krz/orgo

  1name: Release
  2
  3# Build binaries for a tag and attach them to a GitHub release.
  4#
  5# WHY BINARIES AT ALL, given `cargo install orgo` exists: installing from source needs
  6# a Rust toolchain and about a minute of compiling syntect. Someone evaluating a site
  7# generator should be able to download one file and point it at their notes.
  8#
  9# The tag is the source of truth for the version. The build checks it against Cargo.toml
 10# rather than trusting them to match, because a release tagged v0.18.0 containing a binary
 11# that reports 0.17.0 is the kind of thing nobody notices for months.
 12
 13on:
 14  push:
 15    tags: ["v*"]
 16  workflow_dispatch:
 17    inputs:
 18      tag:
 19        description: "Tag to build (for a re-run of a failed release)"
 20        required: true
 21
 22env:
 23  CARGO_TERM_COLOR: always
 24
 25jobs:
 26  build:
 27    name: ${{ matrix.target }}
 28    runs-on: ${{ matrix.os }}
 29    strategy:
 30      fail-fast: false
 31      matrix:
 32        include:
 33          # Apple Silicon and Intel Macs, built natively on their own runners so neither
 34          # is a cross-compile nobody has run.
 35          - { os: macos-latest, target: aarch64-apple-darwin }
 36          - { os: macos-13, target: x86_64-apple-darwin }
 37          # glibc for ordinary distributions, musl for containers and anything older than
 38          # the runner's glibc — a dynamically linked binary is the usual reason a
 39          # download does not run.
 40          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
 41          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl }
 42    steps:
 43      - name: Checkout
 44        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 45        with:
 46          ref: ${{ github.event.inputs.tag || github.ref }}
 47
 48      - name: Install Rust
 49        uses: dtolnay/rust-toolchain@1ff72ee08e3cb84d84adba594e0a297990fc1ed3 # stable
 50        with:
 51          toolchain: stable
 52          targets: ${{ matrix.target }}
 53
 54      - name: Install musl tools
 55        if: endsWith(matrix.target, '-musl')
 56        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends musl-tools
 57
 58      - name: Check the tag against Cargo.toml
 59        shell: bash
 60        run: |
 61          tag="${{ github.event.inputs.tag || github.ref_name }}"
 62          crate=$(cargo metadata --no-deps --format-version 1 \
 63            | python3 -c 'import json,sys; print(json.load(sys.stdin)["packages"][0]["version"])')
 64          if [ "$tag" != "v$crate" ]; then
 65            echo "tag $tag does not match Cargo.toml version $crate" >&2
 66            exit 1
 67          fi
 68
 69      - name: Build
 70        run: cargo build --release --locked --target ${{ matrix.target }}
 71
 72      # A tarball rather than a bare binary: it keeps the executable bit through GitHub's
 73      # download path, and carries the licence with the thing it licenses.
 74      - name: Package
 75        shell: bash
 76        run: |
 77          staging="orgo-${{ github.event.inputs.tag || github.ref_name }}-${{ matrix.target }}"
 78          mkdir "$staging"
 79          cp "target/${{ matrix.target }}/release/orgo" "$staging/"
 80          cp README.md LICENSE CHANGELOG.md "$staging/"
 81          tar czf "$staging.tar.gz" "$staging"
 82          shasum -a 256 "$staging.tar.gz" > "$staging.tar.gz.sha256"
 83
 84      - name: Upload
 85        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
 86        with:
 87          name: ${{ matrix.target }}
 88          path: |
 89            *.tar.gz
 90            *.tar.gz.sha256
 91
 92  release:
 93    name: publish the release
 94    needs: build
 95    runs-on: ubuntu-latest
 96    permissions:
 97      contents: write
 98    steps:
 99      - name: Download every build
100        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
101        with:
102          merge-multiple: true
103
104      # A draft, deliberately. The changelog entry is written by a person, and a release
105      # that publishes itself before anyone has read it cannot be edited quietly.
106      - name: Create the draft release
107        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
108        with:
109          draft: true
110          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
111          files: |
112            *.tar.gz
113            *.tar.gz.sha256