live-patch.yml

name: Upload live patch script
on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
    paths:
      - 'live-patch/pre-apt-upgrade.sh'
      - '.github/workflows/live-patch.yml'

jobs:

  Teamcheck:
    permissions:
      actions: write
      
    name: "Check ORG Team Membership"
    if: ${{ github.repository_owner == 'Armbian' }}
    runs-on: [Linux, X64]
    steps:

    - name: "Check membership"
      uses: armbian/actions/team-check@main
      with:
        ORG_MEMBERS: ${{ secrets.ORG_MEMBERS }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TEAM: "Release manager"

  Sign:
    needs: Teamcheck
    name: "Signing script"
    runs-on: ubuntu-latest
    steps:

      - name: Checkout
        uses: actions/checkout@v4

      - name: Import GPG key
        env:
          GPG_KEY1: ${{ secrets.GPG_KEY1 }}
        if: env.GPG_KEY1 != null
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_KEY1 }}
          passphrase: ${{ secrets.GPG_PASSPHRASE1 }}

      - name: Sign
        env:
          GPG_PASSPHRASE1: ${{ secrets.GPG_PASSPHRASE1 }}
        if: env.GPG_PASSPHRASE1 != null
        run: |

          cp live-patch/pre-apt-upgrade.sh live-patch/pre-apt-upgrade.sh.txt # to have web friendly version
          echo ${{ secrets.GPG_PASSPHRASE1 }} | gpg --passphrase-fd 0 --armor --detach-sign --pinentry-mode loopback --batch --yes live-patch/pre-apt-upgrade.sh

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.KEY_UPLOAD }}
          known_hosts: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}
          if_key_exists: replace

      - name: Upload
        run: |

          rsync -ar -e "ssh -p 10023 -o StrictHostKeyChecking=accept-new" live-patch/pre-apt-upgrade.sh* upload@rsync.armbian.com:/storage/www/dl/_patch/