fix: allow release comment job to view drafts (#478) #160
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: {} | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| if: ${{ github.repository_owner == 'x52dev' }} | |
| outputs: | |
| releases: ${{ steps.release-plz.outputs.releases }} | |
| releases_created: ${{ steps.release-plz.outputs.releases_created }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install Rust | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| - name: Authenticate with crates.io | |
| uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 | |
| id: auth | |
| - name: release-plz | |
| uses: MarcoIeni/release-plz-action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131 | |
| id: release-plz | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| - name: Install Nix | |
| if: ${{ steps.release-plz.outputs.releases_created == 'true' }} | |
| uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 | |
| - name: Enter Nix devshell | |
| if: ${{ steps.release-plz.outputs.releases_created == 'true' }} | |
| uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1 | |
| with: | |
| arguments: .#ci-release | |
| - name: Comment on release PR | |
| if: ${{ steps.release-plz.outputs.releases_created == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASES_JSON: ${{ steps.release-plz.outputs.releases }} | |
| run: x52-comment-release-pr "$RELEASES_JSON" "$GITHUB_SHA" | |
| upload-assets: | |
| name: Upload release assets | |
| needs: release | |
| if: ${{ needs.release.outputs.releases_created == 'true' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - { os: macos-latest, target: aarch64-apple-darwin } | |
| - { os: macos-latest, target: universal-apple-darwin } | |
| - { os: macos-latest, target: x86_64-apple-darwin } | |
| - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu } | |
| - { os: ubuntu-latest, target: aarch64-unknown-linux-musl } | |
| # - { os: ubuntu-latest, target: x86_64-unknown-freebsd } # not supported by aws-lc | |
| - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu } | |
| - { os: ubuntu-latest, target: x86_64-unknown-linux-musl } | |
| # - { os: windows-latest, target: aarch64-pc-windows-msvc } # not supported by aws-lc | |
| - { os: windows-latest, target: x86_64-pc-windows-msvc } | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 60 | |
| permissions: | |
| attestations: write | |
| contents: write | |
| id-token: write | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_NET_GIT_FETCH_WITH_CLI: true | |
| CARGO_NET_RETRY: 10 | |
| CARGO_TERM_COLOR: always | |
| RELEASE_TAG: ${{ fromJSON(needs.release.outputs.releases)[0].tag }} | |
| RUST_BACKTRACE: 1 | |
| RUSTUP_MAX_RETRIES: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ env.RELEASE_TAG }} | |
| persist-credentials: false | |
| - name: Install nasm | |
| if: matrix.os == 'windows-latest' | |
| uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2 | |
| - name: Install Rust | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache: false | |
| - uses: taiki-e/setup-cross-toolchain-action@12b7ad4acfa95a1476779d6c06699b96ec1691f8 # v1.42.0 | |
| with: | |
| target: ${{ matrix.target }} | |
| # TODO: see if this is needed after next deploy | |
| # - if: endsWith(matrix.target, 'windows-msvc') | |
| # run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static" >> "${GITHUB_ENV}" | |
| - name: Build and upload to release | |
| id: upload-release | |
| uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1.30.2 | |
| with: | |
| bin: inspect-cert-chain | |
| target: ${{ matrix.target }} | |
| checksum: sha256 | |
| ref: refs/tags/${{ env.RELEASE_TAG }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 | |
| with: | |
| subject-path: "${{ steps.upload-release.outputs.archive }}.*" | |
| release-assets-uploaded: | |
| name: Release assets uploaded | |
| if: ${{ needs.release.outputs.releases_created == 'true' }} | |
| runs-on: ubuntu-latest | |
| needs: | |
| - release | |
| - upload-assets | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 | |
| - name: Enter Nix devshell | |
| uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1 | |
| with: | |
| arguments: .#ci-release | |
| - name: Comment on release PR | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASES_JSON: ${{ needs.release.outputs.releases }} | |
| run: x52-comment-release-assets-uploaded "$RELEASES_JSON" "$GITHUB_SHA" |