Cross-compile the Intel macOS binary from the ARM runner #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to build, for example v0.1.0" | |
| required: true | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build: | |
| name: Build ${{ matrix.target }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| - target: aarch64-unknown-linux-gnu | |
| os: ubuntu-24.04-arm | |
| # Both macOS targets build on the Apple Silicon runner. The Intel one | |
| # cross-compiles, because the macos-13 Intel runner label is retired | |
| # and a job requesting it queues forever instead of failing. | |
| - target: x86_64-apple-darwin | |
| os: macos-latest | |
| - target: aarch64-apple-darwin | |
| os: macos-latest | |
| - target: x86_64-pc-windows-msvc | |
| os: windows-latest | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| - name: Install pinned Rust toolchain | |
| run: | | |
| rustup toolchain install 1.97.1 --profile minimal | |
| rustup default 1.97.1 | |
| rustup target add ${{ matrix.target }} | |
| - name: Build release binary | |
| run: cargo build --locked --release --target ${{ matrix.target }} | |
| # Archive the binary and publish a checksum beside it. The install script | |
| # refuses to continue when the checksum does not match. | |
| - name: Package (Unix) | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| name="launchguard-${{ matrix.target }}" | |
| mkdir -p "dist/$name" | |
| cp "target/${{ matrix.target }}/release/launchguard" "dist/$name/" | |
| cp README.md LICENSE "dist/$name/" | |
| tar -czf "dist/$name.tar.gz" -C dist "$name" | |
| shasum -a 256 "dist/$name.tar.gz" | awk '{print $1" "'"$name"'".tar.gz"}' > "dist/$name.tar.gz.sha256" | |
| - name: Package (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $name = "launchguard-${{ matrix.target }}" | |
| New-Item -ItemType Directory -Force -Path "dist/$name" | Out-Null | |
| Copy-Item "target/${{ matrix.target }}/release/launchguard.exe" "dist/$name/" | |
| Copy-Item README.md, LICENSE "dist/$name/" | |
| Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip" | |
| $hash = (Get-FileHash "dist/$name.zip" -Algorithm SHA256).Hash.ToLower() | |
| "$hash $name.zip" | Out-File -Encoding ascii "dist/$name.zip.sha256" | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: launchguard-${{ matrix.target }} | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/*.sha256 | |
| if-no-files-found: error | |
| publish: | |
| name: Publish release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Collect checksums | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cat dist/*.sha256 > dist/SHA256SUMS | |
| echo "Published artifacts:" | |
| cat dist/SHA256SUMS | |
| # Binaries are unsigned. Signing needs a paid Apple Developer Program | |
| # membership and a Windows code-signing certificate, both recorded in | |
| # docs/SYSTEM_REQUIREMENTS.md as costs outside the free contract. | |
| - name: Create release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.event.inputs.tag || github.ref_name }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| gh release create "$TAG" \ | |
| --repo "${{ github.repository }}" \ | |
| --title "LaunchGuard $TAG" \ | |
| --notes "Unsigned prebuilt binaries. Verify against \`SHA256SUMS\` before use. | |
| Install: | |
| \`\`\`bash | |
| curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh | sh | |
| \`\`\` | |
| Or download the archive for your platform, check its digest, and place \`launchguard\` on your PATH." \ | |
| dist/*.tar.gz dist/*.zip dist/SHA256SUMS |