chore(release): bump workspace to 0.6.1 (publish Kalman obs, delevera… #10
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tokenless publishing via OIDC "Trusted Publishing" — no secrets to store or rotate. | |
| # Each registry trusts THIS workflow directly; GitHub mints a short-lived identity per | |
| # run. Configure the trusted publisher once per registry (see RELEASING.md), then a tag | |
| # is all it takes. Each job is gated on a repo VARIABLE, so the workflow is safe to land | |
| # before anything is configured: | |
| # PUBLISH_CRATES=true · PUBLISH_NPM=true · PUBLISH_PYPI=true | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC for crates.io + PyPI trusted publishing, and npm provenance | |
| jobs: | |
| crates: | |
| name: crates.io (openoutcry + openoutcry-wasm) | |
| if: ${{ vars.PUBLISH_CRATES == 'true' }} | |
| runs-on: ubuntu-latest | |
| environment: crates | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: "1.96.0" | |
| # Exchanges the GitHub OIDC identity for a short-lived crates.io token. | |
| - uses: rust-lang/crates-io-auth-action@v1 | |
| id: auth | |
| # Publish in dependency order: `openoutcry` first (it depends only on the already | |
| # published sharpebench-* crates), then `openoutcry-wasm` (depends on openoutcry). | |
| # `cargo publish -p` waits for the index, so the next crate resolves. The | |
| # skip-if-published guard makes a re-run idempotent. | |
| - name: Publish to crates.io (dependency order, idempotent) | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| run: | | |
| UA="openoutcry-release (general-liquidity)" # crates.io rejects requests without a User-Agent | |
| V="$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')" | |
| for c in openoutcry openoutcry-wasm; do | |
| if curl -s -A "$UA" "https://crates.io/api/v1/crates/$c/$V" | grep -q "\"num\":\"$V\""; then | |
| echo "✓ $c@$V already on crates.io — skipping" | |
| else | |
| echo "→ publishing $c@$V" | |
| cargo publish -p "$c" --locked | |
| fi | |
| done | |
| npm: | |
| name: npm (@general-liquidity/openoutcry) | |
| if: ${{ vars.PUBLISH_NPM == 'true' }} | |
| runs-on: ubuntu-latest | |
| environment: npm | |
| steps: | |
| - uses: actions/checkout@v6 | |
| # The npm package ships the compiled WASM kernel, so build it fresh first. | |
| - name: Install Rust (pinned) + wasm target | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: "1.96.0" | |
| targets: wasm32-unknown-unknown | |
| - name: Install wasm-pack | |
| run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| - name: Build the WASM kernel (nodejs target) | |
| run: wasm-pack build crates/openoutcry-wasm --target nodejs --out-dir ../../npm/openoutcry/pkg --out-name openoutcry | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| # npm trusted publishing (OIDC) needs npm >= 11.5; provenance is automatic. | |
| - run: npm install -g npm@latest | |
| - name: Publish (skip if version exists) | |
| working-directory: npm/openoutcry | |
| run: | | |
| npm install | |
| npm run build | |
| V=$(node -p "require('./package.json').version") | |
| if npm view "@general-liquidity/openoutcry@$V" version >/dev/null 2>&1; then | |
| echo "@general-liquidity/openoutcry@$V already published — skipping" | |
| else | |
| npm publish --access public | |
| fi | |
| pypi: | |
| name: PyPI (openoutcry wheel) | |
| if: ${{ vars.PUBLISH_PYPI == 'true' }} | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build manylinux wheels + sdist | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| command: build | |
| args: --release --out dist --interpreter 3.10 3.11 3.12 3.13 --manifest-path crates/openoutcry-py/Cargo.toml | |
| manylinux: auto | |
| - name: Build sdist | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| command: sdist | |
| args: --out dist --manifest-path crates/openoutcry-py/Cargo.toml | |
| # Trusted publishing — configure the PyPI publisher for repo `openoutcry`, | |
| # workflow `release.yml`, environment `pypi`. No token needed. | |
| - name: Publish to PyPI (OIDC) | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| packages-dir: dist | |
| # Idempotent re-runs: a version already on PyPI is skipped, not an error | |
| # (matches the crates + npm skip-if-published guards in this workflow). | |
| skip-existing: true |