Automate releases with GitHub Actions and repogen package publishing

.github/workflows/release.yml

@@ -0,0 +1,122 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: production
+
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: ./go.mod
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.4"
+          extensions: curl, openssl, phar, zlib
+          tools: composer:v2
+
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(cd legacy && composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install legacy dependencies
+        run: cd legacy && composer install --no-interaction
+
+      - name: Get PHP version from Makefile
+        id: php-version
+        run: echo "version=$(grep '^PHP_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT
+
+      - name: Get tool versions from Makefile
+        id: tool-versions
+        run: |
+          echo "goreleaser=$(grep '^GORELEASER_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT
+          echo "repogen=$(grep '^REPOGEN_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT
+
+      - name: Cache PHP binaries
+        uses: actions/cache@v4
+        id: php-cache
+        with:
+          path: internal/legacy/archives/php_*
+          key: php-binaries-${{ steps.php-version.outputs.version }}
+
+      - name: Download all PHP binaries
+        if: steps.php-cache.outputs.cache-hit != 'true'
+        run: make download-php
+
+      - name: Write signing keys to files
+        id: signing-keys
+        run: |
+          KEY_DIR=$(mktemp -d)
+          echo "key_dir=$KEY_DIR" >> $GITHUB_OUTPUT
+          echo "${{ secrets.RSA_SIGNING_KEY }}" > "$KEY_DIR/rsa-signing-key.pem"
+          chmod 600 "$KEY_DIR/rsa-signing-key.pem"
+          openssl rsa -in "$KEY_DIR/rsa-signing-key.pem" -pubout -out "$KEY_DIR/rsa-signing-key.pub"
+          echo "${{ secrets.GPG_SIGNING_KEY }}" | base64 -d > "$KEY_DIR/gpg-signing-key.asc"
+          chmod 600 "$KEY_DIR/gpg-signing-key.asc"
+
+      - name: Cache Go binaries
+        uses: actions/cache@v4
+        with:
+          path: ~/go/bin
+          key: ${{ runner.os }}-go-bin-goreleaser-${{ steps.tool-versions.outputs.goreleaser }}-repogen-${{ steps.tool-versions.outputs.repogen }}
+
+      - name: Install Go tools
+        run: make goreleaser repogen
+
+      - name: Build release (tag)
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
+          GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
+          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
+        run: make release
+
+      - name: Build snapshot (branch)
+        if: "!startsWith(github.ref, 'refs/tags/')"
+        env:
+          RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
+          GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
+        run: make snapshot
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: eu-west-1
+
+      - name: Upload packages to repository
+        env:
+          GPG_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
+          RSA_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
+          RSA_PUBLIC_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pub
+        run: bash ./repogen.sh
+
+      - name: Clean up signing keys
+        if: always()
+        run: |
+          rm -rf "${{ steps.signing-keys.outputs.key_dir }}"

.goreleaser.yaml

@@ -104,7 +104,7 @@ release:
     ### HomeBrew
 
     ```console
-    brew update && brew upgrade platformsh/tap/upsun-cli
+    brew update && brew upgrade upsun/tap/upsun-cli
     ```
 
     ### Scoop
@@ -119,30 +119,6 @@ release:
     curl -fsSL https://raw.githubusercontent.com/upsun/cli/main/installer.sh | bash
     ```
 
-    <details>
-
-    <summary>Platform.sh compatibility</summary>
-
-    ### HomeBrew
-
-    ```console
-    brew update && brew upgrade platformsh/tap/platformsh-cli
-    ```
-
-    ### Scoop
-
-    ```console
-    scoop update platform
-    ```
-
-    ### Bash installer
-
-    ```console
-    curl -fsSL https://raw.githubusercontent.com/upsun/cli/main/installer.sh | VENDOR=platformsh bash
-    ```
-
-    </details>
-
 archives:
   - id: platform
     name_template: "platform_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
@@ -171,7 +147,7 @@ archives:
 brews:
   - name: platformsh-cli
     repository:
-      owner: platformsh
+      owner: upsun
       name: homebrew-tap
       token: "{{ .Env.GITHUB_TOKEN }}"
     ids:
@@ -201,7 +177,7 @@ brews:
 
   - name: upsun-cli
     repository:
-      owner: platformsh
+      owner: upsun
       name: homebrew-tap
       token: "{{ .Env.GITHUB_TOKEN }}"
     ids:
@@ -232,7 +208,7 @@ brews:
 scoops:
   - name: platform
     repository:
-      owner: platformsh
+      owner: upsun
       name: homebrew-tap
       token: "{{ .Env.GITHUB_TOKEN }}"
     ids:
@@ -253,7 +229,7 @@ scoops:
 
   - name: upsun
     repository:
-      owner: platformsh
+      owner: upsun
       name: homebrew-tap
       token: "{{ .Env.GITHUB_TOKEN }}"
     ids:
@@ -280,6 +256,7 @@ nfpms:
     maintainer: Antonis Kalipetis <antonis.kalipetis@upsun.com>
     license: MIT
     vendor: Platform.sh
+    file_name_template: "platformsh-cli_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     ids:
       - platform
     formats:
@@ -291,14 +268,22 @@ nfpms:
         dst: /etc/bash_completion.d/platform
       - src: completion/zsh/_platform
         dst: /usr/local/share/zsh/site-functions/_platform
+    apk:
+      signature:
+        key_file: "{{ with .Env.RSA_SIGNING_KEY_FILE }}{{ . }}{{ end }}"
+        key_name: repositories-upsun-com
+    rpm:
+      signature:
+        key_file: "{{ with .Env.GPG_SIGNING_KEY_FILE }}{{ . }}{{ end }}"
 
   - id: upsun
     homepage: https://docs.upsun.com/anchors/cli/
     package_name: upsun-cli
     description: Upsun CLI
     maintainer: Antonis Kalipetis <antonis.kalipetis@upsun.com>
     license: MIT
-    vendor: Platform.sh
+    file_name_template: upsun-cli_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+    vendor: Upsun
     ids:
       - upsun
     formats:
@@ -310,3 +295,10 @@ nfpms:
         dst: /etc/bash_completion.d/upsun
       - src: completion/zsh/_upsun
         dst: /usr/local/share/zsh/site-functions/_upsun
+    apk:
+      signature:
+        key_file: "{{ with .Env.RSA_SIGNING_KEY_FILE }}{{ . }}{{ end }}"
+        key_name: repositories-upsun-com
+    rpm:
+      signature:
+        key_file: "{{ with .Env.GPG_SIGNING_KEY_FILE }}{{ . }}{{ end }}"

CLAUDE.md

@@ -74,7 +74,6 @@ The CLI operates as a wrapper around a legacy PHP CLI:
 - `version.go`: Uses runtime/debug to get version info from VCS
 - Supports vendorization through embedded YAML configs:
   - `config_upsun.go`: Default (no build tags) - Upsun CLI
-  - `config_platformsh.go`: Requires `-tags platformsh` - Platform.sh CLI
   - `config_vendor.go`: Requires `-tags vendor` - Custom vendor CLI
 - Config can be loaded from external files for testing/development
 
@@ -86,7 +85,7 @@ The CLI operates as a wrapper around a legacy PHP CLI:
 - Copies PHP binary and phar to cache directory on first run
 
 **API Client**: `internal/api/`
-- HTTP client for interacting with Platform.sh/Upsun API
+- HTTP client for interacting with Upsun API
 - Handles authentication, organizations, and resource management
 
 **Authentication**: `internal/auth/`
@@ -102,7 +101,6 @@ The CLI operates as a wrapper around a legacy PHP CLI:
 **Multi-Vendor Support**:
 - Uses Go build tags to compile different binaries:
   - Default (no tags): Upsun CLI
-  - `-tags platformsh`: Platform.sh CLI
   - `-tags vendor`: Custom vendor CLI
 - Configuration is embedded at compile time
 - GoReleaser builds multiple variants (upsun, platform, vendor-specific)

Makefile

@@ -19,6 +19,7 @@ VERSION := $(shell git describe --always)
 
 # Tooling versions
 GORELEASER_VERSION=v2.12.0
+REPOGEN_VERSION=v1.0.4
 
 # PHP binaries are downloaded from cli-php-builds releases.
 # See: https://github.com/upsun/cli-php-builds
@@ -74,21 +75,41 @@ php: internal/legacy/archives/php_$(GOOS)_$(GOARCH)
 goreleaser:
 	command -v goreleaser >/dev/null || go install github.com/goreleaser/goreleaser/v2@$(GORELEASER_VERSION)
 
+.PHONY: repogen
+repogen:
+	command -v repogen >/dev/null || go install github.com/ralt/repogen/cmd/repogen@$(REPOGEN_VERSION)
+
 .PHONY: single
 single: goreleaser internal/legacy/archives/platform.phar php ## Build a single target release
 	PHP_VERSION=$(PHP_VERSION) goreleaser build --single-target --id=$(GORELEASER_ID) --snapshot --clean
 
-.PHONY: snapshot ## Build a snapshot release
-snapshot: goreleaser internal/legacy/archives/platform.phar php
-	PHP_VERSION=$(PHP_VERSION) goreleaser build --snapshot --clean
+.PHONY: snapshot
+snapshot: goreleaser internal/legacy/archives/platform.phar php internal/legacy/archives/cacert.pem ## Build a snapshot release
+ifndef RSA_SIGNING_KEY_FILE
+	$(error RSA_SIGNING_KEY_FILE is not set. Set it to the path of your RSA private key for APK signing, or use 'make snapshot-no-nfpm' to skip packaging.)
+endif
+ifndef GPG_SIGNING_KEY_FILE
+	$(error GPG_SIGNING_KEY_FILE is not set. Set it to the path of your GPG private key for RPM signing, or use 'make snapshot-no-nfpm' to skip packaging.)
+endif
+	PHP_VERSION=$(PHP_VERSION) goreleaser release --snapshot --clean --skip=publish,announce
+
+.PHONY: snapshot-no-nfpm
+snapshot-no-nfpm: goreleaser internal/legacy/archives/platform.phar php ## Build a snapshot release without package signing
+	PHP_VERSION=$(PHP_VERSION) goreleaser release --snapshot --clean --skip=publish,announce,nfpm
 
 .PHONY: clean-phar
 clean-phar: ## Clean up the legacy CLI phar
 	rm -f internal/legacy/archives/platform.phar
 	rm -rf legacy/vendor
 
 .PHONY: release
-release: goreleaser clean-phar internal/legacy/archives/platform.phar php ## Create and publish a release
+release: goreleaser clean-phar internal/legacy/archives/platform.phar php internal/legacy/archives/cacert.pem ## Create and publish a release
+ifndef RSA_SIGNING_KEY_FILE
+	$(error RSA_SIGNING_KEY_FILE is not set. Set it to the path of your RSA private key for APK signing.)
+endif
+ifndef GPG_SIGNING_KEY_FILE
+	$(error GPG_SIGNING_KEY_FILE is not set. Set it to the path of your GPG private key for RPM signing.)
+endif
 	PHP_VERSION=$(PHP_VERSION) goreleaser release --clean
 	VERSION=$(VERSION) bash cloudsmith.sh