loop-uh
bfdb1ee274
Симптом: ci.yml красный (запуск 287, patch failed:
proxy/vless/inbound/inbound.go:597), наблюдатель шлёт patch_ci
«патчи не накладываются на свежий XTLS».
Первопричина: ci.yml брал исходник из ручного закрепа upstream.env
(v26.7.28, Go 1.26), а candidate.yml — из discover по официальному Atom.
В 000c6e8 патчи адаптированы под v26.9.30 и выпущены как
v26.9.30-vpnbot.1, но закреп не подняли: CI проверял новые патчи на старом
исходнике. Поезд выпусков при этом здоров — discover сейчас даёт
upstream=v26.9.30, action=noop. Сломанное правило: «какой официальный
исходник проверяет CI» имело два владельца.
Исправление: ci.yml резолвит исходник тем же
release_pipeline.py discover, передаёт candidate.env в test-patches.sh и
build-release.sh через VPNBOT_BUILD_ENV_FILE и берёт версию Go из
go.mod тега, а не жёсткую "1.26". upstream.env (ручная сборка) поднят до
значений манифеста proven v26.9.30-vpnbot.1.
Тест: оба workflow берут исходник и Go из discover и передают
candidate.env обоим сборочным шагам; на прежнем ci.yml тест падает.
Локально: test-patches.sh с discovered env на v26.9.30 зелёный.
Claude-Session: b2684b34-a663-486d-a69e-4d3543ea2650
82 lines
3 KiB
YAML
82 lines
3 KiB
YAML
name: Test and build VPnBot Xray patches
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test-and-build:
|
|
runs-on: linux
|
|
timeout-minutes: 90
|
|
steps:
|
|
- name: Checkout the patch repository
|
|
uses: https://data.forgejo.org/actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install packaging tools
|
|
run: |
|
|
set -euo pipefail
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends ca-certificates curl git openssl python3 unzip zip
|
|
|
|
# The same discovery as candidate.yml owns the official source: CI tests
|
|
# the patches against the release the train will build, not a manual pin.
|
|
- name: Resolve the newest official Xray release
|
|
id: discover
|
|
run: |
|
|
set -euo pipefail
|
|
python3 scripts/release_pipeline.py discover \
|
|
--forgejo-releases-url "${FORGEJO_API_URL}/repos/${FORGEJO_REPOSITORY}/releases" \
|
|
--output-env candidate.env \
|
|
--output-metadata candidate-metadata.json
|
|
set -a
|
|
source candidate.env
|
|
set +a
|
|
printf 'go_version=%s\n' "$GO_VERSION" >> "$FORGEJO_OUTPUT"
|
|
|
|
- name: Set up the Go version required by official Xray
|
|
uses: https://data.forgejo.org/actions/setup-go@v6
|
|
with:
|
|
go-version: ${{ steps.discover.outputs.go_version }}
|
|
cache: false
|
|
|
|
- name: Validate the repository boundary
|
|
run: |
|
|
set -euo pipefail
|
|
git diff --check -- . ':!patches/*.patch'
|
|
bash -n scripts/prepare-source.sh scripts/test-patches.sh scripts/build-release.sh scripts/install_promoter.sh
|
|
python3 -m py_compile scripts/release_pipeline.py scripts/canary_active_revoke.py scripts/pilot_and_promote.py scripts/release_alert_monitor.py
|
|
python3 -m unittest discover -s tests -p 'test_*.py'
|
|
test "$(find patches -maxdepth 1 -type f -name '*.patch' | wc -l)" -eq 3
|
|
if git grep -n -I -E -- 'git\.zapret\.moe/.+Xray-core|github\.com/(youtubediscord|zapretdiscordyoutube)/Xray-core'; then
|
|
echo 'A retired full Xray fork is referenced' >&2
|
|
exit 1
|
|
fi
|
|
if git grep -n -I -E -- 'api\.github\.com|raw\.githubusercontent\.com' -- scripts/release_pipeline.py; then
|
|
echo 'Release discovery must use the official Atom feed and Git tag, not GitHub API/raw endpoints' >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Apply and test the patches on official XTLS source
|
|
env:
|
|
VPNBOT_BUILD_ENV_FILE: candidate.env
|
|
run: scripts/test-patches.sh
|
|
|
|
- name: Build Linux release archives
|
|
env:
|
|
VPNBOT_BUILD_ENV_FILE: candidate.env
|
|
run: scripts/build-release.sh release-assets
|
|
|
|
- name: Upload the exact release candidates
|
|
uses: https://data.forgejo.org/forgejo/upload-artifact@v4
|
|
with:
|
|
name: vpnbot-xray-linux
|
|
path: release-assets/
|
|
retention-days: 7
|