chore(release): v0.4.0 (#83) #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2025 Adam Poulemanos <89049923+bashandbone@users.noreply.github.com> | |
| # | |
| # SPDX-License-Identifier: LicenseRef-PlainMIT OR MIT | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| create-release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: taiki-e/create-gh-release-action@v1 | |
| if: github.event_name != 'workflow_dispatch' | |
| with: | |
| changelog: CHANGELOG.md | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| draft: true | |
| build: | |
| runs-on: ${{ matrix.os }} | |
| needs: [create-release] | |
| permissions: | |
| contents: write | |
| env: | |
| # Force curl-sys to build libcurl from source instead of probing pkg-config | |
| # for whatever the build image happens to expose. A release binary that | |
| # dynamically links the builder's libcurl is not portable, and on musl a | |
| # glibc-linked one would not work at all. | |
| # | |
| # Set unconditionally rather than per-target: this variable is presence- | |
| # checked, so a `${{ ... && '1' || '' }}` expression would still read as set | |
| # on every target. It only affects Linux anyway — curl-sys returns early | |
| # with the system libcurl on Apple targets and uses vcpkg on Windows. | |
| LIBCURL_NO_PKG_CONFIG: "1" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: aarch64-apple-darwin | |
| os: macos-latest | |
| build-tool: cargo | |
| - target: x86_64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| build-tool: cross | |
| - target: aarch64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| build-tool: cross | |
| # musl targets link every native dependency statically — OpenSSL (shared | |
| # by curl and libgit2 since submod dropped rustls), libgit2 and libssh2 | |
| # come from the vendored features below, and musl itself replaces the | |
| # glibc the -gnu targets link dynamically. The result runs on any Linux. | |
| - target: x86_64-unknown-linux-musl | |
| os: ubuntu-latest | |
| build-tool: cross | |
| - target: aarch64-unknown-linux-musl | |
| os: ubuntu-latest | |
| build-tool: cross | |
| - target: x86_64-pc-windows-msvc | |
| os: windows-latest | |
| build-tool: cargo | |
| - target: aarch64-pc-windows-msvc | |
| os: windows-latest | |
| build-tool: cargo | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| lfs: false | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: rust-${{ matrix.target }} | |
| - uses: taiki-e/upload-rust-binary-action@v1 | |
| with: | |
| bin: submod | |
| checksum: sha256 | |
| target: ${{ matrix.target }} | |
| build-tool: ${{ matrix.build-tool }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| features: git2/vendored-libgit2,git2/vendored-openssl | |
| dry-run: ${{ github.event_name == 'workflow_dispatch' }} | |
| # A dry run builds the archive and then throws it away, which left the whole | |
| # point of the musl targets — that the binary is actually static — argued | |
| # from build-script logic rather than measured. These two steps only run on | |
| # workflow_dispatch, so a real tag release is unaffected. | |
| - name: Verify Linux binary linkage | |
| if: github.event_name == 'workflow_dispatch' && contains(matrix.target, 'linux') | |
| env: | |
| TARGET: ${{ matrix.target }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p /tmp/linkcheck | |
| tar xzf "submod-${TARGET}.tar.gz" -C /tmp/linkcheck | |
| desc=$(file /tmp/linkcheck/submod) | |
| echo "$desc" | |
| case "$TARGET" in | |
| *musl*) | |
| # Rust links musl targets as static-pie by default, which `file` | |
| # reports as "static-pie linked" rather than "statically linked". | |
| # Accept either; reject anything dynamically linked. | |
| case "$desc" in | |
| *"statically linked"*|*"static-pie linked"*) | |
| echo "OK: ${TARGET} is statically linked" ;; | |
| *) | |
| echo "::error::${TARGET} is not statically linked: ${desc}" | |
| exit 1 ;; | |
| esac | |
| ;; | |
| *) | |
| echo "note: ${TARGET} is a glibc target; dynamic linking is expected" ;; | |
| esac | |
| - name: Upload dry-run archive for inspection | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dry-run-${{ matrix.target }} | |
| path: submod-${{ matrix.target }}.* | |
| retention-days: 7 | |
| if-no-files-found: error | |
| publish: | |
| name: Publish to crates.io | |
| needs: [build] | |
| # workflow_dispatch is the dry run: `build` already honors it via its | |
| # dry-run input, but this job and `github_release` did not, so a manual | |
| # dispatch still ran `cargo publish` against crates.io and cut a real | |
| # GitHub release. Only a v* tag push publishes anything. | |
| if: github.event_name != 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| environment: cratesio | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: rust-lang/crates-io-auth-action@v1 | |
| id: auth | |
| - run: cargo publish --allow-dirty | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| github_release: | |
| name: Publish GitHub Release | |
| needs: [build, publish] | |
| if: github.event_name != 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Publish Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| body_path: CHANGELOG.md | |
| draft: false | |
| prerelease: false | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |