chore: add simple release pipeline (#163)

Author: viviveevee

.github/workflows/release.yml

@@ -0,0 +1,145 @@
+name: Publish
+
+# We have to use gtar on macOS because apple's tar is literally broken.
+# Yes, I know how stupid that sounds. But it's true:
+# https://github.com/actions/virtual-environments/issues/2619
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-[A-Za-z]+.[0-9]+'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # When getting Rust dependencies, retry on network error:
+  CARGO_NET_RETRY: 10
+
+jobs:
+  build_icp:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [ x86_64-apple-darwin, aarch64-apple-darwin, x86_64-unknown-linux-gnu ]
+        # target: [ x86_64-apple-darwin, aarch64-apple-darwin, x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu ] Waiting for repo to be public
+        include:
+          - os: macos-14-large
+            target: x86_64-apple-darwin
+            binary_path: target/x86_64-apple-darwin/release
+            name: x86_64-darwin
+            tar: gtar
+          - os: macos-14
+            target: aarch64-apple-darwin
+            binary_path: target/aarch64-apple-darwin/release
+            name: aarch64-darwin
+            tar: gtar
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            binary_path: target/x86_64-unknown-linux-gnu/release
+            name: x86_64-linux
+            tar: tar
+        #   - os: ubuntu-22.04-arm
+        #     target: aarch64-unknown-linux-gnu
+        #     binary_path: target/aarch64-unknown-linux-gnu/release
+        #     name: aarch64-linux
+        #     tar: tar
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup environment variables
+        run: |
+          echo "RUSTFLAGS=--remap-path-prefix=${GITHUB_WORKSPACE}=/builds/dfinity" >> $GITHUB_ENV
+
+      - name: Set names (tag only)
+        if: github.ref_type == 'tag'
+        run: |
+          REF_NAME_SANITIZED=$(echo "$GITHUB_REF_NAME" | tr '/' '-')
+          echo "TARBALL_FILENAME=icp-cli-$REF_NAME_SANITIZED-${{ matrix.name }}.tar.gz" >> $GITHUB_ENV
+          echo "SHA256_FILENAME=icp-cli-$REF_NAME_SANITIZED-${{ matrix.name }}.tar.gz.sha256" >> $GITHUB_ENV
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            ~/.rustup/
+            target/
+          key: ${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}-publish-1
+
+      - name: Build
+        run: |
+          cargo clean --target ${{ matrix.target }} --release
+          cargo build --target ${{ matrix.target }} --locked --release
+
+      - name: Strip binaries
+        run: |
+          cd ${{ matrix.binary_path }}
+          sudo chown -R $(whoami) .
+          strip icp
+        if: contains(matrix.os, 'ubuntu')
+
+      - name: Create tarball of binaries and sha256 of tarball
+        if: github.ref_type == 'tag'
+        run: |
+          ${{ matrix.tar }} -zcC ${{ matrix.binary_path }} -f ${{ env.TARBALL_FILENAME }} icp
+          shasum -a 256 ${{ env.TARBALL_FILENAME }} > ${{ env.SHA256_FILENAME }}
+          shasum -c ${{ env.SHA256_FILENAME }}
+
+      - name: Upload Artifacts
+        if: github.ref_type == 'tag'
+        uses: actions/upload-artifact@v4
+        with:
+          name: icp-artifacts-${{ hashFiles('rust-toolchain.toml') }}-${{ matrix.name }}
+          path: |
+            ${{ env.TARBALL_FILENAME }}
+            ${{ env.SHA256_FILENAME }}
+
+  aggregate:
+    name: publishable:required
+    if: ${{ always() }}
+    needs: [build_icp]
+    runs-on: ubuntu-latest
+    steps:
+      - name: check build result
+        if: ${{ needs.build_icp.result != 'success' }}
+        run: exit 1
+
+  publish:
+    runs-on: ubuntu-latest
+    if: github.ref_type == 'tag'
+    needs: build_icp
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        name: [ 'x86_64-darwin', 'aarch64-darwin', 'x86_64-linux']
+        # name: [ 'x86_64-darwin', 'aarch64-darwin', 'x86_64-linux', 'aarch64-linux' ]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup environment variables
+        run: echo "VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
+
+      - name: Download Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: icp-artifacts-${{ hashFiles('rust-toolchain.toml') }}-${{ matrix.name }}
+
+      - name: Upload tarball and sha256
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: icp-*.tar.*
+          file_glob: true
+          tag: ${{ env.VERSION }}
+          prerelease: true
+          make_latest: false