Skip to content

release: v0.16.0 (#427) #45

release: v0.16.0 (#427)

release: v0.16.0 (#427) #45

Workflow file for this run

name: Release
on:
push:
tags:
- 'v*.*.*'
workflow_dispatch:
inputs:
tag:
description: Existing release tag to republish npm from, for example v0.13.1
required: true
type: string
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
NODE_VERSION: 22.14.0
NPM_VERSION: 11.5.1
permissions:
contents: write
id-token: write
jobs:
verify:
name: Verify Release
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
- name: Validate version and run checks
run: |
bash scripts/release-check.sh "${GITHUB_REF_NAME}"
build:
name: Build ${{ matrix.target }}
needs: verify
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
use_cross: "false"
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
use_cross: "true"
- os: ubuntu-latest
target: x86_64-unknown-linux-musl
use_cross: "true"
- os: macos-14
target: x86_64-apple-darwin
use_cross: "false"
- os: macos-14
target: aarch64-apple-darwin
use_cross: "false"
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- name: Install cross
if: matrix.use_cross == 'true'
uses: taiki-e/install-action@v2
with:
tool: cross
- name: Build
shell: bash
run: |
set -euo pipefail
if [[ "${{ matrix.use_cross }}" == "true" ]]; then
cross build --release --target "${{ matrix.target }}"
else
cargo build --release --target "${{ matrix.target }}"
fi
- name: Package (Unix)
if: runner.os != 'Windows'
id: package_unix
shell: bash
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_ROOT="uxc-v${VERSION}-${{ matrix.target }}"
mkdir -p "${PKG_ROOT}"
cp "target/${{ matrix.target }}/release/uxc" "${PKG_ROOT}/uxc"
cp LICENSE "${PKG_ROOT}/LICENSE"
cp README.md "${PKG_ROOT}/README.md"
tar -czf "${PKG_ROOT}.tar.gz" "${PKG_ROOT}"
echo "file=${PKG_ROOT}.tar.gz" >> "${GITHUB_OUTPUT}"
- name: Upload artifact (Unix)
if: runner.os != 'Windows'
uses: actions/upload-artifact@v7.0.1
with:
name: pkg-${{ matrix.target }}
path: ${{ steps.package_unix.outputs.file }}
release:
name: Create GitHub Release
needs: build
runs-on: ubuntu-latest
steps:
- name: Download artifacts
uses: actions/download-artifact@v8.0.1
with:
pattern: pkg-*
path: dist
merge-multiple: true
- name: Generate checksums
shell: bash
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
cd dist
find . -maxdepth 1 -type f ! -name '*checksums.txt' -print0 \
| sort -z \
| xargs -0 sha256sum \
| sed 's|^\./||' > "uxc-v${VERSION}-checksums.txt"
- name: Publish release
uses: softprops/action-gh-release@v2
with:
generate_release_notes: true
files: dist/*
publish-crate:
name: Publish Crate
needs: release
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Publish to crates.io
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: |
if [[ -z "${CARGO_REGISTRY_TOKEN}" ]]; then
echo "CARGO_REGISTRY_TOKEN is not configured"
exit 1
fi
cargo publish --locked --token "${CARGO_REGISTRY_TOKEN}"
publish-npm:
name: Publish npm Package
needs: release
if: github.event_name == 'push'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Setup Node
uses: actions/setup-node@v6.4.0
with:
node-version: ${{ env.NODE_VERSION }}
registry-url: https://registry.npmjs.org
# Trusted publishing should use OIDC, not token-based npm auth.
token: ''
- name: Upgrade npm for trusted publishing
run: npm install -g npm@${{ env.NPM_VERSION }}
- name: Install dependencies
run: npm ci
- name: Build TypeScript package
run: npm run build:ts
- name: Publish npm package
env:
# Ensure npm does not try registry token auth; rely on OIDC trusted publishing.
NODE_AUTH_TOKEN: ''
run: npm publish --workspace @holon-run/uxc-daemon-client --access public --provenance
republish-npm:
name: Republish npm Package
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- name: Checkout tag
uses: actions/checkout@v6.0.2
with:
ref: refs/tags/${{ inputs.tag }}
- name: Setup Node
uses: actions/setup-node@v6.4.0
with:
node-version: ${{ env.NODE_VERSION }}
registry-url: https://registry.npmjs.org
token: ''
- name: Upgrade npm for trusted publishing
run: npm install -g npm@${{ env.NPM_VERSION }}
- name: Install dependencies
run: npm ci
- name: Build TypeScript package
run: npm run build:ts
- name: Publish npm package
env:
NODE_AUTH_TOKEN: ''
run: npm publish --workspace @holon-run/uxc-daemon-client --access public --provenance
update-homebrew-tap:
name: Update Homebrew Tap
needs: release
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Download artifacts
uses: actions/download-artifact@v8.0.1
with:
pattern: pkg-*
path: dist
merge-multiple: true
- name: Update tap formula
env:
HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
run: |
if [[ -z "${HOMEBREW_TAP_TOKEN}" ]]; then
echo "HOMEBREW_TAP_TOKEN is not configured, skipping Homebrew tap update"
exit 0
fi
bash scripts/update-homebrew-formula.sh \
--version "${GITHUB_REF_NAME#v}" \
--dist-dir dist \
--repo "${GITHUB_REPOSITORY}" \
--tap-repo "holon-run/homebrew-tap"