v0.42.0 #82
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Binaries | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag to build (e.g. v0.1.0)" | |
| required: true | |
| permissions: {} | |
| env: | |
| ARCHGATE_TELEMETRY: "0" | |
| jobs: | |
| build: | |
| name: Build ${{ matrix.artifact }} | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: bun-darwin-arm64 | |
| artifact: archgate-darwin-arm64 | |
| os: macos-latest | |
| binary_name: archgate | |
| - target: bun-linux-x64 | |
| artifact: archgate-linux-x64 | |
| os: ubuntu-latest | |
| binary_name: archgate | |
| - target: bun-windows-x64 | |
| artifact: archgate-win32-x64 | |
| os: windows-latest | |
| binary_name: archgate.exe | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.event.release.tag_name || inputs.tag }} | |
| - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0 | |
| with: | |
| auto-install: true | |
| - run: bun install --frozen-lockfile | |
| - name: Validate (Unix) | |
| if: runner.os != 'Windows' | |
| run: bun run validate | |
| - name: Validate (Windows) | |
| if: runner.os == 'Windows' | |
| run: bun run lint && bun run typecheck && bun run format:check && bun run test | |
| - name: Build binary | |
| run: | | |
| bun build src/cli.ts --compile --bytecode --minify --target ${{ matrix.target }} --outfile dist/${{ matrix.artifact }} | |
| - name: Prepare release asset (Unix) | |
| if: runner.os != 'Windows' | |
| run: | | |
| cp dist/${{ matrix.artifact }} archgate | |
| tar -czf ${{ matrix.artifact }}.tar.gz archgate | |
| rm archgate | |
| shasum -a 256 ${{ matrix.artifact }}.tar.gz > ${{ matrix.artifact }}.tar.gz.sha256 | |
| - name: Prepare release asset (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| Copy-Item "dist/${{ matrix.artifact }}.exe" "archgate.exe" | |
| Compress-Archive -Path "archgate.exe" -DestinationPath "${{ matrix.artifact }}.zip" | |
| Remove-Item "archgate.exe" | |
| (Get-FileHash "${{ matrix.artifact }}.zip" -Algorithm SHA256).Hash.ToLower() + " ${{ matrix.artifact }}.zip" | Out-File -Encoding ascii "${{ matrix.artifact }}.zip.sha256" | |
| - name: Attest build provenance (Unix) | |
| if: runner.os != 'Windows' | |
| id: attest-unix | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 | |
| with: | |
| subject-path: ${{ matrix.artifact }}.tar.gz | |
| - name: Attest build provenance (Windows) | |
| if: runner.os == 'Windows' | |
| id: attest-win | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 | |
| with: | |
| subject-path: ${{ matrix.artifact }}.zip | |
| - name: Upload release asset (Unix) | |
| if: runner.os != 'Windows' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| TAG="${{ github.event.release.tag_name || inputs.tag }}" | |
| cp "${{ steps.attest-unix.outputs.bundle-path }}" "${{ matrix.artifact }}.tar.gz.sigstore.json" | |
| gh release upload "$TAG" \ | |
| "${{ matrix.artifact }}.tar.gz" \ | |
| "${{ matrix.artifact }}.tar.gz.sha256" \ | |
| "${{ matrix.artifact }}.tar.gz.sigstore.json" \ | |
| --clobber | |
| - name: Upload release asset (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| $tag = "${{ github.event.release.tag_name || inputs.tag }}" | |
| Copy-Item "${{ steps.attest-win.outputs.bundle-path }}" "${{ matrix.artifact }}.zip.sigstore.json" | |
| gh release upload $tag "${{ matrix.artifact }}.zip" "${{ matrix.artifact }}.zip.sha256" "${{ matrix.artifact }}.zip.sigstore.json" --clobber | |
| - name: Upload digest for SLSA provenance (Unix) | |
| if: runner.os != 'Windows' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: digest-${{ matrix.artifact }} | |
| path: ${{ matrix.artifact }}.tar.gz.sha256 | |
| - name: Upload digest for SLSA provenance (Windows) | |
| if: runner.os == 'Windows' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: digest-${{ matrix.artifact }} | |
| path: ${{ matrix.artifact }}.zip.sha256 | |
| combine-hashes: | |
| name: Combine hashes for provenance | |
| needs: build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| digests: ${{ steps.combine.outputs.digests }} | |
| steps: | |
| - name: Download all digest artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: digest-* | |
| merge-multiple: true | |
| - name: Combine digests | |
| id: combine | |
| run: | | |
| echo "=== Individual digests ===" | |
| cat *.sha256 | |
| echo "" | |
| DIGESTS=$(cat *.sha256 | tr -d '\r' | base64 -w0) | |
| echo "digests=$DIGESTS" >> "$GITHUB_OUTPUT" | |
| # SLSA provenance — generates .intoto.jsonl and uploads it to the release. | |
| provenance: | |
| name: SLSA provenance | |
| needs: combine-hashes | |
| permissions: | |
| actions: read | |
| id-token: write | |
| contents: write | |
| # SLSA reusable workflow MUST be referenced by tag, not SHA — the generator's | |
| # generate-builder.sh extracts the version from the ref to download the builder | |
| # binary from a GitHub release and rejects non-tag refs. See CI-001 exception | |
| # and slsa-framework/slsa-github-generator#150. | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 | |
| with: | |
| base64-subjects: "${{ needs.combine-hashes.outputs.digests }}" | |
| upload-assets: true | |
| upload-tag-name: ${{ github.event.release.tag_name || inputs.tag }} |