krz/orgo

  1name: Release
  2
  3# Build binaries for a tag and attach them to a GitHub release.
  4#
  5# WHY BINARIES AT ALL, given `cargo install orgo` exists: installing from source needs
  6# a Rust toolchain and about a minute of compiling syntect. Someone evaluating a site
  7# generator should be able to download one file and point it at their notes.
  8#
  9# The tag is the source of truth for the version. The build checks it against Cargo.toml
 10# rather than trusting them to match, because a release tagged v0.18.0 containing a binary
 11# that reports 0.17.0 is the kind of thing nobody notices for months.
 12
 13on:
 14  push:
 15    tags: ["v*"]
 16  workflow_dispatch:
 17    inputs:
 18      tag:
 19        description: "Tag to build (for a re-run of a failed release)"
 20        required: true
 21
 22env:
 23  CARGO_TERM_COLOR: always
 24
 25jobs:
 26  build:
 27    name: ${{ matrix.target }}
 28    runs-on: ${{ matrix.os }}
 29    strategy:
 30      fail-fast: false
 31      matrix:
 32        include:
 33          # Apple Silicon and Intel Macs, built natively on their own runners so neither
 34          # is a cross-compile nobody has run.
 35          - { os: macos-latest, target: aarch64-apple-darwin }
 36          - { os: macos-13, target: x86_64-apple-darwin }
 37          # glibc for ordinary distributions, musl for containers and anything older than
 38          # the runner's glibc — a dynamically linked binary is the usual reason a
 39          # download does not run.
 40          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
 41          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl }
 42    steps:
 43      - name: Checkout
 44        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 45        with:
 46          ref: ${{ github.event.inputs.tag || github.ref }}
 47
 48      - name: Install Rust
 49        uses: dtolnay/rust-toolchain@1ff72ee08e3cb84d84adba594e0a297990fc1ed3 # stable
 50        with:
 51          toolchain: stable
 52          targets: ${{ matrix.target }}
 53
 54      - name: Install musl tools
 55        if: endsWith(matrix.target, '-musl')
 56        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends musl-tools
 57
 58      - name: Check the tag against Cargo.toml
 59        shell: bash
 60        run: |
 61          tag="${{ github.event.inputs.tag || github.ref_name }}"
 62          crate=$(cargo metadata --no-deps --format-version 1 \
 63            | python3 -c 'import json,sys; print(json.load(sys.stdin)["packages"][0]["version"])')
 64          if [ "$tag" != "v$crate" ]; then
 65            echo "tag $tag does not match Cargo.toml version $crate" >&2
 66            exit 1
 67          fi
 68
 69      - name: Build
 70        run: cargo build --release --locked --target ${{ matrix.target }}
 71
 72      # A tarball rather than a bare binary: it keeps the executable bit through GitHub's
 73      # download path, and carries the licence with the thing it licenses.
 74      - name: Package
 75        shell: bash
 76        run: |
 77          staging="orgo-${{ github.event.inputs.tag || github.ref_name }}-${{ matrix.target }}"
 78          mkdir "$staging"
 79          cp "target/${{ matrix.target }}/release/orgo" "$staging/"
 80          cp README.md LICENSE "$staging/"
 81          tar czf "$staging.tar.gz" "$staging"
 82          shasum -a 256 "$staging.tar.gz" > "$staging.tar.gz.sha256"
 83
 84      - name: Upload
 85        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 86        with:
 87          name: ${{ matrix.target }}
 88          path: |
 89            *.tar.gz
 90            *.tar.gz.sha256
 91
 92  release:
 93    name: publish the release
 94    needs: build
 95    runs-on: ubuntu-latest
 96    permissions:
 97      contents: write
 98    steps:
 99      - name: Download every build
100        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
101        with:
102          merge-multiple: true
103
104      # A draft, deliberately. The release notes are written by a person, and a release
105      # that publishes itself before anyone has read it cannot be edited quietly.
106      - name: Create the draft release
107        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
108        with:
109          draft: true
110          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
111          files: |
112            *.tar.gz
113            *.tar.gz.sha256
114
115  publish:
116    name: publish to crates.io
117    needs: build
118    runs-on: ubuntu-latest
119    # Named so it can be gated. Adding a required reviewer to this environment in the
120    # repository settings turns a tag push into "waiting for a human", which is the right
121    # shape for the one step in this workflow that cannot be undone: a published version
122    # can be yanked but never replaced.
123    environment: crates-io
124    permissions:
125      # The OIDC token this mints *is* the credential — there is no API token stored in
126      # this repository, and nothing to leak from a compromised job beyond a token that
127      # crates.io revokes when the job ends.
128      id-token: write
129      contents: read
130    steps:
131      - name: Checkout
132        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
133        with:
134          ref: ${{ github.event.inputs.tag || github.ref }}
135
136      - name: Install Rust
137        uses: dtolnay/rust-toolchain@1ff72ee08e3cb84d84adba594e0a297990fc1ed3 # stable
138        with:
139          toolchain: stable
140
141      # Exchanges GitHub's OIDC token for a short-lived crates.io token, and revokes it
142      # when the job finishes. Configured on crates.io against this repository, this
143      # workflow's filename, and the environment above.
144      - name: Authenticate with crates.io
145        id: auth
146        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
147
148      # `--locked` publishes exactly the dependency versions the tests ran against, rather
149      # than whatever resolves at publish time.
150      - name: Publish
151        run: cargo publish --locked
152        env:
153          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}