git / moonbite-network / deploy/ci/README.md · raw

# CI: cross-platform release binaries`release.yml` builds the MoonBite node (`moonbited` + `moonbite-cli`) and thesolo-miner bundle for **Linux, Windows, and both macOS architectures**, andattaches them to a GitHub Release on every `v*` tag.## Reproducible, attested releases (2026-10-10)Two workflows now carry the release trust model described in[`docs/REPRODUCIBLE-BUILDS.md`](../../docs/REPRODUCIBLE-BUILDS.md); both areSHA-pinned on every third-party action:| Workflow | Repo | Does ||---|---|---|| `.github/workflows/release.yml` | moonbite-core | deterministic flags (`SOURCE_DATE_EPOCH`, `-ffile-prefix-map`, `strip -D`, sorted fixed-mtime archives), Linux target built **twice on separate runners** and compared, Sigstore attestation (`actions/attest-build-provenance`), optional minisign of `SHA256SUMS.txt`, disabled Guix job stub || `.github/workflows/release-bundles.yml` | this repo | downloads the core Windows binaries for the same tag, verifies sha256 + attestation (+ minisign once the key is live), builds the miner and wallet zips with `scripts/release/make-bundle.py` twice and compares, attests, optionally minisigns, uploads to this repo's Release |User-side verification: `scripts/release/verify-release.sh` and`scripts/release/Verify-Release.ps1` (sha256, minisign, `gh attestation verify`).Secrets (both repos, optional): `MINISIGN_SECRET_KEY` (minisign secret key filebody) and `MINISIGN_PASSWORD`. When absent the signing step is skipped with anotice and the manifest is published unsigned; the attestation and thereproducibility gate still apply.## Where it goesThis file builds the **C++ node**, so it lives in the node repo:```moonbite-core/.github/workflows/release.yml```The stale, unpinned copy that used to live here (`deploy/ci/release.yml`) wasdeleted in the 2026-10-09 hardening (audit M3): a second copy drifts, and anunpinned workflow is not a reviewable reference. Review the live one inmoonbite-core.## How it works- Rebuilds **RandomX v1.2.1** from source for each target and overwrites the  vendored Linux `librandomx.a`. That version was verified byte-identical to  the vendored library (same 32-byte-seed hash), so every platform's binary is  consensus-correct.- Builds dependencies with the `depends` system, `NO_QT=1` (daemon + cli only).- **Windows** is cross-compiled from an Ubuntu runner with mingw-w64 (posix  threads). **macOS** builds natively on GitHub's macOS runners, which carry the  Apple SDK that cannot be used off Apple hardware - the reason macOS cannot be  cross-built from Linux.- Bundles the binaries with `mine.sh` / `mine.ps1` / `README.md` pulled from  this repo (`release/miner/`), so the miner scripts have one source of truth.- Publishes all archives plus `SHA256SUMS.txt` to the Release.## Releasing```bashgit tag v0.1.0 && git push origin v0.1.0```The `build` matrix runs; the `release` job collects the artifacts and createsthe Release. `depends` output is cached per host, so only the first tag paysthe full dependency-build cost.