feat: improve orchestrate preflight setup #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This file is maintained alongside dist-workspace.toml. | |
| # The user triggers a real release by pushing a version tag; ordinary pushes run the plan check only. | |
| name: Release | |
| permissions: | |
| contents: write | |
| on: | |
| push: | |
| pull_request: | |
| env: | |
| CARGO_DIST_VERSION: "0.31.0" | |
| jobs: | |
| dist-plan: | |
| name: dist plan | |
| runs-on: ubuntu-22.04 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install dist | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh | |
| - name: Install dist | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| irm https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.ps1 | iex | |
| - name: Plan release artifacts | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| dist host --steps=create --tag="${GITHUB_REF_NAME}" --output-format=json > dist-plan.json | |
| else | |
| dist plan --output-format=json > dist-plan.json | |
| fi | |
| jq . dist-plan.json > /dev/null | |
| - name: Upload dist plan | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-plan | |
| path: dist-plan.json | |
| build-local-artifacts: | |
| name: build ${{ matrix.target }} | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: dist-plan | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: aarch64-apple-darwin | |
| runner: macos-latest | |
| - target: x86_64-apple-darwin | |
| runner: macos-latest | |
| - target: aarch64-unknown-linux-gnu | |
| runner: ubuntu-22.04 | |
| zigbuild: true | |
| - target: x86_64-unknown-linux-gnu | |
| runner: ubuntu-22.04 | |
| zigbuild: true | |
| - target: x86_64-pc-windows-msvc | |
| runner: windows-latest | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust target | |
| run: rustup target add ${{ matrix.target }} | |
| - name: Install dist | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh | |
| - name: Install dist | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| irm https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.ps1 | iex | |
| - name: Install cargo-zigbuild for glibc-pinned Linux | |
| if: matrix.zigbuild == true | |
| shell: bash | |
| run: | | |
| python3 -m pip install --user cargo-zigbuild | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| - name: Build macOS binary for signing | |
| if: contains(matrix.target, 'apple-darwin') | |
| shell: bash | |
| run: | | |
| cargo build --release --target=${{ matrix.target }} -p deadreckon | |
| - name: Codesign and notarize macOS binary | |
| if: contains(matrix.target, 'apple-darwin') | |
| shell: bash | |
| env: | |
| APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }} | |
| APPLE_CERT_PWD: ${{ secrets.APPLE_CERT_PWD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_PWD: ${{ secrets.APPLE_APP_PWD }} | |
| run: | | |
| if [[ -z "${APPLE_CERT_P12:-}" ]]; then | |
| echo "::warning::APPLE_CERT_P12 is not configured; skipping macOS codesign/notarization" | |
| exit 0 | |
| fi | |
| missing=() | |
| for name in APPLE_CERT_PWD APPLE_ID APPLE_TEAM_ID APPLE_APP_PWD; do | |
| if [[ -z "${!name:-}" ]]; then | |
| missing+=("$name") | |
| fi | |
| done | |
| if (( ${#missing[@]} > 0 )); then | |
| echo "::warning::missing Apple notarization secrets: ${missing[*]}; skipping macOS codesign/notarization" | |
| exit 0 | |
| fi | |
| binary="target/${{ matrix.target }}/release/deadreckon" | |
| keychain="$RUNNER_TEMP/deadreckon-signing.keychain-db" | |
| cert="$RUNNER_TEMP/developer-id.p12" | |
| zip="$RUNNER_TEMP/deadreckon-${{ matrix.target }}.zip" | |
| echo "$APPLE_CERT_P12" | base64 -D > "$cert" | |
| security create-keychain -p "" "$keychain" | |
| security set-keychain-settings -lut 21600 "$keychain" | |
| security unlock-keychain -p "" "$keychain" | |
| security import "$cert" -k "$keychain" -P "$APPLE_CERT_PWD" -T /usr/bin/codesign | |
| security list-keychains -d user -s "$keychain" login.keychain-db | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "$keychain" | |
| codesign --sign "Developer ID Application" --options runtime --timestamp "$binary" | |
| codesign --verify --verbose "$binary" | |
| ditto -c -k --keepParent "$binary" "$zip" | |
| xcrun notarytool submit "$zip" \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --password "$APPLE_APP_PWD" \ | |
| --wait | |
| - name: Build target artifacts | |
| run: | | |
| dist build --tag=${{ github.ref_name }} --artifacts=local --target=${{ matrix.target }} --output-format=json > dist-manifest-${{ matrix.target }}.json | |
| - name: Upload target artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-local-${{ matrix.target }} | |
| path: | | |
| target/distrib/** | |
| dist-manifest-${{ matrix.target }}.json | |
| build-global-artifacts: | |
| name: build installers and checksums | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: | |
| - dist-plan | |
| - build-local-artifacts | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install dist | |
| shell: bash | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Download local artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: dist-local-* | |
| path: target/distrib | |
| merge-multiple: true | |
| - name: Build global artifacts | |
| run: | | |
| dist build --tag=${{ github.ref_name }} --artifacts=global --output-format=json > dist-manifest-global.json | |
| - name: Patch Homebrew formula receipt | |
| run: | | |
| node release/homebrew/patch-formula.mjs target/distrib | |
| - name: Upload global artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-global | |
| path: | | |
| target/distrib/** | |
| dist-manifest-global.json | |
| publish-github-release: | |
| name: publish GitHub release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: | |
| - dist-plan | |
| - build-local-artifacts | |
| - build-global-artifacts | |
| runs-on: ubuntu-22.04 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install dist | |
| shell: bash | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: dist-* | |
| path: target/distrib | |
| merge-multiple: true | |
| - name: Upload and announce release | |
| run: | | |
| dist host --steps=upload,release,announce --tag=${{ github.ref_name }} | |
| publish-homebrew-formula: | |
| name: publish Homebrew formula | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: | |
| - publish-github-release | |
| runs-on: ubuntu-22.04 | |
| env: | |
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| steps: | |
| - name: Check Homebrew tap token | |
| shell: bash | |
| run: | | |
| if [[ -z "${HOMEBREW_TAP_TOKEN:-}" ]]; then | |
| echo "::error::HOMEBREW_TAP_TOKEN is required to publish gdc/homebrew-tap formulae" | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: gdc/homebrew-tap | |
| token: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| path: homebrew-tap | |
| - name: Download patched formula | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: dist-global | |
| path: target/distrib | |
| - name: Commit formula | |
| shell: bash | |
| run: | | |
| mkdir -p homebrew-tap/Formula | |
| cp target/distrib/*.rb homebrew-tap/Formula/ | |
| cd homebrew-tap | |
| git config user.name "deadreckon release bot" | |
| git config user.email "release-bot@users.noreply.github.com" | |
| if git diff --quiet -- Formula; then | |
| echo "No Homebrew formula changes to publish" | |
| exit 0 | |
| fi | |
| git add Formula/*.rb | |
| git commit -m "deadreckon ${GITHUB_REF_NAME#v}" | |
| git push | |
| publish-npm: | |
| name: publish npm packages | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: | |
| - publish-github-release | |
| uses: ./.github/workflows/publish-npm.yml | |
| with: | |
| tag: ${{ github.ref_name }} | |
| secrets: inherit |