Build(deps): bump rust from 77fac8b to 0e2bcae
#44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container | |
| # Build a multi-arch (amd64 + arm64) image and publish it to GHCR on version | |
| # tags. Pull requests that touch the container setup build it without pushing, | |
| # so the Dockerfile and multi-arch build are validated before release. | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| pull_request: | |
| paths: | |
| - "Dockerfile" | |
| - ".dockerignore" | |
| - ".github/workflows/container.yml" | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: container-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE: ${{ github.repository }} | |
| jobs: | |
| image: | |
| name: build and push image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # Pull requests are build-only. On a release tag, reject a mismatched | |
| # manifest/lockfile/changelog before Docker can publish any image. | |
| - name: Validate release tag | |
| if: github.event_name == 'push' | |
| env: | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: | | |
| python3 - <<'PY' | |
| import datetime | |
| import os | |
| import re | |
| import tomllib | |
| tag = os.environ["RELEASE_TAG"] | |
| match = re.fullmatch( | |
| r"v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", | |
| tag, | |
| ) | |
| if match is None: | |
| raise SystemExit(f"release tag is not strict vMAJOR.MINOR.PATCH: {tag}") | |
| version = tag[1:] | |
| with open("Cargo.toml", "rb") as file: | |
| manifest_version = str(tomllib.load(file)["package"]["version"]) | |
| if manifest_version != version: | |
| raise SystemExit( | |
| f"tag {tag} does not match Cargo.toml version {manifest_version}" | |
| ) | |
| with open("Cargo.lock", "rb") as file: | |
| lockfile = tomllib.load(file) | |
| root_versions = [ | |
| str(package["version"]) | |
| for package in lockfile["package"] | |
| if package["name"] == "alighieri" and "source" not in package | |
| ] | |
| if root_versions != [version]: | |
| raise SystemExit( | |
| f"tag {tag} does not match the root Cargo.lock package: " | |
| f"{root_versions!r}" | |
| ) | |
| with open("CHANGELOG.md", encoding="utf-8") as file: | |
| changelog = file.read() | |
| dates = re.findall( | |
| rf"(?m)^## \[{re.escape(version)}\] - " | |
| r"([0-9]{4}-[0-9]{2}-[0-9]{2})\s*$", | |
| changelog, | |
| ) | |
| if len(dates) != 1: | |
| raise SystemExit( | |
| f"CHANGELOG.md must contain exactly one dated [{version}] heading" | |
| ) | |
| datetime.date.fromisoformat(dates[0]) | |
| PY | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE }} | |
| flavor: latest=false | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| - name: Build and push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| # Pull requests validate the build only; tag pushes publish. | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |