Diff options
| -rw-r--r-- | .gitattributes | 2 | |
| -rw-r--r-- | .github/workflows/ci.yml | 107 | |
| -rw-r--r-- | .github/workflows/release.yml | 52 | |
| -rw-r--r-- | Makefile | 23 |
4 files changed, 1 insertion, 183 deletions
diff --git a/.gitattributes b/.gitattributes index 50da209..e13769c 100644 --- a/.gitattributes +++ b/.gitattributes @@ -13,5 +13,3 @@ Makefile text eol=lf .gitignore export-ignore .gitattributes export-ignore - -.github/ export-ignore diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 7764ac2..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,107 +0,0 @@ -name: ci - -on: - push: - branches: - - '**' - workflow_dispatch: - -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -jobs: - build-and-test: - runs-on: ubuntu-24.04 - strategy: - fail-fast: false - matrix: - cc: [gcc, clang] - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential clang zlib1g-dev gettext libtool - # CC is passed on the command line because git's Makefile hard-assigns - # CC = cc, which would override it as an environment variable. - - name: Build - run: make NO_LUA=1 CC=${{ matrix.cc }} - - name: Run the test suite - # The submodule is pinned by SHA without its release tag, so skip the - # test that runs `git describe` inside it. - run: make NO_LUA=1 CC=${{ matrix.cc }} test - env: - CGIT_TEST_NO_GIT_VERSION: YesPlease - - lua: - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential zlib1g-dev gettext libtool libluajit-5.1-dev - # A plain build auto-detects luajit and links the lua: filter backend. - - name: Build with Lua - run: make - - name: Confirm Lua is compiled in - run: ./build/cgit --version | grep -F '[+] Lua scripting' - - name: Run the test suite - run: make test - env: - CGIT_TEST_NO_GIT_VERSION: YesPlease - - sanitizers: - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential zlib1g-dev gettext libtool - # Runs the test suite against a cgit built with AddressSanitizer and - # UndefinedBehaviorSanitizer. Leak detection is off because cgit is a - # short-lived CGI that leaves cleanup to process exit. - - name: Run the test suite under ASan and UBSan - run: make NO_LUA=1 SANITIZE=address,undefined test - env: - CGIT_TEST_NO_GIT_VERSION: YesPlease - ASAN_OPTIONS: abort_on_error=1:detect_leaks=0 - UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1 - - sparse: - runs-on: ubuntu-24.04 - # Static analysis. Non-blocking, since sparse is noisy on a large codebase. - continue-on-error: true - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential zlib1g-dev gettext libtool sparse - - name: Static-check the cgit sources with sparse - run: make NO_LUA=1 sparse - - hardened-build: - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential zlib1g-dev gettext libtool - - name: Build with release hardening flags - run: ./tools/release-build.sh - - name: Confirm the binary is position independent - run: file build/cgit | grep -q 'pie executable' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 994e8eb..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: release - -on: - push: - tags: - - 'v*' - -# Needed to create the draft release. -permissions: - contents: write - -jobs: - draft-release: - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - # Tags let git describe stamp the exact release version into - # the binary rather than the Makefile fallback. - fetch-tags: true - fetch-depth: 0 - - name: Install build dependencies - run: | - sudo apt-get update - sudo apt-get install -y build-essential zlib1g-dev gettext libtool libluajit-5.1-dev - # Build two hardened variants: a self-contained one with no Lua, and one - # that links the lua: filter backend. Each is packaged with a checksum. - - name: Build and package both variants - run: | - package() { # $1 = release-build.sh arg, $2 = tarball suffix - ./tools/release-build.sh $1 - dist="cgit-${GITHUB_REF_NAME}${2}" - make dist DIST_NAME="$dist" - mv "build/${dist}.tar.gz" . - sha256sum "${dist}.tar.gz" > "${dist}.tar.gz.sha256" - } - package "" "" - package "lua" "-lua" - # Creates a DRAFT release only. Review and publish it by hand. - - name: Create draft release - env: - GH_TOKEN: ${{ github.token }} - run: | - gh release create "${GITHUB_REF_NAME}" \ - --draft \ - --title "cgit ${GITHUB_REF_NAME}" \ - --generate-notes \ - "cgit-${GITHUB_REF_NAME}.tar.gz" \ - "cgit-${GITHUB_REF_NAME}.tar.gz.sha256" \ - "cgit-${GITHUB_REF_NAME}-lua.tar.gz" \ - "cgit-${GITHUB_REF_NAME}-lua.tar.gz.sha256" @@ -43,13 +43,6 @@ mandir = $(prefix)/share/man ASSETS = cgit.css cgit.js cgit.png favicon.ico robots.txt FILTER_FILES = $(notdir $(wildcard $(EXTDIR)/*.lua)) -# Extra files and whole trees the dist target bundles into the release tarball, -# alongside the binary and the assets above. -DIST_DOCS = cgitrc.5.txt README.txt LICENSE.txt AUTHORS -DIST_TREES = custom -DIST_NAME = cgit-$(CGIT_VERSION) -DIST_DIR = $(BUILDDIR)/$(DIST_NAME) - # The man-page source (*.5.txt) sits at the project root and is rendered into # build/. Only one man section exists, so DOC_* derive straight from MAN5_TXT. MAN5_TXT = $(wildcard *.5.txt) @@ -57,7 +50,6 @@ DOC_MAN5 = $(patsubst %.txt,$(BUILDDIR)/%,$(MAN5_TXT)) DOC_HTML = $(patsubst %.txt,$(BUILDDIR)/%.html,$(MAN5_TXT)) INSTALL = install -COPYTREE = cp -r ASCIIDOC = asciidoc ASCIIDOC_EXTRA = ASCIIDOC_HTML = xhtml11 @@ -138,19 +130,6 @@ uninstall-html: rm -fv $(DESTDIR)$(htmldir)/$$i; \ done -# Stage a release tarball under build/ from an already-built binary. It has no -# `all` prerequisite on purpose, so tools/release-build.sh keeps ownership of -# the hardening flags rather than triggering a plain rebuild here. -dist: - @test -f $(BUILDDIR)/cgit || { echo 'build/cgit missing, run make first' >&2; exit 1; } - $(RM) -r $(DIST_DIR) - $(INSTALL) -m 0755 -d $(DIST_DIR) - $(INSTALL) -m 0755 $(BUILDDIR)/cgit $(DIST_DIR)/$(CGIT_SCRIPT_NAME) - $(INSTALL) -m 0644 $(addprefix $(ASSETDIR)/,$(ASSETS)) $(DIST_DIR) - $(INSTALL) -m 0644 $(DIST_DOCS) $(DIST_DIR) - $(COPYTREE) $(DIST_TREES) $(DIST_DIR) - tar czf $(DIST_DIR).tar.gz -C $(BUILDDIR) $(DIST_NAME) - # Compiled output lives under build/; the test suite writes into tests/, so # cleaning removes both. The tests descent is guarded because tests/Makefile # includes git's config.mak.uname, which needs the submodule present. @@ -175,4 +154,4 @@ tags: .PHONY: doc doc-man doc-html .PHONY: install install-doc install-man install-html .PHONY: uninstall uninstall-doc uninstall-man uninstall-html -.PHONY: dist clean cleanall get-git tags +.PHONY: clean cleanall get-git tags |