Skip to content

chore(release): v0.4.0 (#83) #42

chore(release): v0.4.0 (#83)

chore(release): v0.4.0 (#83) #42

Workflow file for this run

# SPDX-FileCopyrightText: 2025 Adam Poulemanos <89049923+bashandbone@users.noreply.github.com>
#
# SPDX-License-Identifier: LicenseRef-PlainMIT OR MIT
name: Release
on:
push:
tags:
- "v*"
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
jobs:
create-release:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v6
- uses: taiki-e/create-gh-release-action@v1
if: github.event_name != 'workflow_dispatch'
with:
changelog: CHANGELOG.md
token: ${{ secrets.GITHUB_TOKEN }}
draft: true
build:
runs-on: ${{ matrix.os }}
needs: [create-release]
permissions:
contents: write
env:
# Force curl-sys to build libcurl from source instead of probing pkg-config
# for whatever the build image happens to expose. A release binary that
# dynamically links the builder's libcurl is not portable, and on musl a
# glibc-linked one would not work at all.
#
# Set unconditionally rather than per-target: this variable is presence-
# checked, so a `${{ ... && '1' || '' }}` expression would still read as set
# on every target. It only affects Linux anyway — curl-sys returns early
# with the system libcurl on Apple targets and uses vcpkg on Windows.
LIBCURL_NO_PKG_CONFIG: "1"
strategy:
fail-fast: false
matrix:
include:
- target: aarch64-apple-darwin
os: macos-latest
build-tool: cargo
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
build-tool: cross
- target: aarch64-unknown-linux-gnu
os: ubuntu-latest
build-tool: cross
# musl targets link every native dependency statically — OpenSSL (shared
# by curl and libgit2 since submod dropped rustls), libgit2 and libssh2
# come from the vendored features below, and musl itself replaces the
# glibc the -gnu targets link dynamically. The result runs on any Linux.
- target: x86_64-unknown-linux-musl
os: ubuntu-latest
build-tool: cross
- target: aarch64-unknown-linux-musl
os: ubuntu-latest
build-tool: cross
- target: x86_64-pc-windows-msvc
os: windows-latest
build-tool: cargo
- target: aarch64-pc-windows-msvc
os: windows-latest
build-tool: cargo
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
fetch-tags: true
lfs: false
- uses: Swatinem/rust-cache@v2
with:
shared-key: rust-${{ matrix.target }}
- uses: taiki-e/upload-rust-binary-action@v1
with:
bin: submod
checksum: sha256
target: ${{ matrix.target }}
build-tool: ${{ matrix.build-tool }}
token: ${{ secrets.GITHUB_TOKEN }}
features: git2/vendored-libgit2,git2/vendored-openssl
dry-run: ${{ github.event_name == 'workflow_dispatch' }}
# A dry run builds the archive and then throws it away, which left the whole
# point of the musl targets — that the binary is actually static — argued
# from build-script logic rather than measured. These two steps only run on
# workflow_dispatch, so a real tag release is unaffected.
- name: Verify Linux binary linkage
if: github.event_name == 'workflow_dispatch' && contains(matrix.target, 'linux')
env:
TARGET: ${{ matrix.target }}
run: |
set -euo pipefail
mkdir -p /tmp/linkcheck
tar xzf "submod-${TARGET}.tar.gz" -C /tmp/linkcheck
desc=$(file /tmp/linkcheck/submod)
echo "$desc"
case "$TARGET" in
*musl*)
# Rust links musl targets as static-pie by default, which `file`
# reports as "static-pie linked" rather than "statically linked".
# Accept either; reject anything dynamically linked.
case "$desc" in
*"statically linked"*|*"static-pie linked"*)
echo "OK: ${TARGET} is statically linked" ;;
*)
echo "::error::${TARGET} is not statically linked: ${desc}"
exit 1 ;;
esac
;;
*)
echo "note: ${TARGET} is a glibc target; dynamic linking is expected" ;;
esac
- name: Upload dry-run archive for inspection
if: github.event_name == 'workflow_dispatch'
uses: actions/upload-artifact@v4
with:
name: dry-run-${{ matrix.target }}
path: submod-${{ matrix.target }}.*
retention-days: 7
if-no-files-found: error
publish:
name: Publish to crates.io
needs: [build]
# workflow_dispatch is the dry run: `build` already honors it via its
# dry-run input, but this job and `github_release` did not, so a manual
# dispatch still ran `cargo publish` against crates.io and cut a real
# GitHub release. Only a v* tag push publishes anything.
if: github.event_name != 'workflow_dispatch'
runs-on: ubuntu-latest
environment: cratesio
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v6
with:
submodules: recursive
- uses: dtolnay/rust-toolchain@stable
- uses: rust-lang/crates-io-auth-action@v1
id: auth
- run: cargo publish --allow-dirty
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
github_release:
name: Publish GitHub Release
needs: [build, publish]
if: github.event_name != 'workflow_dispatch'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v6
- name: Publish Release
uses: softprops/action-gh-release@v2
with:
body_path: CHANGELOG.md
draft: false
prerelease: false
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}