chore(main): release 1.1.0 #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v[0-9]+.[0-9]+.[0-9]+*"] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly audit on Mondays at 06:00 UTC | |
| - cron: "0 6 * * 1" | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| check: | |
| name: Check (fmt, clippy, compile) | |
| runs-on: ubuntu-latest | |
| # Skip on scheduled runs (only audit needs the weekly trigger) | |
| if: github.event_name != 'schedule' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - name: Install system dependencies | |
| run: sudo apt-get update && sudo apt-get install -y build-essential libclang-dev clang | |
| - name: Cache Cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check formatting | |
| run: cargo fmt --check | |
| - name: Run Clippy | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Check compilation | |
| run: cargo check | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| needs: check | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install system dependencies | |
| run: sudo apt-get update && sudo apt-get install -y build-essential libclang-dev clang | |
| - name: Cache Cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run tests | |
| run: cargo test | |
| build: | |
| name: Build (release) | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install system dependencies | |
| run: sudo apt-get update && sudo apt-get install -y build-essential libclang-dev clang | |
| - name: Cache Cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Build release binary | |
| run: cargo build --release | |
| - name: Upload release binary | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: pg-migration-lint | |
| path: target/release/pg-migration-lint | |
| if-no-files-found: error | |
| retention-days: 14 | |
| build-bridge: | |
| name: Build Liquibase bridge JAR | |
| runs-on: ubuntu-latest | |
| # Skip on scheduled runs (only audit needs the weekly trigger) | |
| if: github.event_name != 'schedule' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Build fat JAR with Maven (via Docker) | |
| run: | | |
| docker run --rm \ | |
| -v "$PWD/bridge:/build" \ | |
| -w /build \ | |
| maven:3.9-eclipse-temurin-21 \ | |
| sh -c 'mvn package -q -DskipTests && cp target/liquibase-bridge-1.0.0.jar target/liquibase-bridge.jar' | |
| - name: Upload bridge JAR | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: liquibase-bridge | |
| path: bridge/target/liquibase-bridge.jar | |
| if-no-files-found: error | |
| retention-days: 14 | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| needs: [build, build-bridge] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Download release binary | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: pg-migration-lint | |
| path: artifacts | |
| - name: Download bridge JAR | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: liquibase-bridge | |
| path: artifacts | |
| - name: Prepare release assets | |
| run: | | |
| chmod +x artifacts/pg-migration-lint | |
| tar -czf pg-migration-lint-x86_64-linux.tar.gz -C artifacts pg-migration-lint | |
| cp artifacts/liquibase-bridge.jar liquibase-bridge.jar | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Verify version matches Cargo.toml | |
| run: | | |
| cargo_version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/') | |
| tag_version="${{ steps.version.outputs.version }}" | |
| if [ "$cargo_version" != "$tag_version" ]; then | |
| echo "ERROR: Tag version ($tag_version) does not match Cargo.toml version ($cargo_version)" | |
| exit 1 | |
| fi | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| name: v${{ steps.version.outputs.version }} | |
| generate_release_notes: true | |
| files: | | |
| pg-migration-lint-x86_64-linux.tar.gz | |
| liquibase-bridge.jar | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| deny: | |
| name: Deny (licenses, advisories, duplicates) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| audit: | |
| name: Security audit | |
| runs-on: ubuntu-latest | |
| # Run on PRs, pushes to main, and the weekly schedule | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Run audit | |
| run: cargo audit |