Repository navigation
chore(release): preloop 0.33.6 #298
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist | |
| # | |
| # Copyright 2022-2024, axodotdev | |
| # SPDX-License-Identifier: MIT or Apache-2.0 | |
| # | |
| # CI that: | |
| # | |
| # * checks for a Git Tag that looks like a release | |
| # * builds artifacts with dist (archives, installers, hashes) | |
| # * uploads those artifacts to temporary workflow zip | |
| # * on success, uploads the artifacts to a GitHub Release | |
| # | |
| # Note that the GitHub Release will be created with a generated | |
| # title/body based on your changelogs. | |
| name: Release | |
| permissions: | |
| "contents": "write" | |
| # This task will run whenever you push a git tag that looks like a version | |
| # like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc. | |
| # Various formats will be parsed into a VERSION and an optional PACKAGE_NAME, where | |
| # PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION | |
| # must be a Cargo-style SemVer Version (must have at least major.minor.patch). | |
| # | |
| # If PACKAGE_NAME is specified, then the announcement will be for that | |
| # package (erroring out if it doesn't have the given version or isn't dist-able). | |
| # | |
| # If PACKAGE_NAME isn't specified, then the announcement will be for all | |
| # (dist-able) packages in the workspace with that version (this mode is | |
| # intended for workspaces with only one dist-able package, or with all dist-able | |
| # packages versioned/released in lockstep). | |
| # | |
| # If you push multiple tags at once, separate instances of this workflow will | |
| # spin up, creating an independent announcement for each one. However, GitHub | |
| # will hard limit this to 3 tags per commit, as it will assume more tags is a | |
| # mistake. | |
| # | |
| # If there's a prerelease-style suffix to the version, then the release(s) | |
| # will be marked as a prerelease. | |
| on: | |
| push: | |
| tags: | |
| - '**[0-9]+.[0-9]+.[0-9]+*' | |
| jobs: | |
| # Run 'dist plan' (or host) to determine what tasks we need to do | |
| plan: | |
| runs-on: "ubuntu-22.04" | |
| outputs: | |
| val: ${{ steps.plan.outputs.manifest }} | |
| tag: ${{ !github.event.pull_request && github.ref_name || '' }} | |
| tag-flag: ${{ !github.event.pull_request && format('--tag={0}', github.ref_name) || '' }} | |
| publishing: ${{ !github.event.pull_request }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # Golden captures are LFS-tracked; the global/host jobs rebuild the | |
| # source tarball and smudge them. Without an authenticated fetch the | |
| # unauthenticated LFS API rate limit kills the run. | |
| lfs: true | |
| - name: Install dist | |
| # we specify bash to get pipefail; it guards against the `curl` command | |
| # failing. otherwise `sh` won't catch that `curl` returned non-0 | |
| shell: bash | |
| run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh" | |
| - name: Cache dist | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/dist | |
| # Every release must ship a changelog entry. This must run before the | |
| # plan step: on tag pushes that step runs `dist host --steps=create`, | |
| # which would create the GitHub Release before the guard could fail. | |
| - name: Verify changelog entry for this release | |
| if: ${{ !github.event.pull_request }} | |
| run: | | |
| version="${GITHUB_REF_NAME#v}" | |
| python3 - "$version" <<'PY' | |
| import re, sys | |
| version = sys.argv[1] | |
| text = open("CHANGELOG.md", encoding="utf-8").read() | |
| if not re.search(rf"^## \[{re.escape(version)}\]", text, re.M): | |
| sys.exit(f"CHANGELOG.md has no entry for [{version}]; add one before cutting the release") | |
| print(f"CHANGELOG.md entry for [{version}] found") | |
| PY | |
| # sure would be cool if github gave us proper conditionals... | |
| # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible | |
| # functionality based on whether this is a pull_request, and whether it's from a fork. | |
| # (PRs run on the *source* but secrets are usually on the *target* -- that's *good* | |
| # but also really annoying to build CI around when it needs secrets to work right.) | |
| - id: plan | |
| run: | | |
| dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json | |
| echo "dist ran successfully" | |
| cat plan-dist-manifest.json | |
| echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT" | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: artifacts-plan-dist-manifest | |
| path: plan-dist-manifest.json | |
| # Build and packages all the platform-specific things | |
| build-local-artifacts: | |
| name: build-local-artifacts (${{ join(matrix.targets, ', ') }}) | |
| # Let the initial task tell us to not run (currently very blunt) | |
| needs: | |
| - plan | |
| if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }} | |
| strategy: | |
| fail-fast: false | |
| # Target platforms/runners are computed by dist in create-release. | |
| # Each member of the matrix has the following arguments: | |
| # | |
| # - runner: the github runner | |
| # - dist-args: cli flags to pass to dist | |
| # - install-dist: expression to run to install dist on the runner | |
| # | |
| # Typically there will be: | |
| # - 1 "global" task that builds universal installers | |
| # - N "local" tasks that build each platform's binaries and platform-specific installers | |
| matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }} | |
| runs-on: ${{ matrix.runner }} | |
| container: ${{ matrix.container && matrix.container.image || null }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json | |
| steps: | |
| - name: enable windows longpaths | |
| run: | | |
| git config --global core.longpaths true | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # Golden captures are LFS-tracked; the global/host jobs rebuild the | |
| # source tarball and smudge them. Without an authenticated fetch the | |
| # unauthenticated LFS API rate limit kills the run. | |
| lfs: true | |
| - name: Install Rust non-interactively if not already installed | |
| if: ${{ matrix.container }} | |
| run: | | |
| if ! command -v cargo > /dev/null 2>&1; then | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y | |
| echo "$HOME/.cargo/bin" >> $GITHUB_PATH | |
| fi | |
| - name: Install dist | |
| run: ${{ matrix.install_dist.run }} | |
| # Get the dist-manifest | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - name: Install dependencies | |
| run: | | |
| ${{ matrix.packages_install }} | |
| - name: Build artifacts | |
| run: | | |
| # Actually do builds and make zips and whatnot | |
| dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json | |
| echo "dist ran successfully" | |
| - id: cargo-dist | |
| name: Post-build | |
| # We force bash here just because github makes it really hard to get values up | |
| # to "real" actions without writing to env-vars, and writing to env-vars has | |
| # inconsistent syntax between shell and powershell. | |
| shell: bash | |
| run: | | |
| # Parse out what we just built and upload it to scratch storage | |
| echo "paths<<EOF" >> "$GITHUB_OUTPUT" | |
| dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT" | |
| echo "EOF" >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: artifacts-build-local-${{ join(matrix.targets, '_') }} | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| # Build and package all the platform-agnostic(ish) things | |
| build-global-artifacts: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| runs-on: "ubuntu-22.04" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # Golden captures are LFS-tracked; the global/host jobs rebuild the | |
| # source tarball and smudge them. Without an authenticated fetch the | |
| # unauthenticated LFS API rate limit kills the run. | |
| lfs: true | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| # Get all the local artifacts for the global tasks to use (for e.g. checksums) | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: cargo-dist | |
| shell: bash | |
| run: | | |
| dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json | |
| echo "dist ran successfully" | |
| # Parse out what we just built and upload it to scratch storage | |
| echo "paths<<EOF" >> "$GITHUB_OUTPUT" | |
| jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT" | |
| echo "EOF" >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: artifacts-build-global | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| # Determines if we should publish/announce | |
| host: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| - build-global-artifacts | |
| # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine) | |
| if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| runs-on: "ubuntu-22.04" | |
| outputs: | |
| val: ${{ steps.host.outputs.manifest }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # Golden captures are LFS-tracked; the global/host jobs rebuild the | |
| # source tarball and smudge them. Without an authenticated fetch the | |
| # unauthenticated LFS API rate limit kills the run. | |
| lfs: true | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| # Fetch artifacts from scratch-storage | |
| - name: Fetch artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: host | |
| shell: bash | |
| run: | | |
| dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json | |
| echo "artifacts uploaded and released successfully" | |
| cat dist-manifest.json | |
| echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT" | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| # Overwrite the previous copy | |
| name: artifacts-dist-manifest | |
| path: dist-manifest.json | |
| # Create a GitHub Release while uploading all files to it | |
| - name: "Download GitHub Artifacts" | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: artifacts-* | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Cleanup | |
| run: | | |
| # Remove the granular manifests | |
| rm -f artifacts/*-dist-manifest.json | |
| # Engines resolve the golden at their own release tag. Seed the new | |
| # release with the newest complete pair before publishing; the | |
| # release-golden workflow then replaces each asset with a fresh bake. | |
| # This keeps a failed or unsupported fresh bake visible without ever | |
| # leaving the released engine on a guaranteed 404. | |
| - name: Seed golden assets from the newest complete release | |
| run: | | |
| source_tag="" | |
| golden_dir="$RUNNER_TEMP/release-goldens" | |
| for tag in $(gh release list --limit 50 --json tagName,isDraft --jq '.[] | select(.isDraft == false) | .tagName'); do | |
| rm -rf "$golden_dir" | |
| mkdir -p "$golden_dir" | |
| if gh release download "$tag" \ | |
| --pattern preloop-ubuntu-24.04-x86_64 \ | |
| --pattern preloop-ubuntu-24.04-aarch64 \ | |
| --dir "$golden_dir" && | |
| test -s "$golden_dir/preloop-ubuntu-24.04-x86_64" && | |
| test -s "$golden_dir/preloop-ubuntu-24.04-aarch64"; then | |
| source_tag="$tag" | |
| break | |
| fi | |
| done | |
| test -n "$source_tag" | |
| cp "$golden_dir"/preloop-ubuntu-24.04-{x86_64,aarch64} artifacts/ | |
| echo "Seeded golden assets from $source_tag" | |
| # M1: the updater pins the matching public key | |
| # (crates/preloop-cli/src/update.rs) and refuses any asset without a | |
| # valid detached signature. Sign every published asset with | |
| # `openssl dgst -sha256 -sign` (PKCS#1 v1.5 / SHA-256, raw binary | |
| # signature in `<asset>.sig`) so `preloop update` can authenticate it. | |
| # The private key lives only in the PRELOOP_RELEASE_SIGNING_KEY | |
| # secret and never appears in logs or artifacts. | |
| - name: Sign release assets | |
| env: | |
| PRELOOP_RELEASE_SIGNING_KEY: ${{ secrets.PRELOOP_RELEASE_SIGNING_KEY }} | |
| run: | | |
| if [ -z "$PRELOOP_RELEASE_SIGNING_KEY" ]; then | |
| echo "PRELOOP_RELEASE_SIGNING_KEY secret is not set; cannot sign release assets" >&2 | |
| exit 1 | |
| fi | |
| key_file="$RUNNER_TEMP/release-signing-key.pem" | |
| printf '%s' "$PRELOOP_RELEASE_SIGNING_KEY" > "$key_file" | |
| chmod 600 "$key_file" | |
| for asset in artifacts/*; do | |
| case "$asset" in | |
| *.sig) continue ;; | |
| esac | |
| openssl dgst -sha256 -sign "$key_file" -out "$asset.sig" "$asset" | |
| done | |
| rm -f "$key_file" | |
| ls artifacts/*.sig | |
| - name: Create GitHub Release | |
| env: | |
| # The org disables workflow write tokens, so GITHUB_TOKEN can never | |
| # create a release (HTTP 403 "Resource not accessible by | |
| # integration"). The upload steps only need read; this one needs | |
| # contents: write, which the scoped RELEASES_TOKEN provides. | |
| GH_TOKEN: ${{ secrets.RELEASES_TOKEN }} | |
| PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}" | |
| ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}" | |
| ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}" | |
| RELEASE_COMMIT: "${{ github.sha }}" | |
| run: | | |
| # Write and read notes from a file to avoid quoting breaking things | |
| echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt | |
| gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/* | |
| - name: Generate release notes from merged PRs | |
| env: | |
| # Same reason as the step above: the org disables workflow write | |
| # tokens, so editing the release needs the scoped RELEASES_TOKEN. | |
| GH_TOKEN: ${{ secrets.RELEASES_TOKEN }} | |
| run: | | |
| tag="${{ needs.plan.outputs.tag }}" | |
| # GitHub-generated "What's Changed" (merged PRs since the previous | |
| # tagged release; previous_tag_name defaults to it). Prepend it to | |
| # the dist-generated install/download tables. | |
| gh api "repos/${{ github.repository }}/releases/generate-notes" \ | |
| -F tag_name="$tag" --jq '.body' > "$RUNNER_TEMP/pr-notes.md" | |
| gh release view "$tag" --json body --jq .body > "$RUNNER_TEMP/dist-notes.md" | |
| cat "$RUNNER_TEMP/pr-notes.md" "$RUNNER_TEMP/dist-notes.md" > "$RUNNER_TEMP/notes.md" | |
| gh release edit "$tag" --notes-file "$RUNNER_TEMP/notes.md" | |
| announce: | |
| needs: | |
| - plan | |
| - host | |
| # use "always() && ..." to allow us to wait for all publish jobs while | |
| # still allowing individual publish jobs to skip themselves (for prereleases). | |
| # "host" however must run to completion, no skipping allowed! | |
| if: ${{ always() && needs.host.result == 'success' }} | |
| runs-on: "ubuntu-22.04" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # Golden captures are LFS-tracked; the global/host jobs rebuild the | |
| # source tarball and smudge them. Without an authenticated fetch the | |
| # unauthenticated LFS API rate limit kills the run. | |
| lfs: true |