mirror of
https://github.com/OrcaSlicer/OrcaSlicer.git
synced 2026-09-14 20:47:33 +00:00
254 lines
10 KiB
YAML
254 lines
10 KiB
YAML
name: Post-merge profiles
|
|
|
|
# Push-triggered counterpart to check_profiles.yml (which only gates PRs). When a
|
|
# profile change lands on main or a release branch, rebuild the affected vendors'
|
|
# binary preset caches (<vendor>.opc) and publish each as a versioned ZIP asset on
|
|
# a per-Orca-version release of the profiles repo. From there OrcaCloud's OTA
|
|
# Manager lists the asset, a maintainer attaches a changelog and hits Publish, and
|
|
# only then does it become a live OTA update - this workflow does none of that
|
|
# last part (no changelog, no R2, no webhook).
|
|
#
|
|
# Asset contract expected by OrcaCloud's release scanner:
|
|
# ^(\d+\.\d+\.\d+)_([^_]+)_(\d+(?:\.\d+){3})_(\d{12})\.zip$
|
|
# <orca_ver>_<vendor>_<profile_version>_<UTC yyyymmddHHMM>.zip (zip root: <vendor>.opc)
|
|
#
|
|
# Setup (App + secrets): docs/ota/post-merge-profiles-setup.md
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- release/*
|
|
paths:
|
|
- 'resources/profiles/**'
|
|
- '.github/workflows/post_merge_profiles.yml'
|
|
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# One run per branch; let a run finish rather than cancel it, since it publishes.
|
|
concurrency:
|
|
group: post-merge-profiles-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
# generate_system_cache is published to this repo's own nightly-builds release
|
|
# by build_orca.yml's Linux leg. The job guard pins github.repository to
|
|
# OrcaSlicer/OrcaSlicer, so this resolves there.
|
|
TOOL_REPO: ${{ github.repository }}
|
|
TOOL_ASSET: generate_system_cache_Linux_Ubuntu2404_nightly
|
|
# Where per-vendor ZIP assets are published; OrcaCloud's OTA reads this repo.
|
|
PROFILES_OWNER: OrcaSlicer
|
|
PROFILES_REPO: orcaslicer-profiles
|
|
|
|
jobs:
|
|
publish_profile_caches:
|
|
name: Publish profile caches
|
|
if: ${{ github.repository == 'OrcaSlicer/OrcaSlicer' }}
|
|
# FOLDER_MERGERS is an environment-scoped variable, shared with the PR
|
|
# merge bot. Keep this environment free of protection rules so this
|
|
# push-triggered job does not wait for a reviewer.
|
|
environment: merge-delegation
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
# Enough history to reach github.event.before for the changed-vendor
|
|
# diff on a normal push; deeper pushes fall back to HEAD^..HEAD in the
|
|
# step below. fetch-depth: 0 would clone all of OrcaSlicer's history.
|
|
fetch-depth: 50
|
|
|
|
- name: Resolve changed vendors
|
|
id: vendors
|
|
shell: bash
|
|
env:
|
|
FOLDER_MERGERS: ${{ vars.FOLDER_MERGERS }}
|
|
run: |
|
|
set -euo pipefail
|
|
base='${{ github.event.before }}'
|
|
head='${{ github.sha }}'
|
|
# Zero SHA (branch created / force push) or manual dispatch: fall back
|
|
# to this commit's own diff.
|
|
if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
|
|
base="$head^"
|
|
fi
|
|
echo "Diffing $base..$head"
|
|
|
|
mapfile -t candidates < <(
|
|
git diff --name-only "$base" "$head" -- resources/profiles \
|
|
| sed -nE 's#^resources/profiles/([^/]+)/.*#\1#p; s#^resources/profiles/([^/]+)\.json$#\1#p' \
|
|
| sort -u
|
|
)
|
|
|
|
vendors=()
|
|
for v in "${candidates[@]:-}"; do
|
|
[ -n "$v" ] || continue
|
|
json="resources/profiles/$v.json"
|
|
# A vendor has a manifest plus either a preset directory or a version
|
|
# field; this drops non-vendor files such as blacklist.json.
|
|
if [ -f "$json" ] && { [ -d "resources/profiles/$v" ] || jq -e '.version' "$json" >/dev/null 2>&1; }; then
|
|
vendors+=("$v")
|
|
fi
|
|
done
|
|
|
|
if [ "${#vendors[@]}" -eq 0 ]; then
|
|
echo "No changed vendor profiles in this push; nothing to publish."
|
|
echo "vendors=" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
# A vendor is eligible only when both the profile directory and its
|
|
# sibling bundle JSON are covered by at least one FOLDER_MERGERS
|
|
# grant. The account part is intentionally ignored here: this is a
|
|
# post-merge safety check, not an authorization check for a command.
|
|
grants=()
|
|
while IFS= read -r raw_line; do
|
|
line="${raw_line#"${raw_line%%[![:space:]]*}"}"
|
|
line="${line%"${line##*[![:space:]]}"}"
|
|
[ -n "$line" ] || continue
|
|
[[ "$line" == \#* ]] && continue
|
|
[[ "$line" == *:* ]] || continue
|
|
|
|
grant="${line#*:}"
|
|
grant="${grant#"${grant%%[![:space:]]*}"}"
|
|
grant="${grant%"${grant##*[![:space:]]}"}"
|
|
while [[ "$grant" == */ ]]; do grant="${grant%/}"; done
|
|
grants+=("$grant")
|
|
done <<< "${FOLDER_MERGERS:-}"
|
|
|
|
is_granted() {
|
|
local path="$1"
|
|
local grant
|
|
for grant in "${grants[@]:-}"; do
|
|
if [[ "$path" == "$grant" || "$path" == "$grant/"* ]]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
|
|
unauthorized=()
|
|
for v in "${vendors[@]}"; do
|
|
if ! is_granted "resources/profiles/$v" || ! is_granted "resources/profiles/$v.json"; then
|
|
unauthorized+=("$v")
|
|
fi
|
|
done
|
|
|
|
if [ "${#unauthorized[@]}" -ne 0 ]; then
|
|
echo "Changed vendor profiles are not covered by FOLDER_MERGERS: ${unauthorized[*]}"
|
|
echo "No profile caches will be published for this push."
|
|
echo "vendors=" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
printf 'Changed vendors: %s\n' "${vendors[*]}"
|
|
echo "vendors=${vendors[*]}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Resolve Orca version
|
|
id: orca
|
|
if: steps.vendors.outputs.vendors != ''
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
raw="$(sed -nE 's/^set\(SoftFever_VERSION "([^"]+)".*/\1/p' version.inc | head -1)"
|
|
[ -n "$raw" ] || { echo "::error::could not read SoftFever_VERSION from version.inc"; exit 1; }
|
|
orca_ver="${raw%%-*}"
|
|
if ! [[ "$orca_ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "::error::Orca version '$orca_ver' (from '$raw') is not X.Y.Z"; exit 1
|
|
fi
|
|
# release_tag is what the desktop client sends as orca_version and what
|
|
# OrcaCloud keys R2 on; orca_ver (X.Y.Z) is the asset-name prefix.
|
|
echo "release_tag=$raw" >> "$GITHUB_OUTPUT"
|
|
echo "orca_ver=$orca_ver" >> "$GITHUB_OUTPUT"
|
|
echo "Orca version: release_tag=$raw asset_prefix=$orca_ver"
|
|
|
|
- name: Validate profile versions
|
|
id: pver
|
|
if: steps.vendors.outputs.vendors != ''
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: > "$RUNNER_TEMP/pver.tsv"
|
|
for v in ${{ steps.vendors.outputs.vendors }}; do
|
|
pv="$(jq -r '.version // empty' "resources/profiles/$v.json")"
|
|
if ! [[ "$pv" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "::error::vendor $v version '${pv:-<none>}' must be 4 numeric parts (A.B.C.D) for the OTA asset name; fix resources/profiles/$v.json"
|
|
exit 1
|
|
fi
|
|
printf '%s\t%s\n' "$v" "$pv" >> "$RUNNER_TEMP/pver.tsv"
|
|
echo "$v -> $pv"
|
|
done
|
|
|
|
- name: Download generate_system_cache
|
|
if: steps.vendors.outputs.vendors != ''
|
|
shell: bash
|
|
env:
|
|
# gh (with the default token) rather than an unauthenticated curl: keeps
|
|
# working if TOOL_REPO is ever private and avoids anonymous rate limits.
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
gh release download nightly-builds --repo "$TOOL_REPO" \
|
|
--pattern "$TOOL_ASSET" --output generate_system_cache --clobber
|
|
chmod +x generate_system_cache
|
|
|
|
- name: Build caches and package assets
|
|
id: pkg
|
|
if: steps.vendors.outputs.vendors != ''
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
# One timestamp for the whole run so a multi-vendor merge groups together.
|
|
ts="$(date -u +%Y%m%d%H%M)"
|
|
orca_ver='${{ steps.orca.outputs.orca_ver }}'
|
|
out="$RUNNER_TEMP/assets"
|
|
mkdir -p "$out"
|
|
|
|
for v in ${{ steps.vendors.outputs.vendors }}; do
|
|
./generate_system_cache -p "$GITHUB_WORKSPACE/resources/profiles" -v "$v" -l 2
|
|
opc="resources/profiles/$v.opc"
|
|
[ -f "$opc" ] || { echo "::error::$opc was not generated"; exit 1; }
|
|
pv="$(awk -F'\t' -v v="$v" '$1==v{print $2}' "$RUNNER_TEMP/pver.tsv")"
|
|
name="${orca_ver}_${v}_${pv}_${ts}.zip"
|
|
( cd resources/profiles && zip -q -j "$out/$name" "$v.opc" )
|
|
echo "packaged $name"
|
|
done
|
|
echo "dir=$out" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Mint profiles-repo token
|
|
id: token
|
|
if: steps.vendors.outputs.vendors != ''
|
|
uses: actions/create-github-app-token@v1
|
|
with:
|
|
app-id: ${{ secrets.PROFILES_APP_ID }}
|
|
private-key: ${{ secrets.PROFILES_APP_PRIVATE_KEY }}
|
|
owner: ${{ env.PROFILES_OWNER }}
|
|
repositories: ${{ env.PROFILES_REPO }}
|
|
|
|
- name: Publish assets to profiles release
|
|
if: steps.vendors.outputs.vendors != ''
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ steps.token.outputs.token }}
|
|
RELEASE_TAG: ${{ steps.orca.outputs.release_tag }}
|
|
ASSET_DIR: ${{ steps.pkg.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
repo="$PROFILES_OWNER/$PROFILES_REPO"
|
|
if ! gh release view "$RELEASE_TAG" --repo "$repo" >/dev/null 2>&1; then
|
|
echo "Creating release $RELEASE_TAG on $repo"
|
|
gh release create "$RELEASE_TAG" --repo "$repo" \
|
|
--title "$RELEASE_TAG" --notes "Profile cache assets for Orca $RELEASE_TAG." \
|
|
--latest=false
|
|
fi
|
|
# Asset names are timestamp-unique; a clash means a bug, so don't --clobber.
|
|
gh release upload "$RELEASE_TAG" --repo "$repo" "$ASSET_DIR"/*.zip
|
|
|
|
{
|
|
echo "### Published to \`$repo\` release \`$RELEASE_TAG\`"
|
|
for f in "$ASSET_DIR"/*.zip; do echo "- \`$(basename "$f")\`"; done
|
|
} >> "$GITHUB_STEP_SUMMARY"
|