Build native CLI archives for Apple Silicon, Linux, and Windows, attest and checksum them, publish release guidance, and update the Homebrew tap through a scoped deploy key.
- commit
- 69b16d6b17494cf1ebb71aa521c8924f079ec899
- parent
- d50238a08566a1efe66eccaae4086dc1e423616f
- author
- Dami <dami.etoile@gmail.com>
| A | .github/ | 30 | ++++ |
| A | .github/ | 60 | ++++++++ |
| A | .github/ | 212 | ++++++++++++++++++++++++++++++ |
| M | README.md | 5 | +- |
@@ -0,0 +1,30 @@
1+class Devsite < Formula2+ desc "Share public work and reach local TCP services"3+ homepage "https://dev.site"4+ url "https://github.com/FelineStateMachine/devsite/releases/download/v@VERSION@/devsite-v@VERSION@-aarch64-apple-darwin.tar.gz"5+ version "@VERSION@"6+ sha256 "@SHA256@"7+ license "Apache-2.0"8+9+ depends_on :macos10+ depends_on arch: :arm6411+12+ def install13+ bin.install "devsite"14+ end15+16+ service do17+ run [opt_bin/"devsite", "daemon", "run"]18+ keep_alive true19+ log_path var/"log/devsite.log"20+ error_log_path var/"log/devsite.log"21+ end22+23+ test do24+ assert_match(/^devsite \d+\.\d+\.\d+$/, shell_output("#{bin}/devsite --version").strip)25+ assert_match "status", shell_output("#{bin}/devsite daemon --help")26+ output = shell_output("DEVSITE_HOME=#{testpath}/home #{bin}/devsite --json status")27+ assert_match '"command":"status"', output28+ assert_match '"ok":true', output29+ end30+end@@ -0,0 +1,60 @@
1+dev.site puts links and private TCP services on one developer profile. Services stay on2+the machines that own them, and approved users connect through capability-gated,3+end-to-end encrypted Iroh QUIC. The dev.site control plane never carries service bytes.4+5+## install6+7+macOS users should install with Homebrew:8+9+```sh10+brew install FelineStateMachine/tap/devsite11+```12+13+Linux and Windows users can download the matching archive below. The Apple Silicon archive14+is also provided for direct installation.15+16+| archive target | system |17+| --- | --- |18+| `aarch64-apple-darwin` | Apple Silicon macOS |19+| `x86_64-unknown-linux-gnu` | x86-64 Linux |20+| `aarch64-unknown-linux-gnu` | ARM64 Linux |21+| `x86_64-pc-windows-msvc` | x86-64 Windows |22+23+Each archive contains the `devsite` CLI, README, and Apache-2.0 license. `SHA256SUMS`24+contains checksums for every archive.25+26+On Linux, extract the archive and put `devsite` somewhere on `PATH`:27+28+```sh29+tar -xzf devsite-*-linux-gnu.tar.gz30+sudo install -m 0755 devsite-*-linux-gnu/devsite /usr/local/bin/devsite31+```32+33+On Windows, extract the `.zip` and put the directory containing `devsite.exe` on `PATH`.34+35+## first service36+37+Sign in at [dev.site](https://dev.site), create a machine credential on the dashboard,38+then run:39+40+```sh41+devsite login dsm_...42+devsite service host 5432 --name postgres43+devsite daemon run44+```45+46+An approved user can open the service on dev.site, get a one-use ticket, and connect with:47+48+```sh49+devsite connect dst_...50+```51+52+The daemon is a portable foreground process. Homebrew can supervise it on macOS, systemd53+can supervise it on Linux, and any service manager can keep `devsite daemon run` alive.54+55+## verify a download56+57+```sh58+sha256sum --check SHA256SUMS59+gh attestation verify <archive> --repo FelineStateMachine/devsite60+```@@ -0,0 +1,212 @@
1+name: Release2+3+on:4+ push:5+ tags:6+ - "v*.*.*"7+8+permissions:9+ contents: read10+11+jobs:12+ validate:13+ name: Validate tag14+ runs-on: ubuntu-24.0415+ steps:16+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.117+18+ - name: Match tag to workspace version19+ shell: bash20+ run: |21+ if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then22+ echo "expected a release tag like v0.2.0, got $GITHUB_REF_NAME" >&223+ exit 124+ fi25+26+ tag_version="${GITHUB_REF_NAME#v}"27+ workspace_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)"28+ if [[ "$tag_version" != "$workspace_version" ]]; then29+ echo "tag $GITHUB_REF_NAME does not match workspace version $workspace_version" >&230+ exit 131+ fi32+33+ test:34+ name: Test workspace35+ needs: validate36+ runs-on: ubuntu-24.0437+ steps:38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.139+40+ - name: Install stable Rust41+ run: |42+ rustup update stable43+ rustup default stable44+45+ - name: Test46+ run: cargo test --workspace --locked47+48+ build:49+ name: Build ${{ matrix.target }}50+ needs: validate51+ strategy:52+ fail-fast: false53+ matrix:54+ include:55+ - runner: macos-1556+ target: aarch64-apple-darwin57+ - runner: ubuntu-22.0458+ target: x86_64-unknown-linux-gnu59+ - runner: ubuntu-22.04-arm60+ target: aarch64-unknown-linux-gnu61+ - runner: windows-202562+ target: x86_64-pc-windows-msvc63+ runs-on: ${{ matrix.runner }}64+ permissions:65+ contents: read66+ id-token: write67+ attestations: write68+ steps:69+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.170+71+ - name: Install stable Rust72+ shell: bash73+ run: |74+ rustup update stable75+ rustup default stable76+ rustup target add "${{ matrix.target }}"77+78+ - name: Build CLI79+ shell: bash80+ run: cargo build --locked --release -p devsite-cli --target "${{ matrix.target }}"81+82+ - name: Smoke test CLI83+ shell: bash84+ run: |85+ binary="target/${{ matrix.target }}/release/devsite"86+ if [[ "${{ runner.os }}" == "Windows" ]]; then87+ binary="$binary.exe"88+ fi89+ "$binary" --version | grep -Fx "devsite ${GITHUB_REF_NAME#v}"90+91+ - name: Package archive92+ if: runner.os != 'Windows'93+ shell: bash94+ run: |95+ name="devsite-${GITHUB_REF_NAME}-${{ matrix.target }}"96+ mkdir -p "dist/$name"97+ install -m 0755 "target/${{ matrix.target }}/release/devsite" "dist/$name/devsite"98+ cp README.md LICENSE "dist/$name/"99+ tar -C dist -czf "dist/$name.tar.gz" "$name"100+ rm -rf "dist/$name"101+102+ - name: Package archive103+ if: runner.os == 'Windows'104+ shell: pwsh105+ run: |106+ $name = "devsite-$env:GITHUB_REF_NAME-${{ matrix.target }}"107+ New-Item -ItemType Directory -Path "dist/$name" | Out-Null108+ Copy-Item "target/${{ matrix.target }}/release/devsite.exe" "dist/$name/devsite.exe"109+ Copy-Item README.md, LICENSE "dist/$name/"110+ Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip"111+ Remove-Item -Recurse "dist/$name"112+113+ - name: Attest archive provenance114+ uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4115+ with:116+ subject-path: dist/*117+118+ - name: Upload archive119+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1120+ with:121+ name: ${{ matrix.target }}122+ path: dist/*123+ if-no-files-found: error124+125+ release:126+ name: Publish release127+ needs:128+ - test129+ - build130+ runs-on: ubuntu-24.04131+ permissions:132+ contents: write133+ id-token: write134+ attestations: write135+ steps:136+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1137+138+ - name: Download archives139+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1140+ with:141+ path: dist142+ merge-multiple: true143+144+ - name: Create checksums145+ shell: bash146+ run: |147+ cd dist148+ sha256sum devsite-* > SHA256SUMS149+ sha256sum --check SHA256SUMS150+151+ - name: Attest checksum manifest152+ uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4153+ with:154+ subject-path: dist/SHA256SUMS155+156+ - name: Publish GitHub release157+ env:158+ GH_TOKEN: ${{ github.token }}159+ shell: bash160+ run: |161+ gh release create "$GITHUB_REF_NAME" dist/* \162+ --verify-tag \163+ --latest \164+ --fail-on-no-commits \165+ --title "dev.site $GITHUB_REF_NAME" \166+ --notes "$(cat .github/release-intro.md)" \167+ --generate-notes168+169+ update-homebrew:170+ name: Update Homebrew tap171+ needs: release172+ runs-on: ubuntu-24.04173+ permissions:174+ contents: read175+ steps:176+ - name: Checkout release source177+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1178+179+ - name: Download Apple Silicon archive180+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1181+ with:182+ name: aarch64-apple-darwin183+ path: dist184+185+ - name: Checkout Homebrew tap186+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1187+ with:188+ repository: FelineStateMachine/homebrew-tap189+ path: homebrew-tap190+ ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}191+192+ - name: Render stable formula193+ shell: bash194+ run: |195+ version="${GITHUB_REF_NAME#v}"196+ archive="dist/devsite-${GITHUB_REF_NAME}-aarch64-apple-darwin.tar.gz"197+ sha256="$(sha256sum "$archive" | cut -d ' ' -f 1)"198+199+ sed \200+ -e "s/@VERSION@/$version/g" \201+ -e "s/@SHA256@/$sha256/g" \202+ .github/homebrew/devsite.rb.in > homebrew-tap/Formula/devsite.rb203+ ruby -c homebrew-tap/Formula/devsite.rb204+205+ - name: Push formula update206+ shell: bash207+ run: |208+ git -C homebrew-tap config user.name "github-actions[bot]"209+ git -C homebrew-tap config user.email "41898282+github-actions[bot]@users.noreply.github.com"210+ git -C homebrew-tap add Formula/devsite.rb211+ git -C homebrew-tap commit -m "devsite $GITHUB_REF_NAME"212+ git -C homebrew-tap push@@ -19,9 +19,10 @@ macOS with [Homebrew](https://brew.sh):
1919 brew install FelineStateMachine/tap/devsite2020 ```2121 22-Linux binaries and other builds are attached to the22+Linux x86-64/ARM64, Windows x86-64, and Apple Silicon archives are attached to the2323 [latest GitHub release](https://github.com/FelineStateMachine/devsite/releases/latest).24-The CLI is one binary; `devsite daemon run` is its long-running host mode.24+Each release includes SHA-256 checksums and GitHub build-provenance attestations. The CLI25+is one binary; `devsite daemon run` is its long-running host mode.2526 2627 ## Quick start2728