Release #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| backfill_github_releases: | |
| description: Create or update GitHub Releases for every stable tag | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: read | |
| packages: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| verify: | |
| name: Verify Release Metadata | |
| runs-on: ubuntu-latest | |
| outputs: | |
| release_tag: ${{ steps.release.outputs.release_tag }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch Protected Main | |
| run: git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main | |
| - name: Verify Release Commit Provenance | |
| run: ./scripts/check-release-provenance.sh "$GITHUB_SHA" origin/main | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - name: Cache Cargo Artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Resolve Release Tag | |
| id: release | |
| run: | | |
| if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then | |
| version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -n1)" | |
| echo "release_tag=v${version}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Check Release Metadata | |
| run: ./scripts/check-release.sh "${{ steps.release.outputs.release_tag }}" | |
| - name: List hubuum_client Package Contents | |
| run: cargo package --list -p hubuum_client | |
| required-checks: | |
| name: Required Release Checks | |
| needs: verify | |
| permissions: | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/ci.yml | |
| with: | |
| run_semver: true | |
| secrets: inherit | |
| publish-hubuum-client: | |
| name: Publish hubuum_client | |
| runs-on: ubuntu-latest | |
| needs: | |
| - verify | |
| - required-checks | |
| if: github.event_name == 'push' | |
| environment: release | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo Artifacts | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Authenticate to crates.io | |
| id: auth | |
| uses: rust-lang/crates-io-auth-action@v1 | |
| - name: Check whether hubuum_client is already published | |
| id: published | |
| run: | | |
| version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -n1)" | |
| tmpdir="$(mktemp -d)" | |
| mkdir -p "${tmpdir}/src" | |
| printf "" > "${tmpdir}/src/lib.rs" | |
| printf '%s\n' \ | |
| '[package]' \ | |
| 'name = "hubuum-client-release-probe"' \ | |
| 'version = "0.0.0"' \ | |
| 'edition = "2024"' \ | |
| '' \ | |
| '[dependencies]' \ | |
| "hubuum_client = \"=${version}\"" \ | |
| > "${tmpdir}/Cargo.toml" | |
| if cargo metadata --manifest-path "${tmpdir}/Cargo.toml" --format-version 1 >/dev/null 2>&1; then | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Publish hubuum_client | |
| if: steps.published.outputs.published != 'true' | |
| run: | | |
| set +e | |
| output="$(cargo publish -p hubuum_client --locked 2>&1)" | |
| status=$? | |
| set -e | |
| printf '%s\n' "$output" | |
| if [ "$status" -eq 0 ]; then | |
| exit 0 | |
| fi | |
| if printf '%s\n' "$output" | grep -Fq "already exists on crates.io index"; then | |
| exit 0 | |
| fi | |
| exit "$status" | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| github-release: | |
| name: Publish GitHub Release | |
| runs-on: ubuntu-latest | |
| needs: | |
| - verify | |
| - publish-hubuum-client | |
| if: >- | |
| always() && | |
| needs.verify.result == 'success' && | |
| ((github.event_name == 'push' && needs.publish-hubuum-client.result == 'success') || | |
| (github.event_name == 'workflow_dispatch' && inputs.backfill_github_releases)) | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout All Tags | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Create or Update GitHub Release | |
| if: github.event_name == 'push' | |
| run: ./scripts/publish-github-release.sh "${{ needs.verify.outputs.release_tag }}" --latest | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| - name: Create or Update Stable GitHub Releases | |
| if: github.event_name == 'workflow_dispatch' | |
| run: ./scripts/backfill-github-releases.sh | |
| env: | |
| GH_TOKEN: ${{ github.token }} |