Skip to content

Commit f83b88f

Browse files
found-itfound-it
authored
Merge pull request #10 from edera-dev/found-it/release-workflow
Add release automation
2 parents 6a267ec + 65b1e12 commit f83b88f

10 files changed

Lines changed: 706 additions & 0 deletions

File tree

‎.github/dependabot.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
version: 2
2+
updates:
3+
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
cooldown:
9+
default-days: 7
10+
groups:
11+
actions-updates:
12+
dependency-type: "production"
13+
applies-to: "version-updates"
14+
actions-dev-updates:
15+
dependency-type: "development"
16+
applies-to: "version-updates"
17+
18+
- package-ecosystem: "cargo"
19+
directory: "/"
20+
schedule:
21+
interval: "daily"
22+
cooldown:
23+
default-days: 7
24+
groups:
25+
cargo-updates:
26+
dependency-type: "production"
27+
applies-to: "version-updates"
28+
cargo-dev-updates:
29+
dependency-type: "development"
30+
applies-to: "version-updates"

‎.github/workflows/ci-actions.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions:
10+
contents: read # Default token to read
11+
12+
jobs:
13+
zizmor:
14+
name: zizmor latest via PyPI
15+
runs-on: ubuntu-latest
16+
permissions:
17+
security-events: write # Needed to write security events to github
18+
contents: read # Needed to read clone repo
19+
actions: read # Needed to read actions
20+
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout repository
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
persist-credentials: false
30+
31+
- name: Install the latest version of uv
32+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
33+
34+
- name: Run zizmor
35+
run: uvx zizmor --pedantic --format sarif . > results.sarif
36+
env:
37+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
39+
- name: Upload SARIF file
40+
uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
41+
with:
42+
sarif_file: results.sarif
43+
category: zizmor

‎.github/workflows/ci-code.yaml‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
name: Lint and Test Code
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- bin/**
9+
- examples/**
10+
- src/**
11+
- Cargo.*
12+
- rust-toolchain.toml
13+
- .github/workflows/ci-code.yaml
14+
15+
permissions:
16+
contents: read # Default token to read
17+
18+
jobs:
19+
setup-cargo-make:
20+
name: setup-cargo-make
21+
runs-on: ubuntu-latest
22+
outputs:
23+
cargo_make_version: ${{ steps.get-version.outputs.cargo_make_version }}
24+
cache-key: ${{ steps.cache-cargo-make.outputs.cache-primary-key }}
25+
steps:
26+
- name: Fetch latest cargo-make version
27+
id: get-version
28+
run: |
29+
VERSION=$(curl -s \
30+
-H "User-Agent: github.com/edera-dev/styrolite (contact: support@edera.dev>)" \
31+
https://crates.io/api/v1/crates/cargo-make | jq -r '.crate.max_stable_version')
32+
echo "cargo_make_version=$VERSION" >> $GITHUB_OUTPUT
33+
34+
- name: Cache cargo-make binary
35+
id: cache-cargo-make
36+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
37+
with:
38+
path: ~/.cargo/bin/cargo-make
39+
key: ${{ runner.os }}-cargo-make-${{ steps.get-version.outputs.cargo_make_version }}
40+
41+
- name: Install cargo-make if missing or outdated
42+
if: steps.cache-cargo-make.outputs.cache-hit != 'true'
43+
run: |
44+
cargo install cargo-make --version "${CARGO_MAKE_VERSION}" --force
45+
env:
46+
CARGO_MAKE_VERSION: ${{ steps.get-version.outputs.cargo_make_version }}
47+
48+
- name: Verify cargo-make
49+
run: cargo make --version
50+
51+
rustfmt:
52+
name: rustfmt
53+
runs-on: ubuntu-latest
54+
needs: setup-cargo-make
55+
steps:
56+
- name: harden runner
57+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
58+
with:
59+
egress-policy: audit
60+
61+
- name: checkout repository
62+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
63+
with:
64+
submodules: recursive
65+
persist-credentials: false
66+
67+
- name: Restore cached cargo-make
68+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
69+
with:
70+
path: ~/.cargo/bin/cargo-make
71+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
72+
73+
- name: 'cargo fmt'
74+
run: cargo make format-check
75+
76+
shfmt:
77+
name: shfmt
78+
runs-on: ubuntu-latest
79+
needs: setup-cargo-make
80+
steps:
81+
- name: harden runner
82+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
83+
with:
84+
egress-policy: audit
85+
86+
- name: checkout repository
87+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
88+
with:
89+
submodules: recursive
90+
persist-credentials: false
91+
92+
- name: Restore cached cargo-make
93+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
94+
with:
95+
path: ~/.cargo/bin/cargo-make
96+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
97+
98+
- name: shfmt
99+
run: |
100+
GOBIN=/usr/local/bin go install mvdan.cc/sh/v3/cmd/shfmt@latest
101+
if ! cargo make shfmt; then
102+
echo ""
103+
echo "Please run \`cargo make shfmt-write\`"
104+
exit 1
105+
fi
106+
107+
shellcheck:
108+
name: shellcheck
109+
runs-on: ubuntu-latest
110+
needs: setup-cargo-make
111+
steps:
112+
- name: harden runner
113+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
114+
with:
115+
egress-policy: audit
116+
117+
- name: checkout repository
118+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
119+
with:
120+
submodules: recursive
121+
persist-credentials: false
122+
123+
- name: Restore cached cargo-make
124+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
125+
with:
126+
path: ~/.cargo/bin/cargo-make
127+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
128+
129+
- name: shellcheck
130+
run: cargo make shellcheck
131+
132+
full-build:
133+
runs-on: ubuntu-latest
134+
needs: setup-cargo-make
135+
strategy:
136+
fail-fast: false
137+
matrix:
138+
arch:
139+
- x86_64
140+
env:
141+
TARGET_ARCH: "${{ matrix.arch }}"
142+
name: 'Full build linux-${{ matrix.arch }}'
143+
steps:
144+
- name: harden runner
145+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
146+
with:
147+
egress-policy: audit
148+
149+
- name: checkout repository
150+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
151+
with:
152+
submodules: recursive
153+
persist-credentials: false
154+
155+
- name: Restore cached cargo-make
156+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
157+
with:
158+
path: ~/.cargo/bin/cargo-make
159+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
160+
161+
- name: cargo build
162+
run: cargo make build
163+
164+
full-test:
165+
runs-on: ubuntu-latest
166+
needs: setup-cargo-make
167+
strategy:
168+
fail-fast: false
169+
matrix:
170+
arch:
171+
- x86_64
172+
env:
173+
TARGET_ARCH: "${{ matrix.arch }}"
174+
name: 'Full test linux-${{ matrix.arch }}'
175+
steps:
176+
- name: harden runner
177+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
178+
with:
179+
egress-policy: audit
180+
181+
- name: checkout repository
182+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
183+
with:
184+
submodules: recursive
185+
persist-credentials: false
186+
187+
- name: Restore cached cargo-make
188+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
189+
with:
190+
path: ~/.cargo/bin/cargo-make
191+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
192+
193+
- name: 'cargo test'
194+
run: cargo make test
195+
196+
full-clippy:
197+
runs-on: ubuntu-latest
198+
needs: setup-cargo-make
199+
strategy:
200+
matrix:
201+
arch:
202+
- x86_64
203+
env:
204+
TARGET_ARCH: "${{ matrix.arch }}"
205+
name: 'Full clippy linux-${{ matrix.arch }}'
206+
steps:
207+
- name: harden runner
208+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
209+
with:
210+
egress-policy: audit
211+
212+
- name: checkout repository
213+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
214+
with:
215+
submodules: recursive
216+
persist-credentials: false
217+
218+
- name: Restore cached cargo-make
219+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
220+
with:
221+
path: ~/.cargo/bin/cargo-make
222+
key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}
223+
224+
- name: 'cargo clippy'
225+
run: cargo make clippy

‎.github/workflows/publish.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Publish Binary
2+
3+
on:
4+
# This action runs whenever a release is published
5+
release:
6+
types:
7+
- published
8+
9+
permissions:
10+
contents: read # Default token to read
11+
12+
jobs:
13+
upload-artifact:
14+
if: ${{ github.repository_owner == 'edera-dev' }}
15+
name: Publish Binary
16+
permissions:
17+
contents: write # Needed to publish binary
18+
strategy:
19+
fail-fast: false
20+
matrix:
21+
platform:
22+
- { os: linux, arch: x86_64, on: ubuntu-latest }
23+
env:
24+
TARGET_OS: '${{ matrix.platform.os }}'
25+
TARGET_ARCH: '${{ matrix.platform.arch }}'
26+
runs-on: '${{ matrix.platform.on }}'
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
30+
with:
31+
fetch-depth: 0
32+
persist-credentials: false
33+
34+
- name: Install Rust toolchain
35+
uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # zizmor: ignore[stale-action-refs] -- pinned to stable branch
36+
37+
- name: Install cargo-make
38+
run: cargo install cargo-make
39+
40+
- name: 'Build binary'
41+
run: cargo make --profile release build
42+
43+
- name: 'Assemble styrolite executable'
44+
run: |
45+
tag_name="${TAG_NAME}"
46+
[ -z $tag_name ] && tag_name="${DEFAULT_BRANCH}"
47+
export STYROLITE_FORM='styrolite'
48+
export STYROLITE_TAG_NAME="${tag_name}"
49+
export STYROLITE_PLATFORM="${PLATFORM_OS}-${PLATFORM_ARCH}"
50+
export STYROLITE_RELEASE_DIR='target/release'
51+
cargo make --profile release assemble-release-assets
52+
env:
53+
TAG_NAME: '${{ github.event.release.tag_name }}'
54+
DEFAULT_BRANCH: '${{ github.event.repository.default_branch }}'
55+
PLATFORM_OS: '${{ matrix.platform.os }}'
56+
PLATFORM_ARCH: '${{ matrix.platform.arch }}'
57+
58+
- name: 'Upload styrolite to workflow run'
59+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
60+
with:
61+
name: styrolite-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
62+
path: |
63+
target/assets/*
64+
65+
- name: generate cultivator token
66+
uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
67+
id: generate-token
68+
with:
69+
app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
70+
private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
71+
72+
- name: 'Upload all release artifacts'
73+
run: |
74+
export STYROLITE_TAG_NAME="${TAG_NAME}"
75+
cargo make --profile release upload-release-assets
76+
env:
77+
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
78+
TAG_NAME: '${{ github.event.release.tag_name }}'

0 commit comments

Comments
 (0)