Repository navigation
Archive website (LFS + history cleanup) #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Archive website (pax + gzip + signify) | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' # Runs once a day at 00:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| openbsd-ci: | |
| runs-on: ubuntu-latest | |
| name: Run CI on OpenBSD VM | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_TOKEN }} | |
| SIGNIFY_KEY: ${{ secrets.SIGNIFY_KEY }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run OpenBSD VM | |
| id: openbsd | |
| uses: vmactions/openbsd-vm@v1 | |
| with: | |
| envs: 'GH_TOKEN SIGNIFY_KEY' | |
| usesh: true | |
| prepare: | | |
| pkg_add -I tree curl rsync git github-cli | |
| - name: Create Archive, Checksum, and Signature | |
| shell: openbsd {0} | |
| run: | | |
| set -e | |
| echo "Running on:" | |
| uname -a | |
| REPO_NAME=$(basename "$GITHUB_REPOSITORY") | |
| TMP_ARCHIVE_DIR=/tmp/archive | |
| mkdir -p "$TMP_ARCHIVE_DIR" | |
| ARCHIVE="$TMP_ARCHIVE_DIR/$REPO_NAME.tar.gz" | |
| CHECKSUM="$TMP_ARCHIVE_DIR/$REPO_NAME.tar.gz.sha256" | |
| SIGNATURE="$TMP_ARCHIVE_DIR/$REPO_NAME.tar.gz.sig" | |
| # Remove old files | |
| rm -f "$ARCHIVE" "$CHECKSUM" "$SIGNATURE" | |
| # Create tar.gz (exclude existing archive directory) | |
| pax -w -x tar . | gzip -n -9 > "$ARCHIVE" | |
| # Generate SHA256 checksum | |
| sha256 -q "$ARCHIVE" > "$CHECKSUM" | |
| # Write signify private key AS PLAIN TEXT (required by signify) | |
| printf "%s\n" "$SIGNIFY_KEY" > /root/archive.sec | |
| chmod 600 /root/archive.sec | |
| # Sign archive | |
| signify -S -s /root/archive.sec -m "$ARCHIVE" | |
| - name: Sync Archive Back | |
| shell: openbsd {0} | |
| run: | | |
| mkdir -p archive | |
| rsync -av --delete /tmp/archive/ archive/ | |
| - name: Commit and Push Changes | |
| shell: bash | |
| run: | | |
| set -e | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add archive/ | |
| git commit -m "Update archive from OpenBSD CI [skip ci]" || exit 0 | |
| gh auth login --with-token <<< "$GH_TOKEN" | |
| git push origin main |