cursus/.github/workflows/release-artifacts.yml at 305f84b68751f5f31bb23ff3a41396cabc231b7f · zantarix/cursus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
name: Release Artifacts

on:
  release:
    types: [published]

permissions: {}

jobs:
  check-tag:
    name: Validate release tag
    runs-on: ubuntu-latest
    outputs:
      is_cursus_release: ${{ steps.check.outputs.is_cursus_release }}
    steps:
      - id: check
        name: Check tag format
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$TAG_NAME" =~ ^cursus@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "is_cursus_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_cursus_release=false" >> "$GITHUB_OUTPUT"
          fi

  macos:
    name: Build macOS artifacts
    needs: check-tag
    if: needs.check-tag.outputs.is_cursus_release == 'true'
    runs-on: macos-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    defaults:
      run:
        shell: nix develop -c bash -e {0}

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
        with:
          use-flakehub: false

      - name: Build macOS artifacts
        run: cargo make release-macos

      - name: Upload artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          # Necessary in order to fix a naming issue
          cp target/x86_64-apple-darwin/release/cursus ./cursus-osx-x86_64
          cp target/aarch64-apple-darwin/release/cursus ./cursus-osx-aarch64
          gh release upload "$TAG_NAME" \
            "./cursus-osx-x86_64#cursus-osx-x86_64" \
            "./cursus-osx-aarch64#cursus-osx-aarch64"

      - name: Attest macOS x86_64
        id: attest_osx_x86_64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-osx-x86_64

      - name: Attest macOS aarch64
        id: attest_osx_aarch64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-osx-aarch64

      - name: Upload attestation bundles
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
          BUNDLE_X86_64: ${{ steps.attest_osx_x86_64.outputs.bundle-path }}
          BUNDLE_AARCH64: ${{ steps.attest_osx_aarch64.outputs.bundle-path }}
        run: |
          # actions/attest writes every bundle as `attestation.json`; the Release
          # asset name is taken from the basename, so rename each to match its
          # binary before upload (same naming fix as the binaries themselves).
          cp "$BUNDLE_X86_64" ./cursus-osx-x86_64.sigstore.json
          cp "$BUNDLE_AARCH64" ./cursus-osx-aarch64.sigstore.json
          gh release upload "$TAG_NAME" \
            ./cursus-osx-x86_64.sigstore.json \
            ./cursus-osx-aarch64.sigstore.json

  windows:
    name: Build Windows artifacts
    needs: check-tag
    if: needs.check-tag.outputs.is_cursus_release == 'true'
    runs-on: windows-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    env:
      RUSTFLAGS: "-C target-feature=+crt-static"

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Rust nightly
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: nightly
          targets: x86_64-pc-windows-msvc,aarch64-pc-windows-msvc

      - name: Build Windows artifacts
        run: |
          cargo build --release -p cursus-bin --target x86_64-pc-windows-msvc
          cargo build --release -p cursus-bin --target aarch64-pc-windows-msvc

      - name: Upload artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        shell: bash
        run: |
          # Necessary in order to fix a naming issue
          cp target/x86_64-pc-windows-msvc/release/cursus.exe ./cursus-windows-x86_64.exe
          cp target/aarch64-pc-windows-msvc/release/cursus.exe ./cursus-windows-aarch64.exe
          gh release upload "$TAG_NAME" \
            "./cursus-windows-x86_64.exe#cursus-windows-x86_64.exe" \
            "./cursus-windows-aarch64.exe#cursus-windows-aarch64.exe"

      - name: Attest Windows x86_64
        id: attest_windows_x86_64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-windows-x86_64.exe

      - name: Attest Windows aarch64
        id: attest_windows_aarch64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-windows-aarch64.exe

      - name: Upload attestation bundles
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
          BUNDLE_X86_64: ${{ steps.attest_windows_x86_64.outputs.bundle-path }}
          BUNDLE_AARCH64: ${{ steps.attest_windows_aarch64.outputs.bundle-path }}
        shell: bash
        run: |
          # actions/attest writes every bundle as `attestation.json`; the Release
          # asset name is taken from the basename, so rename each to match its
          # binary before upload (same naming fix as the binaries themselves).
          cp "$BUNDLE_X86_64" ./cursus-windows-x86_64.exe.sigstore.json
          cp "$BUNDLE_AARCH64" ./cursus-windows-aarch64.exe.sigstore.json
          gh release upload "$TAG_NAME" \
            ./cursus-windows-x86_64.exe.sigstore.json \
            ./cursus-windows-aarch64.exe.sigstore.json

  linux:
    name: Build Linux artifacts
    needs: check-tag
    if: needs.check-tag.outputs.is_cursus_release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    defaults:
      run:
        shell: nix develop -c bash -e {0}

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
        with:
          use-flakehub: false

      - name: Build Linux artifacts
        run: cargo make release-linux

      - name: Upload artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          cp target/x86_64-unknown-linux-musl/release/cursus ./cursus-linux-x86_64
          cp target/aarch64-unknown-linux-musl/release/cursus ./cursus-linux-aarch64
          cp target/riscv64gc-unknown-linux-musl/release/cursus ./cursus-linux-riscv64gc
          gh release upload "$TAG_NAME" \
            "./cursus-linux-x86_64#cursus-linux-x86_64" \
            "./cursus-linux-aarch64#cursus-linux-aarch64" \
            "./cursus-linux-riscv64gc#cursus-linux-riscv64gc"

      - name: Attest Linux x86_64
        id: attest_linux_x86_64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-linux-x86_64

      - name: Attest Linux aarch64
        id: attest_linux_aarch64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-linux-aarch64

      - name: Attest Linux riscv64
        id: attest_linux_riscv64
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: ./cursus-linux-riscv64gc

      - name: Upload attestation bundles
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
          BUNDLE_X86_64: ${{ steps.attest_linux_x86_64.outputs.bundle-path }}
          BUNDLE_AARCH64: ${{ steps.attest_linux_aarch64.outputs.bundle-path }}
          BUNDLE_RISCV64: ${{ steps.attest_linux_riscv64.outputs.bundle-path }}
        run: |
          # actions/attest writes every bundle as `attestation.json`; the Release
          # asset name is taken from the basename, so rename each to match its
          # binary before upload (same naming fix as the binaries themselves).
          cp "$BUNDLE_X86_64" ./cursus-linux-x86_64.sigstore.json
          cp "$BUNDLE_AARCH64" ./cursus-linux-aarch64.sigstore.json
          cp "$BUNDLE_RISCV64" ./cursus-linux-riscv64gc.sigstore.json
          gh release upload "$TAG_NAME" \
            ./cursus-linux-x86_64.sigstore.json \
            ./cursus-linux-aarch64.sigstore.json \
            ./cursus-linux-riscv64gc.sigstore.json