From 50faebaf88c1e6138d455cd0f654ceda20ded271 Mon Sep 17 00:00:00 2001 From: kjake Date: Thu, 13 Aug 2026 12:14:41 -0400 Subject: [PATCH 1/2] ci(build): add FreeBSD 15.1 and NetBSD 11.0 legs; bump OpenBSD to 7.9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Parameterize the vmactions `release` per matrix entry so one OS can build multiple versions, then: - FreeBSD: keep 14.3, add 15.1 -> cloudflared-freebsd15-amd64 (OPNsense 15) - NetBSD: keep 10.1, add 11.0 -> cloudflared-netbsd11-amd64 - OpenBSD: bump 7.8 -> 7.9 (asset name cloudflared-openbsd7-amd64 unchanged) Also set `fail-fast: false` so a new/older leg failing cannot cancel the proven ones mid-release. Verified before adding: vmactions ships conf/{15.1,11.0,7.9}.conf, and the package sets exist — NetBSD 11.0 pkgsrc has ruby34 + go-1.26.5, OpenBSD 7.9 has ruby-3.4 + go-1.26. --- .github/workflows/build_unix.yaml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build_unix.yaml b/.github/workflows/build_unix.yaml index dbee9cce631..ffd9ee85718 100644 --- a/.github/workflows/build_unix.yaml +++ b/.github/workflows/build_unix.yaml @@ -22,13 +22,28 @@ jobs: build: runs-on: ubuntu-latest strategy: + # Don't let one leg's failure cancel the others — a new/older OS version + # breaking must not stop the proven ones from building and uploading. + fail-fast: false matrix: include: + # FreeBSD: keep 14.x and track 15.x (OPNsense 25.7+ is FreeBSD 15). - os: freebsd + release: "14.3" assetName: cloudflared-freebsd14-amd64 + - os: freebsd + release: "15.1" + assetName: cloudflared-freebsd15-amd64 + # NetBSD: keep 10.x and add 11.0. - os: netbsd + release: "10.1" assetName: cloudflared-netbsd10-amd64 + - os: netbsd + release: "11.0" + assetName: cloudflared-netbsd11-amd64 + # OpenBSD: single latest release. - os: openbsd + release: "7.9" assetName: cloudflared-openbsd7-amd64 env: GOEXPERIMENT: "noboringcrypto" @@ -76,7 +91,7 @@ jobs: if: matrix.os == 'freebsd' uses: vmactions/freebsd-vm@v1 with: - release: "14.3" + release: "${{ matrix.release }}" envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN" usesh: true mem: 4096 @@ -117,7 +132,7 @@ jobs: if: matrix.os == 'netbsd' uses: vmactions/netbsd-vm@v1 with: - release: "10.1" + release: "${{ matrix.release }}" envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN" usesh: true mem: 4096 @@ -149,7 +164,7 @@ jobs: if: matrix.os == 'openbsd' uses: vmactions/openbsd-vm@v1 with: - release: "7.8" + release: "${{ matrix.release }}" envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN" usesh: true mem: 4096 From 9b18b3cddac895e55d676c548f0a0c6992087521 Mon Sep 17 00:00:00 2001 From: kjake Date: Thu, 13 Aug 2026 12:23:49 -0400 Subject: [PATCH 2/2] fix(build): drop unused ruby/fpm from OpenBSD prepare (7.9 defaults ruby 4.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenBSD 7.9 makes ruby 4.0 the default; `pkg_add ruby-34` fuzzy-resolved to ruby-4.0 (gem40, not gem34), so `gem34 install fpm` failed with exit 127. fpm is never used by the cloudflared build target (only `gmake cloudflared` runs), so remove the ruby/gem/libffi install entirely — eliminating the ruby-version-drift failure mode rather than chasing version pins. --- .github/workflows/build_unix.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_unix.yaml b/.github/workflows/build_unix.yaml index ffd9ee85718..0a997e5b096 100644 --- a/.github/workflows/build_unix.yaml +++ b/.github/workflows/build_unix.yaml @@ -169,8 +169,12 @@ jobs: usesh: true mem: 4096 prepare: | - pkg_add -xaz gmake sudo-- bash git go curl wget libffi ruby-34 - gem34 install fpm + # cloudflared's build target only runs `gmake cloudflared` and never + # invokes fpm, so ruby/gem are intentionally omitted. On OpenBSD 7.9 + # ruby 4.0 became the default and `pkg_add ruby-34` fuzzy-matched to + # ruby-4.0 (which ships gem40, not gem34), breaking the leg; dropping + # the unused ruby/fpm install removes that version-drift failure mode. + pkg_add -xaz gmake sudo-- bash git go curl wget git config --global --add safe.directory /home/runner/work/cloudflared/cloudflared run: | # Do NOT run `go mod tidy` here — it sees only the current GOOS's