Skip to content

Commit 40fabb3

Browse files
featherbreadfeatherbread
committed
Re-port release workflow changes
Now, I have a better mechanism to test the workflow. I've also finally set up a GPG key and added it as a secret to the repo, so we can test signing.
1 parent 59b90a2 commit 40fabb3

File tree

4 files changed

+121
-83
lines changed

4 files changed

+121
-83
lines changed

‎.github/workflows/build-release-archives.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77

88
env:
99
CARGO_TERM_COLOR: always
10+
CARGO_ABOUT_VERSION: '0.6.6'
1011

1112
jobs:
1213
build-doc:
@@ -16,10 +17,10 @@ jobs:
1617
uses: actions/checkout@v4
1718
- name: Install cargo-about
1819
run: |
19-
version=0.6.6
20-
slug=cargo-about-$version-x86_64-unknown-linux-musl
21-
wget https://github.com/EmbarkStudios/cargo-about/releases/download/$version/$slug.tar.gz
22-
tar -xvf $slug.tar.gz --strip-components=1 $slug/cargo-about
20+
version="$CARGO_ABOUT_VERSION"
21+
slug="cargo-about-$version-x86_64-unknown-linux-musl"
22+
wget "https://github.com/EmbarkStudios/cargo-about/releases/download/$version/$slug.tar.gz"
23+
tar -xvf "$slug.tar.gz" --strip-components=1 $slug/cargo-about
2324
mv cargo-about "$HOME/.cargo/bin/"
2425
- name: Generate LICENSES.html
2526
run: make doc/LICENSES.html

‎.github/workflows/deep-tests.yml‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
env:
99
CARGO_TERM_COLOR: always
1010
CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
11+
NEXTEST_VERSION: '0.9'
1112

1213
jobs:
1314
cargo-publish-dry-run:
@@ -24,12 +25,31 @@ jobs:
2425
- name: Try Publishing
2526
run: cargo publish --dry-run
2627

28+
read-msrv:
29+
runs-on: ubuntu-24.04
30+
steps:
31+
- name: Checkout
32+
uses: actions/checkout@v4
33+
- name: Read MSRV
34+
id: read-msrv
35+
run: |
36+
msrv="$(cargo metadata --no-deps --format-version=1 | jq -r '.packages[0].rust_version')"
37+
echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
38+
outputs:
39+
msrv: ${{ steps.read-msrv.outputs.msrv }}
40+
2741
stable-msrv-test:
42+
needs: read-msrv
2843
strategy:
2944
fail-fast: false
3045
matrix:
31-
runner: [ubuntu-24.04, macos-14, windows-2022]
32-
toolchain: [stable, '1.70.0']
46+
runner:
47+
- ubuntu-24.04
48+
- macos-14
49+
- windows-2022
50+
toolchain:
51+
- stable
52+
- ${{ needs.read-msrv.outputs.msrv }}
3353
runs-on: ${{ matrix.runner }}
3454
steps:
3555
- name: Checkout
@@ -57,6 +77,6 @@ jobs:
5777
rustup default nightly
5878
rustc --version
5979
- name: Download Nextest
60-
run: curl -LsSf https://get.nexte.st/0.9/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
80+
run: curl -LsSf "https://get.nexte.st/$NEXTEST_VERSION/linux" | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
6181
- name: Test in Miri
6282
run: cargo miri nextest run -j num-cpus

‎.github/workflows/main-tests.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,10 @@ jobs:
3535
uses: actions/checkout@v4
3636
- name: Download Toolchain
3737
run: |
38+
msrv="$(cargo metadata --no-deps --format-version=1 | jq -r '.packages[0].rust_version')"
3839
rustup set profile minimal
39-
rustup toolchain install 1.70.0
40-
rustup default 1.70.0
40+
rustup toolchain install "$msrv"
41+
rustup default "$msrv"
4142
rustc --version
4243
- name: Check
4344
run: cargo check

‎.github/workflows/release-process.yml‎

Lines changed: 90 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ name: Release Process
33

44
on:
55
push:
6-
branches: [start-release]
6+
branches:
7+
- start-release
8+
- check-release
79

810
env:
911
CARGO_TERM_COLOR: always
@@ -56,76 +58,90 @@ jobs:
5658
permissions:
5759
contents: write
5860

59-
# merge-release:
60-
# needs:
61-
# - check-release-branch
62-
# - run-deep-tests
63-
# - build-archives
64-
# runs-on: ubuntu-24.04
65-
# permissions:
66-
# contents: write
67-
# steps:
68-
# - name: Checkout
69-
# uses: actions/checkout@v4
70-
# with:
71-
# filter: blob:none
72-
# fetch-depth: 0
73-
# - name: Import Signing Key
74-
# run: gpg --batch --import <<< "$GPG_PRIVATE_KEY"
75-
# env:
76-
# GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
77-
# - name: Merge Release
78-
# run: |
79-
# set -x
80-
81-
# release_branch="${{ needs.check-release-branch.outputs.release_branch }}"
82-
# release_tag="${{ needs.check-release-branch.outputs.release_tag }}"
83-
# gpg_key_id="${{ vars.GPG_KEY_ID }}"
84-
85-
# git config --global user.name "github-actions[bot]"
86-
# git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
87-
88-
# git tag -asu "$gpg_key_id" -m "$release_tag" "$release_tag"
89-
90-
# git checkout main
91-
# git merge --ff-only "$release_branch"
92-
93-
# git push origin main "$release_tag" :"$release_branch"
94-
95-
# create-github-release:
96-
# needs:
97-
# - check-release-branch
98-
# - build-archives
99-
# - merge-release
100-
# runs-on: ubuntu-24.04
101-
# permissions:
102-
# contents: write
103-
# steps:
104-
# - name: Download Artifacts
105-
# uses: actions/download-artifact@v4
106-
# with:
107-
# name: release
108-
# - name: List Artifacts
109-
# run: ls -lR
110-
# - name: Create Release
111-
# uses: softprops/action-gh-release@v2
112-
# with:
113-
# tag_name: ${{ needs.check-release-branch.outputs.release_tag }}
114-
# files: |
115-
# xt-*.tar.gz
116-
# SHA256SUMS
117-
# body: >-
118-
# **[See the xt CHANGELOG][changelog] for release information.**
119-
120-
121-
# Binary releases of xt are available for Linux and macOS as
122-
# attachments to this GitHub Release. They are statically linked (on
123-
# Linux), or link only to the platform's standard libraries (on macOS).
124-
# Before using them, review the [Installation][install] section of the
125-
# xt README. Your platform may support a more robust installation
126-
# mechanism.
127-
128-
129-
# [changelog]: https://github.com/ahamlinman/xt/blob/main/CHANGELOG.md
130-
131-
# [install]: https://github.com/ahamlinman/xt?tab=readme-ov-file#installation
61+
merge-release:
62+
needs:
63+
- check-release-branch
64+
- run-deep-tests
65+
- build-archives
66+
runs-on: ubuntu-24.04
67+
permissions:
68+
contents: write
69+
env:
70+
RELEASE_BRANCH: ${{ needs.check-release-branch.outputs.release_branch }}
71+
RELEASE_TAG: ${{ needs.check-release-branch.outputs.release_tag }}
72+
GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}
73+
steps:
74+
- name: Checkout
75+
uses: actions/checkout@v4
76+
with:
77+
filter: blob:none
78+
fetch-depth: 0
79+
- name: Import Signing Key
80+
run: gpg --batch --import <<< "$GPG_PRIVATE_KEY"
81+
env:
82+
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
83+
- name: Merge Release
84+
run: |
85+
set -x
86+
87+
git config --global user.name "github-actions[bot]"
88+
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
89+
90+
git tag -asu "$GPG_KEY_ID" -m "$RELEASE_TAG" "$RELEASE_TAG"
91+
92+
git checkout main
93+
git merge --ff-only "$RELEASE_BRANCH"
94+
95+
# So far, none of the intermediate state of the release should be exposed
96+
# outside of the GitHub workflow.
97+
#
98+
# THIS STEP IS THE POINT OF NO RETURN.
99+
# IT IS THE ATOMIC MOMENT AT WHICH THE RELEASE OCCURS AND CANNOT BE REVOKED.
100+
#
101+
# Any failures after this point MUST be possible to recover from manually.
102+
# For example, the GitHub release can be cut by hand using archives uploaded
103+
# to the workflow run, and the crate can be published from a local checkout
104+
# of the tag.
105+
- name: Push Release
106+
if: ${{ github.ref == 'refs/heads/start-release' }}
107+
run: |
108+
git push --atomic origin main "$RELEASE_TAG" :"$RELEASE_BRANCH"
109+
110+
create-github-release:
111+
if: ${{ github.ref == 'refs/heads/start-release' }}
112+
needs:
113+
- check-release-branch
114+
- build-archives
115+
- merge-release
116+
runs-on: ubuntu-24.04
117+
permissions:
118+
contents: write
119+
steps:
120+
- name: Download Artifacts
121+
uses: actions/download-artifact@v4
122+
with:
123+
name: release
124+
- name: List Artifacts
125+
run: ls -lR
126+
- name: Create Release
127+
uses: softprops/action-gh-release@v2
128+
with:
129+
tag_name: ${{ needs.check-release-branch.outputs.release_tag }}
130+
files: |
131+
xt-*.tar.gz
132+
SHA256SUMS
133+
body: >-
134+
**[See the xt CHANGELOG][changelog] for release information.**
135+
136+
137+
Binary releases of xt are available for Linux and macOS as
138+
attachments to this GitHub Release. They are statically linked (on
139+
Linux), or link only to the platform's standard libraries (on macOS).
140+
Before using them, review the [Installation][install] section of the
141+
xt README. Your platform may support a more robust installation
142+
mechanism.
143+
144+
145+
[changelog]: https://github.com/ahamlinman/xt/blob/main/CHANGELOG.md
146+
147+
[install]: https://github.com/ahamlinman/xt?tab=readme-ov-file#installation

0 commit comments

Comments
 (0)