build.yml

# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com) and contributors
# SPDX-FileContributor: Sebastian Thomschke, Vegard IT GmbH
# SPDX-License-Identifier: Apache-2.0
#
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
name: Build

on:
  push:
    branches-ignore:  # build all branches except:
    - 'dependabot/**'  # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
    tags-ignore:  # don't build tags
    - '**'
    paths-ignore:
    - '**/*.adoc'
    - '**/*.md'
    - '**/*.rst'
    - '.editorconfig'
    - '.git*'
    - '.github/*.yml'
  pull_request:
    paths-ignore:
    - '**/*.adoc'
    - '**/*.md'
    - '**/*.rst'
    - '.editorconfig'
    - '.git*'
    - '.github/*.yml'
  workflow_dispatch:
    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
    inputs:
      DSM_VERSION:
        description: 'DSM Version'
        required: true
        default: '7.2'

defaults:
  run:
    shell: bash

env:
  SYNO_TOOLKIT_BASE_URL: https://global.download.synology.com/download/ToolChain/toolkit
  DSM_VERSION: '7.2'

jobs:
  ###########################################################
  preparation:
  ###########################################################
    runs-on: ubuntu-latest

    steps:
    - name: Git checkout
      uses: actions/checkout@v4  # https://github.com/actions/checkout

    - name: Determine effective DSM version
      run: |
        set -eux
        if [[ -n "${{ github.event.inputs.DSM_VERSION }}" ]]; then
          echo "DSM_VERSION=${{ github.event.inputs.DSM_VERSION }}" >> $GITHUB_ENV
        fi

    - uses: actions/cache@v4  # https://github.com/actions/cache
      id: cache_synology_toolkit_base_env
      with:
        path: toolkit_tarballs/base_env-*
        key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_base_env
        lookup-only: true

    - name: Download Synology Base Toolkit tarball
      if: steps.cache_synology_toolkit_base_env.outputs.cache-hit != 'true'
      run: |
        set -eux

        mkdir -p toolkit_tarballs
        pushd toolkit_tarballs/
          archive=base_env-${DSM_VERSION}.txz
          curl -sSf "$SYNO_TOOLKIT_BASE_URL/$DSM_VERSION/base/$archive" -o $archive
        popd


  ###########################################################
  build-spks:
  ###########################################################
    runs-on: ubuntu-latest
    needs: 
      - preparation

    strategy:
      fail-fast: false
      matrix:
        # see https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have
        PACKAGE_ARCH:
        - apollolake  # e.g. DS918+
        - armada37xx
        - armada38x
        - avoton
        - braswell  # e.g. DS716+II
        - broadwell
        - broadwellnk
        - bromolow
        #- cedarview  # no DSM 7.2 support
        - denverton  # e.g. RS2418+
        - geminilake
        - grantley
        - kvmx64
        - monaco
        - purley
        - r1000
        - rtd1296
        - rtd1619b
        - v1000

    steps:
    - name: Determine effective DSM version
      run: |
        set -eux
        if [[ -n "${{ github.event.inputs.DSM_VERSION }}" ]]; then
          echo "DSM_VERSION=${{ github.event.inputs.DSM_VERSION }}" >> $GITHUB_ENV
        fi


    - name: "Show: environment variables"
      run: env | sort


    - name: Git checkout
      uses: actions/checkout@v4  # https://github.com/actions/checkout


    - name: Build [synobuild] Docker image
      run: |
        set -eux

        docker build -t synobuild .


    - uses: actions/cache/restore@v4  # https://github.com/actions/cache
      with:
        path: toolkit_tarballs/base_env-*
        key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_base_env


    - uses: actions/cache/restore@v4  # https://github.com/actions/cache
      with:
        path: toolkit_tarballs/ds.*
        key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_${{ matrix.PACKAGE_ARCH }}


    - name: Download Synology Toolkit tarballs
      run: |
        set -eux

        mkdir -p toolkit_tarballs
        pushd toolkit_tarballs/
          archive_base_url="https://global.download.synology.com/download/ToolChain/toolkit/$DSM_VERSION"
          archive=ds.${{ matrix.PACKAGE_ARCH }}-$DSM_VERSION.dev.txz
          [[ -f $archive ]] || curl -sSf "$SYNO_TOOLKIT_BASE_URL/$DSM_VERSION/${{ matrix.PACKAGE_ARCH }}/$archive" -o $archive
          archive=ds.${{ matrix.PACKAGE_ARCH }}-$DSM_VERSION.env.txz
          [[ -f $archive ]] || curl -sSf "$SYNO_TOOLKIT_BASE_URL/$DSM_VERSION/${{ matrix.PACKAGE_ARCH }}/$archive" -o $archive
        popd


    - name: Build SPK files
      run: |
        set -eux

        mkdir artifacts
        docker run --rm --privileged \
          --env PACKAGE_ARCH=${{ matrix.PACKAGE_ARCH }} \
          --env DSM_VER=${DSM_VERSION} \
          -v $(pwd)/artifacts:/result_spk \
          -v $(pwd)/toolkit_tarballs:/toolkit_tarballs \
          synobuild
        ls -l artifacts
        ls -l artifacts/*

        for spk in artifacts/*/*.spk; do
          sudo mv "$spk" "${spk%.spk}_DSM${DSM_VERSION}.spk"
        done


    - name: Upload SPKs
      if: github.ref_name == 'main'
      uses: actions/upload-artifact@v4  # https://github.com/actions/upload-artifact
      with:
        name: artifacts-${{ matrix.PACKAGE_ARCH }}
        path: artifacts/**


  ###########################################################
  publish-release:
  ###########################################################
    runs-on: ubuntu-latest
    needs: 
      - build-spks
    if: github.ref_name == 'main'
    concurrency: publish-latest-release # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency

    steps:
    - name: Git checkout 
      # only required by "hub release create" to prevent "fatal: Not a git repository"
      uses: actions/checkout@v4  # https://github.com/actions/checkout


    - name: Download build artifacts
      uses: actions/download-artifact@v4


    - name: Set effective DSM version
      run: |
        set -eux

        if [[ -n "${{ github.event.inputs.DSM_VERSION }}" ]]; then
          echo "DSM_VERSION=${{ github.event.inputs.DSM_VERSION }}" >> $GITHUB_ENV
        fi


    - name: Set effective WireGuard version
      run: |
        set -eux

        spks=($(ls artifacts-*/WireGuard-*/*.spk))
        [[ ${spks[0]} =~ ([0-9.]+) ]] && echo "${BASH_REMATCH[1]}"
        echo "WG_VERSION=${BASH_REMATCH[1]}" >> $GITHUB_ENV


    - name: "Delete previous release"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        set -eux

        api_base_url="$GITHUB_API_URL/repos/$GITHUB_REPOSITORY"

        release_name=WireGuard-${WG_VERSION}-DSM${DSM_VERSION}

        # https://hub.github.com/hub-release.1.html
        hub release delete "${release_name}" || true

        # delete git tag
        tag_url="$api_base_url/git/refs/tags/${release_name}"
        if curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -fsLo /dev/null --head "$tag_url"; then
          echo "Deleting tag [$tag_url]..."
          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -fsSL -X DELETE "$tag_url"
        fi


    - name: "Create release"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        set -eux

        release_name=WireGuard-${WG_VERSION}-DSM${DSM_VERSION}

        # https://cli.github.com/manual/gh_release_create
        echo "
        ${release_name}

        **Use at your own risk. We are not responsible if this breaks your NAS. Realistically it should not result in data loss, but it could render your NAS inaccessible if something goes wrong.**

        **Especially if you are not comfortable with removing the hard drives from your NAS and manually recovering the data, this is not for you.**

        See https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have to find the right architecture of your NAS
        " | GH_DEBUG=1 gh release create "$release_name" \
          --latest \
          --notes-file - \
          --target "${{ github.sha }}" \
          $(ls artifacts-*/WireGuard-*/*.spk)


    - name: "Delete intermediate build artifacts"
      uses: geekyeggo/delete-artifact@v5 # https://github.com/GeekyEggo/delete-artifact/
      with:
        name: "*"
        failOnError: false