馃Ι Update: Flamingo Code Review (#66) #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSQuery Release | |
| permissions: | |
| contents: write | |
| packages: write | |
| actions: write | |
| pull-requests: write | |
| attestations: write | |
| id-token: write | |
| on: | |
| push: | |
| branches: [master] | |
| paths-ignore: | |
| - "**/*.md" | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Version to Release (e.g., v1.2.3)" | |
| required: true | |
| type: string | |
| env: | |
| REGISTRY: "ghcr.io" | |
| ORGANISATION: ${{ github.repository_owner }} | |
| REPOSITORY: ${{ github.event.repository.name }} | |
| CMAKE_OSX_DEPLOYMENT_TARGET: "10.15" | |
| CMAKE_BUILD_TYPE: Release | |
| BINARY_NAME: osqueryd | |
| # ============================================================================= | |
| # JOBS | |
| # ============================================================================= | |
| jobs: | |
| # cmake needs 3 semver components and no leading "v" | |
| version: | |
| name: "Resolve Version" | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.resolve.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Resolve version | |
| id: resolve | |
| env: | |
| INPUT_VERSION: ${{ inputs.version }} | |
| run: | | |
| set -euo pipefail | |
| v="${INPUT_VERSION:-}" | |
| [ -n "$v" ] || v="$(git describe --tags --abbrev=0 2>/dev/null || true)" | |
| v="${v#v}" | |
| case "$v" in | |
| [0-9]*.[0-9]*.[0-9]*) ;; | |
| *) echo "::warning::Unusable version '$v'; falling back to 0.0.0" ; v="0.0.0" ;; | |
| esac | |
| echo "Resolved version: $v" | |
| echo "version=$v" >> "$GITHUB_OUTPUT" | |
| build_macos: | |
| name: "Build C Client for (${{ matrix.os }} ${{ matrix.os_arch }})" | |
| runs-on: ${{ matrix.os }} | |
| needs: [version] | |
| if: | | |
| github.event_name == 'push' || | |
| github.event_name == 'workflow_dispatch' | |
| defaults: | |
| run: | |
| shell: bash | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: "macOS x86-64" | |
| os: macos-15-intel | |
| os_arch: x86-64 | |
| cmake_arch: x86_64 | |
| artifact_name: osquery-macos-x64 | |
| - name: "macOS ARM64" | |
| os: macos-15 # pinned: Xcode 26 on macos-latest fails to compile boost mpl | |
| os_arch: arm64 | |
| cmake_arch: arm64 | |
| artifact_name: osquery-macos-arm64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install Xcode Command Line Tools | |
| shell: bash | |
| run: | | |
| # Install Xcode if not already installed | |
| if ! xcode-select -p >/dev/null 2>&1; then | |
| echo "Installing Xcode Command Line Tools..." | |
| xcode-select --install | |
| # Wait for installation to complete | |
| while ! xcode-select -p >/dev/null 2>&1; do | |
| echo "Waiting for Xcode Command Line Tools installation..." | |
| sleep 10 | |
| done | |
| fi | |
| - name: Install macOS Dependencies | |
| run: brew install ccache git git-lfs cmake python clang-format flex bison cppcheck | |
| shell: bash | |
| # ccache 4.x defaults to ~/Library/Caches/ccache on macOS | |
| - name: Configure ccache | |
| run: | | |
| echo "CCACHE_DIR=$HOME/.ccache" >> $GITHUB_ENV | |
| echo "CCACHE_MAXSIZE=2G" >> $GITHUB_ENV | |
| echo "CCACHE_COMPRESS=1" >> $GITHUB_ENV | |
| - name: Cache ccache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.ccache | |
| key: ${{ runner.os }}-${{ matrix.os_arch }}-ccache-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ matrix.os_arch }}-ccache- | |
| - name: Setup Build Environment | |
| run: | | |
| echo "Setting up build environment for ${{ matrix.os_arch }}..." | |
| export SDKROOT=$(xcrun --show-sdk-path) | |
| export CFLAGS="-isysroot $SDKROOT" | |
| export CXXFLAGS="-isysroot $SDKROOT" | |
| echo "SDKROOT=$SDKROOT" >> $GITHUB_ENV | |
| echo "CFLAGS=-isysroot $SDKROOT" >> $GITHUB_ENV | |
| echo "CXXFLAGS=-isysroot $SDKROOT" >> $GITHUB_ENV | |
| - name: Configure CMake | |
| run: | | |
| echo "Creating build directory and configuring..." | |
| mkdir -p build && cd build | |
| cmake \ | |
| -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ env.CMAKE_OSX_DEPLOYMENT_TARGET }} \ | |
| -DCMAKE_BUILD_TYPE=${{ env.CMAKE_BUILD_TYPE }} \ | |
| -DCMAKE_C_COMPILER=clang \ | |
| -DCMAKE_CXX_COMPILER=clang++ \ | |
| -DCMAKE_OSX_SYSROOT=$SDKROOT \ | |
| -DCMAKE_OSX_ARCHITECTURES=${{ matrix.cmake_arch }} \ | |
| -DOSQUERY_VERSION="${{ needs.version.outputs.version }}" \ | |
| .. | |
| echo "CMake configuration completed" | |
| - name: Build Project | |
| run: | | |
| echo "Starting build for ${{ matrix.os_arch }}..." | |
| cd build | |
| CPU_COUNT=$(sysctl -n hw.ncpu) | |
| echo "Building with $CPU_COUNT parallel jobs" | |
| time cmake --build . -j $CPU_COUNT | |
| echo "Build completed successfully" | |
| - name: ccache statistics | |
| if: always() | |
| run: ccache --show-stats | |
| - name: Upload client artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.artifact_name }} | |
| path: build/osquery/${{ env.BINARY_NAME }} | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| compression-level: 9 | |
| create_universal_macos: | |
| name: "Create Universal macOS Binary" | |
| needs: [build_macos] | |
| runs-on: macos-latest | |
| if: | | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && | |
| !failure() && !cancelled() | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Download macOS x86-64 Binary | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: osquery-macos-x64 | |
| path: x64-artifacts/ | |
| - name: Download macOS ARM64 Binary | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: osquery-macos-arm64 | |
| path: arm64-artifacts/ | |
| - name: Create Universal Binary | |
| run: | | |
| echo "Creating universal macOS binary..." | |
| X64_BINARY="x64-artifacts/${{ env.BINARY_NAME }}" | |
| ARM64_BINARY="arm64-artifacts/${{ env.BINARY_NAME }}" | |
| echo "Creating universal binary with lipo..." | |
| mkdir -p artifacts | |
| lipo -create "$X64_BINARY" "$ARM64_BINARY" -output ./artifacts/${{ env.BINARY_NAME }} | |
| # Verify universal binary | |
| echo "Universal binary info:" | |
| lipo -info ./artifacts/${{ env.BINARY_NAME }} | |
| file ./artifacts/${{ env.BINARY_NAME }} | |
| - name: Sign MacOS package | |
| uses: ./.github/steps/sign-macos-package | |
| with: | |
| apple_certificate_p12: ${{ secrets.APPLE_CERTIFICATE_P12 }} | |
| apple_certificate_password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| apple_developer_id: ${{ secrets.APPLE_DEVELOPER_ID }} | |
| apple_id_username: ${{ secrets.APPLE_ID_USERNAME }} | |
| apple_id_password: ${{ secrets.APPLE_ID_PASSWORD }} | |
| apple_team_id: ${{ secrets.APPLE_TEAM_ID }} | |
| binary_name: ${{ env.BINARY_NAME }} | |
| - name: Upload Universal Binary | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: osquery-mac-universal | |
| path: artifacts/ | |
| retention-days: 30 | |
| compression-level: 9 | |
| build_windows: | |
| name: "Build C Client for (${{ matrix.os }} ${{ matrix.os_arch }})" | |
| runs-on: ${{ matrix.os }} | |
| needs: [version] | |
| if: | | |
| github.event_name == 'push' || | |
| github.event_name == 'workflow_dispatch' | |
| defaults: | |
| run: | |
| shell: cmd | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: "Windows x64" | |
| os: windows-2022 # pinned: windows-latest is VS 2026; generator below needs VS 17 | |
| os_arch: x64 | |
| artifact_name: osquery-windows-amd64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Setup MSBuild | |
| uses: microsoft/setup-msbuild@v2 | |
| - name: Setup Visual Studio Build Tools | |
| uses: ilammy/msvc-dev-cmd@v1 | |
| with: | |
| arch: ${{ matrix.os_arch }} | |
| - name: Configure CMake for ${{ matrix.os }} | |
| run: | | |
| mkdir build | |
| cd build | |
| cmake -G "Visual Studio 17 2022" -A ${{ matrix.os_arch }} -DOSQUERY_VERSION="${{ needs.version.outputs.version }}" .. | |
| - name: Build OSQuery for Windows ${{ matrix.os_arch }} with MSBuild | |
| run: | | |
| cd build | |
| cmake --build . --config RelWithDebInfo -j10 | |
| - name: Sign Windows package | |
| uses: ./.github/steps/sign-windows-package | |
| with: | |
| azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure_client_id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| signing_endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }} | |
| code_signing_account_name: ${{ secrets.AZURE_CODE_SIGNING_ACCOUNT_NAME }} | |
| certificate_profile_name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }} | |
| binary_path: build/osquery/RelWithDebInfo/${{ env.BINARY_NAME }}.exe | |
| - name: Upload Windows OSQuery artifact | |
| if: runner.os == 'Windows' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.artifact_name }} | |
| path: "build/osquery/RelWithDebInfo/${{ env.BINARY_NAME }}.exe" | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| compression-level: 9 | |
| release: | |
| name: "Create Release" | |
| needs: [build_macos, create_universal_macos, build_windows] | |
| runs-on: ubuntu-latest | |
| if: | | |
| github.event_name == 'workflow_dispatch' && | |
| inputs.version != '' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: release-artifacts | |
| - name: Prepare release artifacts | |
| run: | | |
| set -e | |
| mkdir -p final-artifacts/clients | |
| # macOS | |
| if [ -d "release-artifacts/osquery-mac-universal" ]; then | |
| tar -czf "final-artifacts/clients/osquery-macos-universal.tar.gz" \ | |
| -C "release-artifacts/osquery-mac-universal" ${{ env.BINARY_NAME }} | |
| fi | |
| # Windows | |
| if [ -d "release-artifacts/osquery-windows-amd64" ]; then | |
| (cd "release-artifacts/osquery-windows-amd64" && \ | |
| zip "${GITHUB_WORKSPACE}/final-artifacts/clients/osquery-windows-amd64.zip" ${{ env.BINARY_NAME }}.exe) | |
| fi | |
| MISSING="" | |
| [ -f "final-artifacts/clients/osquery-macos-universal.tar.gz" ] || MISSING="$MISSING macOS" | |
| [ -f "final-artifacts/clients/osquery-windows-amd64.zip" ] || MISSING="$MISSING Windows" | |
| if [ -n "$MISSING" ]; then | |
| echo "::error::Missing release artifacts:$MISSING" | |
| exit 1 | |
| fi | |
| ls -lh final-artifacts/clients/ | |
| - name: Generate release header | |
| run: | | |
| cat > RELEASE_HEADER.md <<EOF | |
| ## OSQuery Clients | |
| - **macOS** (Universal): \`osquery-macos-universal.tar.gz\` | |
| - **Windows** (amd64): \`osquery-windows-amd64.zip\` | |
| EOF | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ inputs.version }} | |
| name: "馃Ι ${{ inputs.version }}" | |
| draft: false | |
| prerelease: false | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| body_path: RELEASE_HEADER.md | |
| files: | | |
| final-artifacts/clients/* |