This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-gateway.git
The following commit(s) were added to refs/heads/master by this push:
new b5a69fb ci: publish nightly binaries as a pre-release
b5a69fb is described below
commit b5a69fb6ccf4ad94265be5c640ba0d1f6d1ffc74
Author: Yang Luo <[email protected]>
AuthorDate: Mon Aug 17 14:24:29 2026 +0800
ci: publish nightly binaries as a pre-release
---
.github/workflows/nightly.yml | 180 ++++++++++++++++++++++++++++++++++++++++++
.gitignore | 3 +
README.md | 6 ++
embed.go | 6 ++
4 files changed, 195 insertions(+)
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 0000000..0cead6f
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,180 @@
+name: Nightly
+
+# Every push to master refreshes the "nightly" pre-release with one archive per
+# platform, built from that commit. These are convenience builds, not releases:
+# the source package cut by release.yml stays the only official artifact, so
+# this workflow never creates a version tag and never publishes a full release.
+
+on:
+ push:
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+# Nightly runs are never cancelled halfway: the publish step deletes the old
+# release before creating the new one, and a cancellation in that window would
+# leave no nightly at all.
+concurrency:
+ group: nightly
+ cancel-in-progress: false
+
+env:
+ GO_VERSION: "1.25"
+ BASENAME: apache-casbin-gateway-nightly-incubating
+
+jobs:
+ frontend:
+ name: Build web UI
+ runs-on: ubuntu-latest
+ if: ${{ github.repository == 'apache/casbin-gateway' }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - uses: actions/setup-node@v4
+ with:
+ node-version: 20
+ cache: 'yarn'
+ cache-dependency-path: ./web/yarn.lock
+
+ # Source maps are left out on purpose: everything under web/build ends up
+ # inside every one of the six binaries below.
+ - name: Build
+ run: yarn install && CI=false GENERATE_SOURCEMAP=false yarn run build
+ working-directory: ./web
+
+ - name: Upload web build
+ uses: actions/upload-artifact@v4
+ with:
+ name: web-build-${{ github.run_id }}
+ path: ./web/build
+ retention-days: 1
+
+ nightly:
+ name: Publish nightly
+ runs-on: ubuntu-latest
+ needs: [ frontend ]
+ if: ${{ github.repository == 'apache/casbin-gateway' }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache-dependency-path: ./go.mod
+
+ # The binaries are built with -tags embed, which bakes conf/app.conf, the
+ # web UI and the IP database in, so web/build has to be in place first.
+ - name: Download web build
+ uses: actions/download-artifact@v4
+ with:
+ name: web-build-${{ github.run_id }}
+ path: ./web/build
+
+ - name: Build the platform archives
+ run: |
+ set -euo pipefail
+ mkdir -p dist
+
+ # goos goarch arch-name-used-in-the-file-name
+ targets=(
+ "linux amd64 x86_64"
+ "linux arm64 arm64"
+ "darwin amd64 x86_64"
+ "darwin arm64 arm64"
+ "windows amd64 x86_64"
+ "windows arm64 arm64"
+ )
+
+ for target in "${targets[@]}"; do
+ read -r goos goarch archName <<< "${target}"
+
+ name="${BASENAME}-${goos}-${archName}"
+ stage="dist/${name}"
+ mkdir -p "${stage}"
+
+ binary="${stage}/casbin-gateway"
+ if [[ "${goos}" == "windows" ]]; then
+ binary="${binary}.exe"
+ fi
+
+ echo "Building ${name}"
+ GOOS="${goos}" GOARCH="${goarch}" CGO_ENABLED=0 \
+ go build -tags embed -trimpath -ldflags "-s -w" -o "${binary}" .
+
+ cp LICENSE NOTICE DISCLAIMER README.md "${stage}/"
+
+ if [[ "${goos}" == "windows" ]]; then
+ archive="${name}.zip"
+ (cd dist && zip -qr "${archive}" "${name}")
+ else
+ archive="${name}.tar.gz"
+ tar -czf "dist/${archive}" -C dist "${name}"
+ fi
+
+ (cd dist && sha512sum "${archive}" > "${archive}.sha512")
+ rm -rf "${stage}"
+ done
+
+ ls -l dist
+
+ - name: Write release notes
+ run: |
+ set -euo pipefail
+ cat > release-notes.md <<'NOTES'
+ ## This is not an official release
+
+ These are automated convenience builds of the current `master`. Use
them for
+ testing and development only.
+
+ Official releases are source packages, published on the
+ [releases page](https://github.com/apache/casbin-gateway/releases).
+
+ ## Contents
+
+ Each archive holds one self-contained `casbin-gateway` executable,
together with
+ `LICENSE`, `NOTICE` and `DISCLAIMER`. The executable is built with
`-tags embed`,
+ so it carries its own settings, web UI and IP database and starts
with no files
+ next to it. Data is written to `./data`, `./logs` and `./tmp` in the
working
+ directory. A `.sha512` file accompanies every archive.
+
+ | Platform | Archive |
+ | --- | --- |
+ | Linux x86_64 | `BASENAME_PLACEHOLDER-linux-x86_64.tar.gz` |
+ | Linux arm64 | `BASENAME_PLACEHOLDER-linux-arm64.tar.gz` |
+ | macOS x86_64 | `BASENAME_PLACEHOLDER-darwin-x86_64.tar.gz` |
+ | macOS arm64 | `BASENAME_PLACEHOLDER-darwin-arm64.tar.gz` |
+ | Windows x86_64 | `BASENAME_PLACEHOLDER-windows-x86_64.zip` |
+ | Windows arm64 | `BASENAME_PLACEHOLDER-windows-arm64.zip` |
+ NOTES
+
+ sed -i "s/BASENAME_PLACEHOLDER/${BASENAME}/g" release-notes.md
+ printf '\nBuilt from commit %s.\n' "${GITHUB_SHA}" >>
release-notes.md
+ cat release-notes.md
+
+ # The nightly release is replaced rather than updated, so that its tag
+ # moves to the commit it was actually built from. --cleanup-tag removes
+ # the old tag as well, and --target recreates it at this commit.
+ #
+ # The gh CLI is used instead of a marketplace action: the ASF org only
+ # allows actions owned by GitHub or by the enterprise allow-list.
+ - name: Replace the nightly pre-release
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ set -euo pipefail
+
+ if gh release view nightly >/dev/null 2>&1; then
+ gh release delete nightly --yes --cleanup-tag
+ fi
+
+ gh release create nightly \
+ --prerelease \
+ --target "${GITHUB_SHA}" \
+ --title "Nightly build (not an official release)" \
+ --notes-file release-notes.md \
+ dist/*.tar.gz dist/*.zip dist/*.sha512
diff --git a/.gitignore b/.gitignore
index 4704935..64fb89c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,9 @@
# Built binaries
casbin-gateway
+# Release and nightly archives, staged here by the workflows
+dist/
+
tmp/
tmpFiles/
*.tmp
diff --git a/README.md b/README.md
index 576366d..bd6c0c3 100644
--- a/README.md
+++ b/README.md
@@ -168,6 +168,12 @@ The startup summary reports which source each one came
from:
Being self-contained is about startup, not about staying read-only: a running
Gateway still writes `./data` (the SQLite database, deployed apps, agent patch
state), `./logs` and `./tmp` relative to its working directory. Start it from
the directory where that state belongs.
+#### Nightly builds
+
+Every push to `master` rebuilds the
[`nightly`](https://github.com/apache/casbin-gateway/releases/tag/nightly)
pre-release, with one such archive per platform — Linux, macOS and Windows,
`x86_64` and `arm64` — each carrying `LICENSE`, `NOTICE`, `DISCLAIMER` and a
`.sha512` checksum.
+
+**Nightly builds are not official releases.** They are automated builds of
whatever is on `master`, and exist so that a change can be tried without a Go
and Node toolchain. Anything else should be built from a source release.
+
### Necessary configuration
#### Get the code
diff --git a/embed.go b/embed.go
index 8cd8602..83a6629 100644
--- a/embed.go
+++ b/embed.go
@@ -33,6 +33,12 @@ import (
"embed"
"io/fs"
+ // The IANA time zone database, which util.GetCurrentTime() needs. A
+ // self-contained binary cannot count on the host for it: Windows ships
no
+ // zoneinfo at all, and -trimpath drops the GOROOT copy Go falls back
to,
+ // so without this the first timestamp panics with "unknown time zone".
+ _ "time/tzdata"
+
"github.com/apache/casbin-gateway/embedsupport"
)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
