@sigitcodereview / sigit / commits / 9d84d40

fix: render nfpm config with envsubst so deb/rpm builds succeed

The Linux jobs in release-github failed at "Build Linux packages" with: glob failed: ${PKG_BINARY}: no matching files nfpm expands ${VAR} in scalar fields such as arch: and version:, but not in contents[].src (goreleaser/nfpm#719), so the staged binary path was passed through literally and matched nothing. Both Linux targets died there, which blocked the release job and the Homebrew/Scoop/winget fan-out that depends on it. Render packaging/nfpm.yaml through envsubst first so nfpm only ever sees literal values. envsubst is restricted to the three known variables so it cannot clobber shell-looking text (scriptlets, $PATH) added to the config later. Also guard against a worse, silent failure found while verifying this: when RELEASE_VERSION is empty nfpm exits 0 and emits a bogus "sigit_0.0.0~rc0_amd64.deb" that would be attached to the release. The step now fails loudly on an empty version or a missing binary, and verifies both packagers actually produced output. Verified against nfpm 2.43.0 (the pinned CI version): amd64 and arm64 both produce correctly named deb/rpm artifacts containing /usr/bin/sigit at 0755 root:root. Co-Authored-By: siGit Code <noreply@sigit.si>

paydii committed Aug 30, 2026 at 21:37 UTC 9d84d40a192caaa2cceb7c25064726d4512b652e
2 files changed +38 -3
.github/workflows/release-github.yml
+35 -2
@@ -141,8 +141,41 @@ jobs:
141 export PKG_VERSION="${RELEASE_VERSION}"
142 export PKG_BINARY="./release/${PROJECT_NAME}-${{ matrix.name }}"
143
144 - /tmp/nfpm package --config packaging/nfpm.yaml --packager deb --target ./release/
145 - /tmp/nfpm package --config packaging/nfpm.yaml --packager rpm --target ./release/
144 + # An empty version is worse than a hard failure here: nfpm accepts it
145 + # and silently emits a "0.0.0~rc0" package that would be attached to
146 + # the release. Same for a missing binary, which only surfaces as an
147 + # opaque glob error. Fail loudly instead.
148 + if [ -z "${PKG_VERSION}" ]; then
149 + echo "RELEASE_VERSION is empty; refusing to build packages" >&2
150 + exit 1
151 + fi
152 + if [ ! -f "${PKG_BINARY}" ]; then
153 + echo "Staged binary ${PKG_BINARY} not found" >&2
154 + exit 1
155 + fi
156 +
157 + # nfpm expands ${VAR} in most fields but NOT in contents.src, so the
158 + # config is rendered up front and nfpm only ever sees literal values.
159 + # envsubst comes from gettext-base, preinstalled on the Ubuntu runner
160 + # images. The explicit variable list keeps it from clobbering any
161 + # other shell-looking text added to the config later.
162 + if ! command -v envsubst >/dev/null 2>&1; then
163 + sudo apt-get update && sudo apt-get install -y gettext-base
164 + fi
165 +
166 + envsubst '${PKG_ARCH} ${PKG_VERSION} ${PKG_BINARY}' \
167 + < packaging/nfpm.yaml > /tmp/nfpm.rendered.yaml
168 +
169 + /tmp/nfpm package --config /tmp/nfpm.rendered.yaml --packager deb --target ./release/
170 + /tmp/nfpm package --config /tmp/nfpm.rendered.yaml --packager rpm --target ./release/
171 +
172 + # Guard against a packager silently producing nothing.
173 + for ext in deb rpm; do
174 + if ! compgen -G "./release/*.${ext}" >/dev/null; then
175 + echo "No .${ext} produced" >&2
176 + exit 1
177 + fi
178 + done
179
180 ls -la ./release/
181
packaging/nfpm.yaml
+3 -1
@@ -7,7 +7,9 @@
7 # config.
8 #
9 # PKG_ARCH and PKG_VERSION are set by release-github.yml; PKG_BINARY points at
10 -# the renamed binary already staged in release/.
10 +# the renamed binary already staged in release/. nfpm does not expand env vars
11 +# in contents.src, so release-github.yml renders this file with envsubst before
12 +# invoking nfpm.
13 name: sigit
14 arch: ${PKG_ARCH}
15 platform: linux