ci: Build/sign RPMs for multiple Fedora versions

* Use `matrix` to generate pipelines for multiple Fedora versions * Sign RPM packages using the Jenkins GPG key * Publish RPM files to *dch* repository on *files.pyrocufflink.blue* instead of Gitea (the latter cannot handle multiple releases of the same package)
2024-06-03 08:31:18 -05:00
parent ed07fe930e
commit 5a0e5de56a
6 changed files with 144 additions and 35 deletions
--- a/ci/Jenkinsfile
+++ b/ci/Jenkinsfile
@@ -1,40 +1,81 @@
-// vim: set sw=4 ts=4 sts=4 et :
-
 pipeline {
-    agent {
-        kubernetes {
-            yamlFile 'ci/podTemplate.yaml'
-            defaultContainer 'build'
-        }
-    }
+    agent none

    stages {
-        stage('Build') {
-            steps {
-                sh 'make rpm'
-            }
-        }
+        stage('RPM') {
+            matrix {
+                axes {
+                    axis {
+                        name 'FEDORA'
+                        values '39', '40'
+                    }
+                }

-        stage('Publish') {
-            when {
-                branch 'main'
-            }
-            steps {
-                withCredentials([usernamePassword(
-                    credentialsId: 'jenkins-packages',
-                    usernameVariable: 'GITEA_USERNAME',
-                    passwordVariable: 'GITEA_PASSWORD',
-                )]) {
-                    sh 'make publish'
+                stages {
+                    stage('Build RPM') {
+                        agent {
+                            kubernetes {
+                                yamlFile 'ci/podTemplate.yaml'
+                                yamlMergeStrategy merge()
+                                defaultContainer 'fedora'
+                                containerTemplate {
+                                    name 'fedora'
+                                    image "registry.fedoraproject.org/fedora:${FEDORA}"
+                                }
+                            }
+                        }
+                        environment {
+                            GNUPGHOME = "${env.WORKSPACE_TMP}/gnupg"
+                        }
+                        stages {
+                            stage('Prepare') {
+                                steps {
+                                    sh '. ci/prepare.sh'
+                                }
+                            }
+
+                            stage('Build') {
+                                steps {
+                                    sh '. ci/build.sh'
+                                    script {
+                                        if (env.BRANCH_NAME == 'main') {
+                                            withCredentials([
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key',
+                                                    variable: 'RPM_GPG_PRIVATE_KEY',
+                                                ),
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key-passphrase',
+                                                    variable: 'RPM_GPG_KEY_PASSPHRASE',
+                                                ),
+                                            ]) {
+                                                sh '. ci/sign-rpms.sh'
+                                            }
+                                        }
+                                    }
+                                }
+                                post {
+                                    success {
+                                        archiveArtifacts '*.rpm'
+                                    }
+                                }
+                            }
+
+                            stage('Publish') {
+                                when {
+                                    branch 'main'
+                                }
+                                steps {
+                                    sshagent(['jenkins-repohost']) {
+                                        sh '. ci/publish.sh'
+                                    }
+                                }
+                            }
+                        }
+                    }
                }
            }
        }
-    }

-    post {
-        success {
-            archiveArtifacts '*.rpm'
-        }
    }
-
 }