.toml /app/config.toml
 
-USER root
+RUN chown -R telemt:telemt /app
-
+USER telemt
-EXPOSE 443
-EXPOSE 9090
-EXPOSE 9091
-
-ENTRYPOINT ["/app/telemt"]
-CMD ["config.toml"]
-
-# ==========================
-# Stage 5: Production (distroless)
-# ==========================
-FROM gcr.io/distroless/base-debian12 AS prod
-
-WORKDIR /app
-
-COPY --from=minimal /telemt /app/telemt
-COPY config.toml /app/config.toml
-
-# TLS + timezone + shell
-COPY --from=debug-base /etc/ssl/certs /etc/ssl/certs
-COPY --from=debug-base /usr/share/zoneinfo /usr/share/zoneinfo
-COPY --from=debug-base /bin/busybox /bin/busybox
-
-RUN ["/bin/busybox", "--install", "-s", "/bin"]
-
-# distroless user
-USER nonroot:nonroot
 
 EXPOSE 443
 EXPOSE 9090