diff --git a/.github/workflows/build-native-packages.yml b/.github/workflows/build-native-packages.yml index 8ad11bd92..9c7442aa1 100644 --- a/.github/workflows/build-native-packages.yml +++ b/.github/workflows/build-native-packages.yml @@ -100,83 +100,9 @@ jobs: REMOTE_USER: ${{ secrets.ZMREPO_SSH_USER }} TARGET: debian/master/mini-dinstall/incoming/ - build-rpm: - name: Build & sign .rpm (${{ matrix.distro }}) - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - distro: ["rockylinux:9", "fedora:40"] - container: - image: ${{ matrix.distro }} - steps: - - name: Install build tools - run: | - set -eux - if command -v dnf >/dev/null; then PM=dnf; else PM=yum; fi - $PM -y install git rpm-build make gcc gcc-c++ cmake pkgconfig \ - ccache which redhat-rpm-config gnupg2 rpm-sign - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: Import GPG key (RPM) - run: | - set -eux - mkdir -p ~/.gnupg - chmod 700 ~/.gnupg - echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf - echo "$GPG_PRIVATE_KEY_B64" | base64 -d > /tmp/priv.asc - gpg --batch --import /tmp/priv.asc - gpg --batch --yes --edit-key "$GPG_KEY_ID" trust quit <<< "5\ny" - gpg --batch --armor --export "$GPG_KEY_ID" > public.asc - printf '%%_signature gpg\n' >> ~/.rpmmacros - printf '%%_gpg_name %s\n' "$GPG_KEY_ID" >> ~/.rpmmacros - # custom sign cmd with loopback pinentry; rpmsign passes files via macros - cat >> ~/.rpmmacros <<'EOF' -%__gpg /usr/bin/gpg -%__gpg_sign_cmd %{__gpg} gpg --batch --no-verbose --no-armor --pinentry-mode loopback --passphrase %{?__gpg_passphrase} -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename} -EOF - - name: Prepare rpmbuild tree & source - run: | - set -eux - mkdir -p rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} - VERSION="${GITHUB_REF_NAME:-dev}" - git archive --format=tar --prefix=zoneminder-${VERSION}/ HEAD | gzip -9 > rpmbuild/SOURCES/zoneminder-${VERSION}.tar.gz - cp packaging/zoneminder.spec rpmbuild/SPECS/zoneminder.spec - - name: Install BuildRequires - run: | - set -eux - if command -v dnf >/dev/null; then PM=dnf; else PM=yum; fi - $PM -y builddep rpmbuild/SPECS/zoneminder.spec || true - - name: Build RPMs - run: | - set -eux - rpmbuild -ba rpmbuild/SPECS/zoneminder.spec \ - --define "_topdir $(pwd)/rpmbuild" \ - --define "version ${GITHUB_REF_NAME:-dev}" - - name: Sign RPMs - env: - __gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }} - run: | - set -eux - find rpmbuild/RPMS -name "*.rpm" -print0 | xargs -0 -n1 -I{} rpmsign --addsign {} - # quick verify (non-fatal if gpg keyring missing pub) - rpm -Kv rpmbuild/RPMS/*/*.rpm || true - - name: Collect .rpm artifacts (incl. public key) - run: | - set -eux - mkdir -p artifacts/rpm - find rpmbuild/RPMS -name "*.rpm" -exec cp -v {} artifacts/rpm/ \; - cp -v public.asc artifacts/rpm/ - - name: Upload .rpm artifacts - uses: actions/upload-artifact@v4 - with: - name: rpm-${{ matrix.distro }} - path: artifacts/rpm release: name: Create GitHub Release (on tag) - needs: [build-debian, build-rpm] + needs: build-debian if: startsWith(github.ref, 'refs/tags/') runs-on: ubuntu-latest steps: