22e7c2de50
Derive runtime templates before setup validation so reruns preserve existing policy. Redact policy JSON by default to avoid exposing owner-local details.
121 lines
3.7 KiB
YAML
121 lines
3.7 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
|
|
jobs:
|
|
build:
|
|
name: Build ${{ matrix.target }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: ubuntu-24.04
|
|
target: x86_64-unknown-linux-gnu
|
|
- runner: macos-15
|
|
target: aarch64-apple-darwin
|
|
runs-on: ${{ matrix.runner }}
|
|
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Install Linux build requirements
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
clang-18 libc++-18-dev libc++abi-18-dev lld-18 \
|
|
libseccomp-dev cmake ninja-build pkg-config
|
|
|
|
- name: Configure
|
|
env:
|
|
CC: ${{ runner.os == 'Linux' && 'clang-18' || 'clang' }}
|
|
CXX: ${{ runner.os == 'Linux' && 'clang++-18' || 'clang++' }}
|
|
CXXFLAGS: ${{ runner.os == 'Linux' && '-stdlib=libc++' || '' }}
|
|
LDFLAGS: ${{ runner.os == 'Linux' && '-stdlib=libc++ -fuse-ld=lld' || '' }}
|
|
run: cmake --preset release
|
|
|
|
- name: Verify packaging runtime
|
|
run: python3 --version
|
|
|
|
- name: Build
|
|
run: cmake --build --preset release --parallel 2
|
|
|
|
- name: Verify release tag identity
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
env:
|
|
RELEASE_TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
version="$(build/release/src/glove --version)"
|
|
version="${version#glove }"
|
|
[[ "$RELEASE_TAG" == "v$version" ]] || {
|
|
printf 'tag %s does not match embedded Glove version %s\n' \
|
|
"$RELEASE_TAG" "$version" >&2
|
|
exit 1
|
|
}
|
|
[[ "$(build/release/src/gloved --version)" == "gloved $version" ]]
|
|
|
|
- name: Package
|
|
run: |
|
|
chmod +x scripts/package-release.sh
|
|
scripts/package-release.sh \
|
|
--target "${{ matrix.target }}" \
|
|
--binary-dir build/release/src \
|
|
--output-dir dist \
|
|
--source-revision "$GITHUB_SHA"
|
|
|
|
- name: Attest release archive
|
|
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
|
|
with:
|
|
subject-path: dist/*.tar.gz
|
|
|
|
- name: Upload build
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: glove-${{ matrix.target }}
|
|
path: |
|
|
dist/*.tar.gz
|
|
dist/*.sha256
|
|
if-no-files-found: error
|
|
|
|
publish:
|
|
name: Publish immutable assets
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
needs: build
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- name: Download builds
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Publish release assets
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
mapfile -t assets < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.sha256' \) | sort)
|
|
(( ${#assets[@]} > 0 ))
|
|
if gh release view "$TAG" >/dev/null 2>&1; then
|
|
draft="$(gh release view "$TAG" --json isDraft --jq .isDraft)"
|
|
[[ "$draft" == "true" ]] || {
|
|
printf 'release %s is already immutable and published\n' "$TAG" >&2
|
|
exit 1
|
|
}
|
|
else
|
|
gh release create "$TAG" --draft --verify-tag --generate-notes
|
|
fi
|
|
gh release upload "$TAG" "${assets[@]}"
|
|
gh release edit "$TAG" --draft=false
|