release.yml

# adapted from https://github.com/taiki-e/cargo-hack/blob/main/.github/workflows/release.yml

name: Publish releases to GitHub
on:
  push:
    tags:
      - "*"

permissions: {}

jobs:
  nextest-filtering-release:
    permissions:
      contents: write
    environment: release
    if: github.repository_owner == 'nextest-rs' && startsWith(github.ref_name, 'nextest-filtering-')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo release
        uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
        with:
          tool: cargo-release@0.25.0
      - uses: taiki-e/create-gh-release-action@c5baa0b5dc700cf06439d87935e130220a6882d9 # v1.9.3
        with:
          prefix: nextest-filtering
          changelog: nextest-filtering/CHANGELOG.md
          title: $prefix $version
          branch: main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - run: ./scripts/cargo-release-publish.sh
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  nextest-metadata-release:
    permissions:
      contents: write
    environment: release
    if: github.repository_owner == 'nextest-rs' && startsWith(github.ref_name, 'nextest-metadata-')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo release
        uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
        with:
          tool: cargo-release@0.25.0
      - uses: taiki-e/create-gh-release-action@c5baa0b5dc700cf06439d87935e130220a6882d9 # v1.9.3
        with:
          prefix: nextest-metadata
          changelog: nextest-metadata/CHANGELOG.md
          title: $prefix $version
          branch: main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - run: ./scripts/cargo-release-publish.sh
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  nextest-runner-release:
    permissions:
      contents: write
    environment: release
    if: github.repository_owner == 'nextest-rs' && startsWith(github.ref_name, 'nextest-runner-')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo release
        uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
        with:
          tool: cargo-release@0.25.0
      - uses: taiki-e/create-gh-release-action@c5baa0b5dc700cf06439d87935e130220a6882d9 # v1.9.3
        with:
          prefix: nextest-runner
          # No need for a changelog -- use the cargo-nextest changelog instead.
          title: $prefix $version
          branch: main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - run: ./scripts/cargo-release-publish.sh
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  cargo-nextest-release:
    permissions:
      contents: write
    if: github.repository_owner == 'nextest-rs' && startsWith(github.ref_name, 'cargo-nextest-')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # Note: do not publish this until binaries are built and uploaded below. This is so that
      # `cargo binstall` keeps working.
      - uses: taiki-e/create-gh-release-action@c5baa0b5dc700cf06439d87935e130220a6882d9 # v1.9.3
        id: create-gh-release
        with:
          prefix: cargo-nextest
          # The changelog for cargo-nextest is hosted on the website
          changelog: site/src/changelog.md
          title: $prefix $version
          branch: main
          # Uploads can't be made to immutable releases, so we set this to draft for now.
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    outputs:
      version: ${{ steps.create-gh-release.outputs.version }}

  build-cargo-nextest-binaries:
    name: Build cargo-nextest binaries for ${{ matrix.target }}
    permissions:
      contents: write
    environment: release
    if: github.repository_owner == 'nextest-rs' && startsWith(github.ref_name, 'cargo-nextest-')
    needs:
      - cargo-nextest-release
    strategy:
      matrix:
        include:
          # Native builds

          - target: x86_64-unknown-linux-gnu
            os: ubuntu-22.04
            # On Linux, we use glibc 2.27, as the minimum of
            # - Ubuntu 18.04 (glibc 2.27)
            # - CentOS 8 (glibc 2.28)
            # - Debian 10 (glibc 2.28)
            #
            # See https://repology.org/project/glibc/versions.
            #
            # We used to use an Ubuntu 18.04 container, but that became untenable over time:
            # https://github.com/nextest-rs/nextest/issues/1055
            build-target: x86_64-unknown-linux-gnu.2.27
            build-tool: cargo-zigbuild
            dry-run: false
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            build-target: x86_64-pc-windows-msvc
            build-tool: cargo
            # The Windows builds go through a signing process, so we set dry-run
            # in the upload-rust-binary-action to true
            dry-run: true
          - target: i686-pc-windows-msvc
            os: windows-latest
            build-target: i686-pc-windows-msvc
            build-tool: cargo
            dry-run: true
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            build-target: aarch64-pc-windows-msvc
            build-tool: cargo
            dry-run: true
          - target: universal-apple-darwin
            # macos-14 for M1 runners
            os: macos-14
            build-target: universal-apple-darwin
            build-tool: cargo
            dry-run: false

          # Builds using cross
          - target: x86_64-unknown-linux-musl
            os: ubuntu-22.04
            build-target: x86_64-unknown-linux-musl
            # musl is statically linked and uses cross
            build-tool: cross
            dry-run: false
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-22.04
            build-target: aarch64-unknown-linux-gnu
            build-tool: cross
            dry-run: false
          - target: aarch64-unknown-linux-musl
            os: ubuntu-22.04
            build-target: aarch64-unknown-linux-musl
            # musl is statically linked and uses cross
            build-tool: cross
            dry-run: false
          - target: riscv64gc-unknown-linux-gnu
            os: ubuntu-22.04
            build-target: riscv64gc-unknown-linux-gnu
            build-tool: cross
            dry-run: false
          - target: x86_64-unknown-freebsd
            os: ubuntu-22.04
            build-target: x86_64-unknown-freebsd
            build-tool: cross
            dry-run: false
          - target: x86_64-unknown-illumos
            os: ubuntu-22.04
            build-target: x86_64-unknown-illumos
            build-tool: cross
            dry-run: false
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install b2sum on macOS
        if: startsWith(matrix.os, 'macos')
        run: |
          brew install b2sum

      - uses: taiki-e/upload-rust-binary-action@0e34102c043ded9f2ca39f7af5cd99a540c61aff # v1.29.1
        with:
          bin: cargo-nextest
          # The tag name contains the binary name so just use that.
          archive: $tag-$target
          build-tool: ${{ matrix.build-tool }}
          target: ${{ matrix.build-target }}
          tar: all
          checksum: b2,sha256
          dry-run: ${{ matrix.dry-run }}
          dry-run-intended: ${{ matrix.dry-run }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CARGO_PROFILE_RELEASE_LTO: true
          CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1

      - name: Install just on Windows
        if: endsWith(matrix.target, '-pc-windows-msvc')
        uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
        with:
          tool: just
      - name: Download verpatch on Windows
        if: endsWith(matrix.target, '-pc-windows-msvc')
        shell: bash
        run: |
          set -x
          mkdir -p target/unsigned
          cd target/unsigned
          cp ../${{ matrix.build-target }}/release/cargo-nextest.exe .
          curl -LsSfO "https://github.com/nextest-rs/mukti/releases/download/verpatch-1.0.10/verpatch-bin-1.0.10.zip"
          unzip verpatch-bin-1.0.10.zip
      - name: Add metadata to Windows binary
        if: endsWith(matrix.target, '-pc-windows-msvc')
        # Bash seems to screw up argument parsing for verpatch. We really should
        # rewrite this tool in Rust at some point.
        shell: powershell
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          cd target/unsigned
          # Extract version from ref_name, e.g. cargo-nextest-0.9.97 -> 0.9.97
          $refName = $env:REF_NAME
          if ($refName -match "^cargo-nextest-(.+)$") {
            $version = $Matches[1]
          } else {
            Write-Error "Could not extract version from ref_name: $refName"
            exit 1
          }
          .\verpatch.exe /va .\cargo-nextest.exe `
            $version /high `
            /pv $version `
            /s product "cargo-nextest" `
            /s "(c)" "(c) The nextest Contributors. License: MIT OR Apache-2.0"
      - name: Get the Windows signing policy slug
        if: endsWith(matrix.target, '-pc-windows-msvc')
        id: get-signing-policy-slug
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          just win-signing-policy-slug "${REF_NAME}" >> "${GITHUB_OUTPUT}"

      - name: Upload unsigned Windows artifact
        id: upload-unsigned-artifact
        if: endsWith(matrix.target, '-pc-windows-msvc')
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: ${{ matrix.target }}-unsigned
          path: target/unsigned/cargo-nextest.exe
      - run: mkdir -p target/signed
        if: endsWith(matrix.target, '-pc-windows-msvc')
      - name: Submit Windows artifact signing request
        id: submit-signing-request
        if: endsWith(matrix.target, '-pc-windows-msvc')
        uses: signpath/github-action-submit-signing-request@3f9250c56651ff692d6729a2fbb0603a42d7d322 # v2.0
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '34634019-2ee0-4162-830a-72cd1a0cb73f'
          project-slug: 'nextest'
          signing-policy-slug: '${{ steps.get-signing-policy-slug.outputs.signing-policy-slug }}'
          github-artifact-id: '${{ steps.upload-unsigned-artifact.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'target/signed'
      - name: Archive and upload Windows artifacts
        id: archive-windows-artifact
        if: endsWith(matrix.target, '-pc-windows-msvc')
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF_NAME: ${{ github.ref_name }}
          TARGET: ${{ matrix.target }}
        run: ./scripts/archive-and-upload-windows.sh cargo-nextest.exe
      - name: Set archive output variable
        id: archive-output
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
          TARGET: ${{ matrix.target }}
        run: ./scripts/set-archive-output.sh
    outputs:
      x86_64-linux-tar: ${{ steps.archive-output.outputs.x86_64-unknown-linux-gnu-tar }}
      x86_64-linux-musl-tar: ${{ steps.archive-output.outputs.x86_64-unknown-linux-musl-tar }}
      aarch64-linux-tar: ${{ steps.archive-output.outputs.aarch64-unknown-linux-gnu-tar }}
      aarch64-linux-musl-tar: ${{ steps.archive-output.outputs.aarch64-unknown-linux-musl-tar }}
      riscv64gc-linux-tar: ${{ steps.archive-output.outputs.riscv64gc-unknown-linux-gnu-tar }}
      x86_64-windows-tar: ${{ steps.archive-output.outputs.x86_64-pc-windows-msvc-tar }}
      x86_64-windows-zip: ${{ steps.archive-output.outputs.x86_64-pc-windows-msvc-zip }}
      i686-windows-tar: ${{ steps.archive-output.outputs.i686-pc-windows-msvc-tar }}
      i686-windows-zip: ${{ steps.archive-output.outputs.i686-pc-windows-msvc-zip }}
      aarch64-windows-tar: ${{ steps.archive-output.outputs.aarch64-pc-windows-msvc-tar }}
      aarch64-windows-zip: ${{ steps.archive-output.outputs.aarch64-pc-windows-msvc-zip }}
      mac-tar: ${{ steps.archive-output.outputs.universal-apple-darwin-tar }}
      x86_64-unknown-freebsd-tar: ${{ steps.archive-output.outputs.x86_64-unknown-freebsd-tar }}
      x86_64-unknown-illumos-tar: ${{ steps.archive-output.outputs.x86_64-unknown-illumos-tar }}

  update-release-meta:
    name: Update release-meta branch and publish to crates.io
    permissions:
      contents: write
    environment: release
    if: github.repository_owner == 'nextest-rs'
    needs:
      - cargo-nextest-release
      - build-cargo-nextest-binaries
    runs-on: ubuntu-latest
    steps:
      - name: Clone nextest repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: nextest
      - name: Clone release-meta repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Credentials are needed for git push later in this job.
          persist-credentials: true
          repository: nextest-rs/release-meta
          ref: main
          token: ${{ secrets.RELEASE_META_DEPLOY_TOKEN }}
          path: release-meta

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo release
        uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
        with:
          tool: cargo-release@0.25.0
      # The GitHub release must be marked as published (immutable) before Mukti
      # metadata is generated, since that fetches release artifacts based on the
      # tag name (which isn't available until the release is created).
      - name: Mark GitHub release published
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          cd nextest
          gh release edit "${REF_NAME}" --draft=false
      - name: Download mukti
        run: |
          mkdir -p ~/bin
          curl -LsSf "https://github.com/nextest-rs/mukti/releases/download/mukti-bin-0.7.8/mukti-bin-0.7.8-x86_64-unknown-linux-musl.tar.gz" \
            | tar xzf - -C ~/bin
      - name: Add release metadata
        env:
          REF_NAME: ${{ github.ref_name }}
          VERSION: ${{ needs.cargo-nextest-release.outputs.version }}
          ARCHIVE_X86_64_LINUX_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-linux-tar }}
          ARCHIVE_X86_64_LINUX_MUSL_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-linux-musl-tar }}
          ARCHIVE_AARCH64_LINUX_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.aarch64-linux-tar }}
          ARCHIVE_AARCH64_LINUX_MUSL_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.aarch64-linux-musl-tar }}
          ARCHIVE_RISCV64GC_LINUX_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.riscv64gc-linux-tar }}
          ARCHIVE_X86_64_WINDOWS_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-windows-tar }}
          ARCHIVE_X86_64_WINDOWS_ZIP: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-windows-zip }}
          ARCHIVE_I686_WINDOWS_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.i686-windows-tar }}
          ARCHIVE_I686_WINDOWS_ZIP: ${{ needs.build-cargo-nextest-binaries.outputs.i686-windows-zip }}
          ARCHIVE_AARCH64_WINDOWS_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.aarch64-windows-tar }}
          ARCHIVE_AARCH64_WINDOWS_ZIP: ${{ needs.build-cargo-nextest-binaries.outputs.aarch64-windows-zip }}
          ARCHIVE_MAC_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.mac-tar }}
          ARCHIVE_X86_64_FREEBSD_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-unknown-freebsd-tar }}
          ARCHIVE_X86_64_ILLUMOS_TAR: ${{ needs.build-cargo-nextest-binaries.outputs.x86_64-unknown-illumos-tar }}
        run: ./scripts/add-release-metadata.sh
      - name: Generate redirects
        run: |
          cd release-meta
          ~/bin/mukti-bin --json releases.json generate-redirects --flavor cloudflare . \
            --alias linux=x86_64-unknown-linux-gnu:tar.gz \
            --alias linux-musl=x86_64-unknown-linux-musl:tar.gz \
            --alias linux-arm=aarch64-unknown-linux-gnu:tar.gz \
            --alias linux-arm-musl=aarch64-unknown-linux-musl:tar.gz \
            --alias linux-riscv64=riscv64gc-unknown-linux-gnu:tar.gz \
            --alias windows=x86_64-pc-windows-msvc:zip \
            --alias windows-tar=x86_64-pc-windows-msvc:tar.gz \
            --alias windows-x86=i686-pc-windows-msvc:zip \
            --alias windows-x86-tar=i686-pc-windows-msvc:tar.gz \
            --alias windows-arm=aarch64-pc-windows-msvc:zip \
            --alias windows-arm-tar=aarch64-pc-windows-msvc:tar.gz \
            --alias mac=universal-apple-darwin:tar.gz \
            --alias freebsd=x86_64-unknown-freebsd:tar.gz \
            --alias illumos=x86_64-unknown-illumos:tar.gz \
      - name: Add extra redirects
        run: |
          cat nextest/site/release-meta-static/extra-redirects >> release-meta/_redirects
      - name: Update release-meta repo
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          cd release-meta
          git config user.email "bot@nexte.st"
          git config user.name "Nextest Bot"
          git pull --autostash --rebase origin main
          git add releases.json _redirects
          git commit -m "Update release metadata for ${REF_NAME}"
          git push origin HEAD:main
      - name: Run cargo-release-publish.sh
        run: |
          cd nextest
          PUBLISH_CARGO_NEXTEST=1 ./scripts/cargo-release-publish.sh
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}