docs: configuration.md route/policy section catches up to 1.2.1 (sock… #36
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # On a version tag (e.g. v0.9.0): create the GitHub Release, then cross-compile the busbar | |
| # binary for major targets and attach tarballs to that Release. | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: write # create the Release + upload assets | |
| id-token: write # OIDC identity for keyless Sigstore signing (provenance) | |
| attestations: write # record the build-provenance attestation | |
| jobs: | |
| # Create the Release first so the parallel upload jobs have something to attach to | |
| # (uploading from a matrix without a pre-existing release races → "release not found"). | |
| create-release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Create GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release create "${GITHUB_REF_NAME}" \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --title "busbar ${GITHUB_REF_NAME}" \ | |
| --verify-tag --generate-notes \ | |
| || gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" | |
| # Generate a CycloneDX Software Bill of Materials (every dependency + version + | |
| # license) and attach it to the Release. Lets downstream users answer "is the | |
| # crate in advisory X inside busbar v1.0.1?" without decompiling, and satisfies | |
| # enterprise/government (EO 14028) procurement that increasingly requires an SBOM. | |
| sbom: | |
| needs: create-release | |
| name: sbom (cyclonedx) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-cyclonedx | |
| run: cargo install cargo-cyclonedx --locked | |
| - name: Generate SBOM | |
| run: cargo cyclonedx --format json --override-filename "busbar-${GITHUB_REF_NAME}.cdx" | |
| - name: Attach SBOM to Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # cargo-cyclonedx writes the SBOM next to the package's Cargo.toml. | |
| sbom="$(find . -name "busbar-${GITHUB_REF_NAME}.cdx.json" -print -quit)" | |
| test -n "$sbom" || { echo "SBOM not found"; exit 1; } | |
| gh release upload "${GITHUB_REF_NAME}" "$sbom" \ | |
| --repo "${GITHUB_REPOSITORY}" --clobber | |
| upload-assets: | |
| needs: create-release | |
| name: ${{ matrix.target }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| - target: aarch64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| - target: x86_64-apple-darwin | |
| os: macos-latest | |
| - target: aarch64-apple-darwin | |
| os: macos-latest | |
| - target: x86_64-pc-windows-msvc | |
| os: windows-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Builds --release for the target (installing the toolchain + cross-linker as | |
| # needed), tarballs the `busbar` binary, and uploads it to the Release for this tag. | |
| - name: Build and upload busbar | |
| uses: taiki-e/upload-rust-binary-action@v1 | |
| with: | |
| bin: busbar | |
| target: ${{ matrix.target }} | |
| archive: busbar-$target | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Generate a keyless (Sigstore/OIDC) build-provenance attestation binding THIS | |
| # archive's digest to this workflow run + commit. A user verifies the download with | |
| # gh attestation verify <archive> --repo ${{ github.repository }} | |
| # so a swapped/backdoored artifact on the Release page (the LiteLLM-PyPI scenario) | |
| # fails verification. The glob matches whichever extension was produced (.tar.gz on | |
| # unix, .zip on windows); `archive: busbar-$target` leaves it in the workspace. | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: "busbar-${{ matrix.target }}.*" |