test(e2e): activate a runtime explicitly in the shared pre-warm tree … #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag (e.g. v0.1.0)" | |
| required: true | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Production trust gate — dormant until the owner sets the repository variable | |
| # ROCM_CLI_REQUIRE_PRODUCTION_TRUST (e.g. "1") and provides the trust inputs | |
| # below. While the variable is unset/falsy, release_readiness.py skips | |
| # validate_production_trust() and behavior is unchanged. The values are public | |
| # keys and paths (not the private signing key, which stays step-scoped). When | |
| # enabling the gate, the recipe-index inputs also require a step that | |
| # materializes the hosted index + its .sig into the workspace. | |
| ROCM_CLI_REQUIRE_PRODUCTION_TRUST: ${{ vars.ROCM_CLI_REQUIRE_PRODUCTION_TRUST }} | |
| ROCM_CLI_SIGNING_PUBLIC_KEY_PEM: ${{ secrets.ROCM_CLI_SIGNING_PUBLIC_KEY_PEM }} | |
| ROCM_CLI_METADATA_PUBLIC_KEY_PEM: ${{ secrets.ROCM_CLI_METADATA_PUBLIC_KEY_PEM }} | |
| ROCM_CLI_MODEL_RECIPE_INDEX_PATH: ${{ vars.ROCM_CLI_MODEL_RECIPE_INDEX_PATH }} | |
| ROCM_CLI_MODEL_RECIPE_INDEX_PUBLIC_KEY_PATH: ${{ vars.ROCM_CLI_MODEL_RECIPE_INDEX_PUBLIC_KEY_PATH }} | |
| jobs: | |
| release: | |
| name: Build Linux release assets | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version.outputs.value }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| - name: Verify pinned keys match the signing key | |
| run: cargo xtask verify-pinned-keys | |
| - name: Determine version | |
| id: version | |
| run: | | |
| VERSION="${{ github.event.inputs.tag }}" | |
| if [ -z "${VERSION}" ]; then | |
| VERSION="${GITHUB_REF_NAME}" | |
| fi | |
| case "${VERSION}" in | |
| v*) ;; | |
| *) | |
| echo "release version must be a tag beginning with v, got: ${VERSION}" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| case "${VERSION}" in | |
| */*|*\\*) | |
| echo "release version must not contain path separators, got: ${VERSION}" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| echo "value=${VERSION}" >> "$GITHUB_OUTPUT" | |
| - name: Cache Cargo home and build artifacts | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/.cargo/bin | |
| ~/.cargo/registry/cache | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/src | |
| ~/.cargo/rustup | |
| target | |
| key: Linux-manylinux-release-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }} | |
| restore-keys: | | |
| Linux-manylinux-release- | |
| - name: Build release binaries | |
| run: | | |
| # The bind-mount source must exist and be owned by the runner user; | |
| # Docker would otherwise create it as root, leaving the non-root | |
| # container user unable to write into CARGO_HOME/RUSTUP_HOME. | |
| mkdir -p "$HOME/.cargo" | |
| # Install system build deps as root: yum needs to write to | |
| # /var/cache/yum and the RPM db, which a non-root container user | |
| # cannot do. These land in the container's ephemeral layer (not the | |
| # bind mount), so this runs every time; only the Cargo/rustup state | |
| # below is cached. | |
| docker run --rm \ | |
| -v "$PWD":/work \ | |
| -w /work \ | |
| quay.io/pypa/manylinux2014_x86_64 \ | |
| /bin/bash -lc ' | |
| set -euo pipefail | |
| yum install -y pkgconfig libcap-devel | |
| ' | |
| # Build as the runner user so cached Cargo/rustup files are owned by | |
| # the runner (the host-side cache save step must be able to read them). | |
| docker run --rm \ | |
| -u "$(id -u):$(id -g)" \ | |
| -e CARGO_HOME=/host-cargo \ | |
| -e RUSTUP_HOME=/host-cargo/rustup \ | |
| -v "$HOME/.cargo":/host-cargo \ | |
| -v "$PWD":/work \ | |
| -w /work \ | |
| quay.io/pypa/manylinux2014_x86_64 \ | |
| /bin/bash -lc ' | |
| set -euo pipefail | |
| if [ ! -f /host-cargo/bin/cargo ]; then | |
| curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain none --no-modify-path | |
| fi | |
| export PATH="/host-cargo/bin:$PATH" | |
| cargo build --release -p rocm -p rocmd -p xtask | |
| ' | |
| - name: Package release bundle | |
| env: | |
| ROCM_CLI_SIGNING_PRIVATE_KEY_PEM: ${{ secrets.ROCM_CLI_SIGNING_PRIVATE_KEY_PEM }} | |
| ROCM_CLI_REQUIRE_SIGNATURE: "1" | |
| run: | | |
| VERSION="${{ steps.version.outputs.value }}" | |
| DIST="rocm-cli-${VERSION}-linux-amd64" | |
| chmod +x install.sh | |
| cargo xtask package "${DIST}" | |
| cp "dist/${DIST}.tar.gz" dist/rocm-cli-linux-amd64.tar.gz | |
| (cd dist && sha256sum rocm-cli-linux-amd64.tar.gz > rocm-cli-linux-amd64.tar.gz.sha256) | |
| if [ -f "dist/${DIST}.tar.gz.sig" ]; then | |
| cp "dist/${DIST}.tar.gz.sig" dist/rocm-cli-linux-amd64.tar.gz.sig | |
| else | |
| echo "release signature was not produced" >&2 | |
| exit 1 | |
| fi | |
| python scripts/release_readiness.py \ | |
| --dist dist \ | |
| --require-signatures \ | |
| --require-rocm-asset-names \ | |
| --require-exact-assets \ | |
| --asset "${DIST}.tar.gz" \ | |
| --asset rocm-cli-linux-amd64.tar.gz | |
| - name: Create release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.value }}" | |
| gh release create "${VERSION}" \ | |
| --draft \ | |
| --title "rocm-cli ${VERSION}" \ | |
| --notes "$(cat <<EOF | |
| Install the latest stable release on Linux x86_64: | |
| \`\`\`bash | |
| curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh | sh | |
| \`\`\` | |
| Install the latest stable release on Windows x86_64 from PowerShell: | |
| \`\`\`powershell | |
| \$script = "\$env:TEMP\install-rocm-cli.ps1"; irm https://raw.githubusercontent.com/${{ github.repository }}/main/install.ps1 -OutFile \$script; powershell -ExecutionPolicy Bypass -File \$script | |
| \`\`\` | |
| Install a specific tagged release: | |
| \`\`\`bash | |
| curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh | sh -s -- ${VERSION} | |
| \`\`\` | |
| EOF | |
| )" \ | |
| dist/*.tar.gz dist/*.tar.gz.sha256 dist/*.sig | |
| windows-release: | |
| name: Build and upload Windows release | |
| runs-on: windows-latest | |
| needs: release | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| - name: Verify pinned keys match the signing key | |
| shell: pwsh | |
| run: cargo xtask verify-pinned-keys | |
| - name: Build release binaries | |
| shell: pwsh | |
| run: cargo build --release -p rocm -p rocmd -p xtask | |
| - name: Package Windows bundle | |
| shell: pwsh | |
| env: | |
| ROCM_CLI_SIGNING_PRIVATE_KEY_PEM: ${{ secrets.ROCM_CLI_SIGNING_PRIVATE_KEY_PEM }} | |
| ROCM_CLI_REQUIRE_SIGNATURE: "1" | |
| run: | | |
| $version = "${{ needs.release.outputs.version }}" | |
| $dist = "rocm-cli-$version-windows-amd64" | |
| cargo xtask package $dist | |
| Copy-Item "dist\$dist.zip" "dist\rocm-cli-windows-amd64.zip" | |
| $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath "dist\rocm-cli-windows-amd64.zip").Hash.ToLowerInvariant() | |
| Set-Content -LiteralPath "dist\rocm-cli-windows-amd64.zip.sha256" -Value "$hash rocm-cli-windows-amd64.zip" -Encoding ascii | |
| if (Test-Path "dist\$dist.zip.sig") { | |
| Copy-Item "dist\$dist.zip.sig" "dist\rocm-cli-windows-amd64.zip.sig" | |
| } else { | |
| throw "release signature was not produced" | |
| } | |
| python .\scripts\release_readiness.py ` | |
| --dist dist ` | |
| --require-signatures ` | |
| --require-rocm-asset-names ` | |
| --require-exact-assets ` | |
| --asset "$dist.zip" ` | |
| --asset rocm-cli-windows-amd64.zip | |
| - name: Upload Windows release assets | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| $version = "${{ needs.release.outputs.version }}" | |
| $assets = Get-ChildItem dist -File -Include *.zip,*.sha256,*.sig -Recurse | ForEach-Object { $_.FullName } | |
| gh release upload $version @assets --clobber | |
| publish-release: | |
| name: Publish release | |
| runs-on: ubuntu-latest | |
| needs: | |
| - release | |
| - windows-release | |
| steps: | |
| - name: Publish draft release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| run: | | |
| VERSION="${{ needs.release.outputs.version }}" | |
| RELEASE_ID="$(gh release view "${VERSION}" --json databaseId -q .databaseId)" | |
| gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" -f draft=false |