Lucas RayanandClaude Sonnet 5
1b974bb90d
Acauã: Network Detection & Threat Hunting, heuristic analysis over a rolling 7-day window using deterministic math (time series, graph theory, information theory) instead of opaque ML models. Third product in the Ciberfauna ecosystem, alongside Guará and Sabiá. Follows the ecosystem's established conventions: OpenWolf project memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the same self-hosted runners, Conventional Commits, SemVer, logo and productName handling, MIT OR Apache-2.0 licensing. Architecture decision (made with the project owner after a dedicated consultation, not the original blueprint's suggested stack): Rust throughout, not Python/FastAPI/React. Most of the statistics (Bowley skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection, pivot chains) reduces to SQL over an embedded DuckDB/Parquet store; only the spectral analysis and graph centrality need host-language code, and both have workable Rust crates. Documented in full, including six corrections to the original blueprint's math (Rayleigh/Schuster instead of a degenerate Lomb-Scargle over bare timestamps, an explicit sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+ licensing caution, deterministic per-alert evidence), in docs/architecture.md. Skeleton only: crates/acaua-core has the four detection pillars, fusion, storage, zeek log parsing and the updater as typed stubs that compile and return a clear "skeleton" status rather than real detection logic — that is separate, future work. crates/acaua-cli has serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also already includes the one-click desktop self-update mechanism shared with Guará and Sabiá (AppImage/.deb/Windows installer), even with no release published yet, for consistency across the ecosystem. No Gitea repository exists for this project yet; this is a local-only commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
127 lines
6.1 KiB
YAML
127 lines
6.1 KiB
YAML
name: Release
|
|
|
|
# Triggered when a v* tag is pushed: creates the Gitea Release entry with notes
|
|
# from CHANGELOG.md and uploads the compiled CLI (scripts/package-cli.sh) with
|
|
# a .sha256 checksum alongside each archive, plus the desktop bundles (Linux
|
|
# aarch64, Linux x86_64, and Windows via cargo-xwin).
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
# Rust toolchains, cargo registry, and caches live on the persistent runner volume.
|
|
CARGO_HOME: /opt/hostedtoolcache/cargo
|
|
RUSTUP_HOME: /opt/hostedtoolcache/rustup
|
|
NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
|
|
XWIN_CACHE_DIR: /opt/hostedtoolcache/xwin-cache
|
|
|
|
jobs:
|
|
release:
|
|
name: Create release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Release
|
|
env:
|
|
TAG: ${{ gitea.ref_name }}
|
|
TOKEN: ${{ gitea.token }}
|
|
API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
|
|
run: |
|
|
# Re-running the workflow does not recreate an existing release.
|
|
if curl -fsS -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" >/dev/null 2>&1; then
|
|
echo "release $TAG already exists"; exit 0
|
|
fi
|
|
scripts/release-notes.sh "$TAG" > notes.md
|
|
pre=false; case "$TAG" in *-*) pre=true ;; esac
|
|
jq -n --arg tag "$TAG" --arg name "Acauã ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
|
|
'{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json
|
|
curl -fsS -X POST "$API/releases" -H "Authorization: token $TOKEN" \
|
|
-H 'Content-Type: application/json' -d @release.json >/dev/null
|
|
|
|
cli:
|
|
name: CLI (${{ matrix.platform }})
|
|
needs: release
|
|
runs-on: ${{ matrix.runner }}
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-release-cli-${{ matrix.platform }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "", runner: linux-arm64 }
|
|
- { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu", runner: linux-amd64 }
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
- name: Platform cross-linker
|
|
if: ${{ matrix.apt != '' && matrix.runner != 'linux-amd64' }}
|
|
run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/cli-x86_64 ${{ matrix.apt }}
|
|
- name: Build and package
|
|
run: scripts/package-cli.sh "${{ gitea.ref_name }}" "${{ matrix.platform }}" "${{ matrix.target }}" | tee packages.txt
|
|
- name: Upload to release
|
|
env:
|
|
TOKEN: ${{ gitea.token }}
|
|
API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
|
|
run: scripts/release-upload.sh "${{ gitea.ref_name }}" $(cat packages.txt)
|
|
|
|
gui:
|
|
name: Desktop app (${{ matrix.platform }})
|
|
needs: release
|
|
runs-on: ${{ matrix.runner }}
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-release-gui-${{ matrix.platform }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { platform: linux-aarch64, runner: linux-arm64 }
|
|
- { platform: linux-x86_64, runner: linux-amd64 }
|
|
- { platform: windows, runner: linux-amd64 }
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 22
|
|
- name: Tauri dependencies (Linux aarch64)
|
|
if: matrix.platform == 'linux-aarch64'
|
|
timeout-minutes: 25
|
|
run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
|
|
- name: Tauri dependencies (Linux x86_64)
|
|
if: matrix.platform == 'linux-x86_64'
|
|
timeout-minutes: 25
|
|
run: |
|
|
if [ "$(uname -m)" = aarch64 ]; then
|
|
dpkg --add-architecture amd64
|
|
. /etc/os-release
|
|
if [ "${ID:-}" = ubuntu ]; then
|
|
if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
|
|
grep -q '^Architectures:' /etc/apt/sources.list.d/ubuntu.sources || sed -i '/^Types: deb/a Architectures: arm64' /etc/apt/sources.list.d/ubuntu.sources
|
|
printf 'Types: deb\nURIs: http://archive.ubuntu.com/ubuntu/\nSuites: %s %s-updates %s-security\nComponents: main universe\nArchitectures: amd64\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n' "$VERSION_CODENAME" "$VERSION_CODENAME" "$VERSION_CODENAME" >/etc/apt/sources.list.d/amd64.sources
|
|
elif [ -f /etc/apt/sources.list ]; then
|
|
sed -i 's/^deb http/deb [arch=arm64] http/' /etc/apt/sources.list
|
|
printf 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s main universe\ndeb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s-updates main universe\ndeb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s-security main universe\n' "$VERSION_CODENAME" "$VERSION_CODENAME" "$VERSION_CODENAME" >/etc/apt/sources.list.d/amd64.list
|
|
fi
|
|
fi
|
|
scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-amd64 gcc-x86-64-linux-gnu g++-x86-64-linux-gnu pkg-config patchelf file squashfs-tools qemu-user libglib2.0-bin libwebkit2gtk-4.1-dev:amd64 libayatana-appindicator3-dev:amd64 librsvg2-dev:amd64
|
|
else
|
|
scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
|
|
fi
|
|
- name: Cross-compilation tools (Windows)
|
|
if: matrix.platform == 'windows'
|
|
run: |
|
|
scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-win nsis lld llvm clang
|
|
command -v cargo-xwin >/dev/null || cargo install cargo-xwin --locked
|
|
- name: Build and package
|
|
run: scripts/build-gui.sh "${{ matrix.platform }}"
|
|
- name: Upload to release
|
|
env:
|
|
TOKEN: ${{ gitea.token }}
|
|
API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
|
|
run: scripts/release-upload.sh "${{ gitea.ref_name }}" dist-gui/*
|