release-stable #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-stable | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: "Git ref to release from" | |
| required: true | |
| default: main | |
| type: string | |
| version_override: | |
| description: "Optional stable version override, for example v0.1.3" | |
| required: false | |
| default: "" | |
| type: string | |
| permissions: | |
| actions: write | |
| contents: write | |
| concurrency: | |
| group: runseal-release-stable | |
| cancel-in-progress: false | |
| jobs: | |
| metadata: | |
| runs-on: ubuntu-latest | |
| env: | |
| STABLE_VERSION_OVERRIDE: ${{ inputs.version_override }} | |
| RUNSEAL_RELEASES_PUBLIC_URL: ${{ vars.RUNSEAL_RELEASES_PUBLIC_URL }} | |
| RUNSEAL_RELEASES_S3_AK: ${{ secrets.RUNSEAL_RELEASES_S3_AK }} | |
| RUNSEAL_RELEASES_S3_BUCKET: ${{ secrets.RUNSEAL_RELEASES_S3_BUCKET }} | |
| RUNSEAL_RELEASES_S3_SK: ${{ secrets.RUNSEAL_RELEASES_S3_SK }} | |
| RUNSEAL_RELEASES_S3_URL: ${{ secrets.RUNSEAL_RELEASES_S3_URL }} | |
| R2_ACCESS_PROBE_NAME: release-stable | |
| RELEASE_CHANNEL: stable | |
| outputs: | |
| base_version: ${{ steps.stable.outputs.base_version }} | |
| release_version: ${{ steps.stable.outputs.release_version }} | |
| state_source: ${{ steps.stable.outputs.state_source }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - name: Validate R2 access | |
| run: bash .github/scripts/release/r2/check.sh | |
| - name: Resolve stable metadata | |
| id: stable | |
| run: python3 .github/scripts/release/metadata/stable.py | |
| verify: | |
| needs: metadata | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Format | |
| run: cargo fmt --all --check | |
| - name: Test | |
| run: cargo test --locked --workspace | |
| - name: Clippy | |
| run: cargo clippy --locked --workspace --all-targets -- -D warnings | |
| - name: Install Flavor | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL https://flavor.perish.uk/manage.sh -o "$RUNNER_TEMP/manage-flavor.sh" | |
| sh "$RUNNER_TEMP/manage-flavor.sh" install --bin-dir "$HOME/.local/bin" | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| - name: Flavor self-check | |
| run: flavor check --root . --config flavor.toml | |
| build: | |
| needs: [metadata, verify] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| archive: runseal-x86_64-unknown-linux-gnu.tar.gz | |
| - runner: macos-latest | |
| target: aarch64-apple-darwin | |
| archive: runseal-aarch64-apple-darwin.tar.gz | |
| - runner: macos-latest | |
| target: x86_64-apple-darwin | |
| archive: runseal-x86_64-apple-darwin.tar.gz | |
| - runner: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| archive: runseal-x86_64-pc-windows-msvc.zip | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Package release artifact | |
| if: runner.os != 'Windows' | |
| env: | |
| TARGET: ${{ matrix.target }} | |
| run: sh .github/scripts/release/assets/package.sh "${{ needs.metadata.outputs.release_version }}" | |
| - name: Package release artifact | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| env: | |
| TARGET: ${{ matrix.target }} | |
| run: ./.github/scripts/release/assets/package.ps1 "${{ needs.metadata.outputs.release_version }}" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-${{ matrix.target }} | |
| path: dist/${{ needs.metadata.outputs.release_version }}/${{ matrix.archive }} | |
| publish: | |
| needs: [metadata, build] | |
| runs-on: ubuntu-latest | |
| env: | |
| BASE_VERSION: ${{ needs.metadata.outputs.base_version }} | |
| RUNSEAL_RELEASES_PUBLIC_URL: ${{ vars.RUNSEAL_RELEASES_PUBLIC_URL }} | |
| RUNSEAL_RELEASES_S3_AK: ${{ secrets.RUNSEAL_RELEASES_S3_AK }} | |
| RUNSEAL_RELEASES_S3_BUCKET: ${{ secrets.RUNSEAL_RELEASES_S3_BUCKET }} | |
| RUNSEAL_RELEASES_S3_SK: ${{ secrets.RUNSEAL_RELEASES_S3_SK }} | |
| RUNSEAL_RELEASES_S3_URL: ${{ secrets.RUNSEAL_RELEASES_S3_URL }} | |
| RELEASE_CHANNEL: stable | |
| RELEASE_ROOT: dist/${{ needs.metadata.outputs.release_version }} | |
| RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }} | |
| STATE_SOURCE: ${{ needs.metadata.outputs.state_source }} | |
| outputs: | |
| metadata_url: ${{ steps.r2.outputs.metadata_url }} | |
| version_metadata_url: ${{ steps.r2.outputs.version_metadata_url }} | |
| version_prefix: ${{ steps.r2.outputs.version_prefix }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| path: dist/${{ needs.metadata.outputs.release_version }} | |
| merge-multiple: true | |
| - name: Create checksums | |
| run: sh .github/scripts/release/assets/checksums.sh "${RELEASE_VERSION}" "${RELEASE_ROOT}" | |
| - name: Accept release assets | |
| run: sh .github/scripts/release/assets/verify.sh accept "${RELEASE_VERSION}" "${RELEASE_ROOT}" | |
| - name: Verify release archives | |
| run: sh .github/scripts/release/assets/verify.sh verify "${RELEASE_VERSION}" "${RELEASE_ROOT}" | |
| - name: Publish to R2 | |
| id: r2 | |
| run: bash .github/scripts/release/r2/publish.sh | |
| - name: Verify R2 publish | |
| env: | |
| R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }} | |
| run: bash .github/scripts/release/r2/verify.sh | |
| - name: Create and push git tag | |
| run: | | |
| set -euo pipefail | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| if git rev-parse --verify --quiet "refs/tags/${RELEASE_VERSION}" >/dev/null; then | |
| echo "[release-stable] tag ${RELEASE_VERSION} already exists locally; skipping create" | |
| else | |
| git tag -a "${RELEASE_VERSION}" -m "${RELEASE_VERSION}" | |
| fi | |
| git push origin "refs/tags/${RELEASE_VERSION}" | |
| - name: Publish summary | |
| env: | |
| R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }} | |
| R2_VERSION_METADATA_URL: ${{ steps.r2.outputs.version_metadata_url }} | |
| R2_VERSION_PREFIX: ${{ steps.r2.outputs.version_prefix }} | |
| run: bash .github/scripts/release/r2/summary.sh | |
| - name: Cleanup workflow artifacts | |
| if: ${{ success() }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: bash .github/scripts/release/github/cleanup-artifacts.sh | |
| smoke: | |
| needs: [metadata, publish] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| RUNSEAL_RELEASES_PUBLIC_URL: ${{ vars.RUNSEAL_RELEASES_PUBLIC_URL }} | |
| SMOKE_LATEST: "1" | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - name: Smoke stable install on Unix | |
| if: runner.os != 'Windows' | |
| run: sh .github/scripts/release/smoke/smoke.sh "${{ needs.metadata.outputs.release_version }}" stable | |
| - name: Smoke stable install on Windows | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: ./.github/scripts/release/smoke/smoke.ps1 "${{ needs.metadata.outputs.release_version }}" stable |