# CI that: # # * checks for a Git Tag that looks like a release # * creates a Github Release™ and fills in its text # * builds artifacts with cargo-dist (executable-zips, installers) # * uploads those artifacts to the Github Release™ # # Note that the Github Release™ will be created before the artifacts, # so there will be a few minutes where the release has no artifacts # and then they will slowly trickle in, possibly failing. To make # this more pleasant we mark the release as a "draft" until all # artifacts have been successfully uploaded. This allows you to # choose what to do with partial successes and avoids spamming # anyone with notifications before the release is actually ready. name: Release permissions: contents: write # This task will run whenever you push a git tag that looks like a version # like "v1", "v1.2.0", "v0.1.0-prerelease01", "my-app-v1.0.0", etc. # The version will be roughly parsed as ({PACKAGE_NAME}-)?v{VERSION}, where # PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION # must be a Cargo-style SemVer Version. # # If PACKAGE_NAME is specified, then we will create a Github Release™ for that # package (erroring out if it doesn't have the given version or isn't cargo-dist-able). # # If PACKAGE_NAME isn't specified, then we will create a Github Release™ for all # (cargo-dist-able) packages in the workspace with that version (this is mode is # intended for workspaces with only one dist-able package, or with all dist-able # packages versioned/released in lockstep). # # If you push multiple tags at once, separate instances of this workflow will # spin up, creating an independent Github Release™ for each one. # # If there's a prerelease-style suffix to the version then the Github Release™ # will be marked as a prerelease. on: push: tags: - '*-?v[0-9]+*' jobs: # Create the Github Release™ so the packages have something to be uploaded to create-release: runs-on: ubuntu-latest outputs: has-releases: ${{ steps.create-release.outputs.has-releases }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v3 - name: Install Rust run: rustup update 1.69.0 --no-self-update && rustup default 1.69.0 - name: Install cargo-dist run: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.0.6-prerelease.5/cargo-dist-v0.0.6-prerelease.5-installer.sh | sh - id: create-release run: | cargo dist plan --tag=${{ github.ref_name }} --output-format=json > dist-manifest.json echo "dist plan ran successfully" cat dist-manifest.json # Create the Github Release™ based on what cargo-dist thinks it should be ANNOUNCEMENT_TITLE=$(jq --raw-output ".announcement_title" dist-manifest.json) IS_PRERELEASE=$(jq --raw-output ".announcement_is_prerelease" dist-manifest.json) jq --raw-output ".announcement_github_body" dist-manifest.json > new_dist_announcement.md gh release create ${{ github.ref_name }} --draft --prerelease="$IS_PRERELEASE" --title="$ANNOUNCEMENT_TITLE" --notes-file=new_dist_announcement.md echo "created announcement!" # Upload the manifest to the Github Release™ gh release upload ${{ github.ref_name }} dist-manifest.json echo "uploaded manifest!" # Disable all the upload-artifacts tasks if we have no actual releases HAS_RELEASES=$(jq --raw-output ".releases != null" dist-manifest.json) echo "has-releases=$HAS_RELEASES" >> "$GITHUB_OUTPUT" # Build and packages all the things upload-artifacts: # Let the initial task tell us to not run (currently very blunt) needs: create-release if: ${{ needs.create-release.outputs.has-releases == 'true' }} strategy: matrix: # For these target platforms include: - os: ubuntu-20.04 dist-args: --artifacts=global install-dist: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.0.6-prerelease.5/cargo-dist-v0.0.6-prerelease.5-installer.sh | sh - os: macos-11 dist-args: --artifacts=local --target=aarch64-apple-darwin --target=x86_64-apple-darwin install-dist: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.0.6-prerelease.5/cargo-dist-v0.0.6-prerelease.5-installer.sh | sh - os: ubuntu-20.04 dist-args: --artifacts=local --target=x86_64-unknown-linux-gnu install-dist: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.0.6-prerelease.5/cargo-dist-v0.0.6-prerelease.5-installer.sh | sh - os: windows-2019 dist-args: --artifacts=local --target=x86_64-pc-windows-msvc install-dist: irm https://github.com/axodotdev/cargo-dist/releases/download/v0.0.6-prerelease.5/cargo-dist-v0.0.6-prerelease.5-installer.ps1 | iex runs-on: ${{ matrix.os }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v3 - name: Install Rust run: rustup update 1.69.0 --no-self-update && rustup default 1.69.0 - name: Install cargo-dist run: ${{ matrix.install-dist }} - name: Run cargo-dist # This logic is a bit janky because it's trying to be a polyglot between # powershell and bash since this will run on windows, macos, and linux! # The two platforms don't agree on how to talk about env vars but they # do agree on 'cat' and '$()' so we use that to marshal values between commands. run: | # Actually do builds and make zips and whatnot cargo dist build --tag=${{ github.ref_name }} --output-format=json ${{ matrix.dist-args }} > dist-manifest.json echo "dist ran successfully" cat dist-manifest.json # Parse out what we just built and upload it to the Github Release™ jq --raw-output ".artifacts[]?.path | select( . != null )" dist-manifest.json > uploads.txt echo "uploading..." cat uploads.txt gh release upload ${{ github.ref_name }} $(cat uploads.txt) echo "uploaded!" - uses: actions/upload-artifact@v3 with: name: blob-artifacts path: | target/distrib/*.xz target/distrib/*.zip sign-release: needs: upload-artifacts runs-on: ubuntu-latest env: COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}} COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v3 - uses: actions/download-artifact@v3 with: name: blob-artifacts path: blob-artifacts - uses: sigstore/cosign-installer@main - name: Generate and sign checksums.txt working-directory: blob-artifacts # This is a bit of a mediocre workaround until sigstore/protobuf-specs#48 and related functionality # is implemented by Sigstore. run: | sha256sum $(ls *) > checksums.txt cosign sign-blob --yes --key env://COSIGN_PRIVATE_KEY --bundle cosign.bundle checksums.txt echo "uploading..." gh release upload ${{ github.ref_name }} checksums.txt cosign.bundle echo "cosign.bundle and checksums.txt uploaded! 🔏" # Mark the Github Release™ as a non-draft now that everything has succeeded! publish-release: # Only run after all the other tasks, but it's ok if upload-artifacts was skipped needs: [create-release, upload-artifacts, sign-release] if: ${{ always() && needs.create-release.result == 'success' && ((needs.upload-artifacts.result == 'skipped' && needs.sign-release.result == 'skipped') || (needs.upload-artifacts.result == 'success' && needs.sign-release.result == 'success')) }} runs-on: ubuntu-latest env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v3 - name: mark release as non-draft run: | gh release edit ${{ github.ref_name }} --draft=false