Update zon #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Triggered when a tag like v0.0.4 is pushed. Six parallel package jobs (one Velopack | |
| # channel each; some runners use Zig cross-compile to the target triple), then a final job | |
| # stages assets and uploads a draft GitHub release via scripts/release.sh. | |
| # | |
| # Flow: | |
| # 1. Operator edits VERSION, commits, tags v<VERSION>, pushes the tag. | |
| # 2. Matrix builds (Linux ×2, Windows ×2, macOS ×2): prefetch with retries, | |
| # then package per target. Windows targets build natively on windows-latest | |
| # with the runner's system MSVC; build.zig wires a translate-c shim | |
| # (src/tools/msvc_translatec_shim) and a SIZE_MAX defineCMacro so aro | |
| # doesn't reject MSVC stdint.h's `0xff…ui64` literal. | |
| # 3. The assemble job downloads zig-out/<channel>/ from each artifact, runs | |
| # FIZZY_RELEASE_SKIP_BUILD=1 ./scripts/release.sh (staging + gh release create). | |
| # 4. Operator reviews the draft and publishes when ready (auto-update only after publish). | |
| # | |
| # Signing (optional macOS builds when secrets unset): | |
| # FIZZY_MACOS_CERT_P12_BASE64 / FIZZY_MACOS_CERT_PASSWORD | |
| # FIZZY_MACOS_SIGN_APP / FIZZY_MACOS_SIGN_INSTALLER | |
| # FIZZY_APPLE_ID / FIZZY_APPLE_APP_PASSWORD / FIZZY_APPLE_TEAM_ID | |
| # | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Existing tag to release (e.g. v0.0.4)" | |
| required: true | |
| concurrency: | |
| group: release-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| ZIG_VERSION: "0.16.0" | |
| jobs: | |
| # Linux + Windows: no fizzy_release environment (no signing secrets needed). | |
| package: | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - channel: x86-64-linux | |
| target: x86_64-linux-gnu | |
| runner: ubuntu-latest | |
| - channel: arm64-linux | |
| target: aarch64-linux-gnu | |
| runner: ubuntu-latest | |
| # Windows targets build natively on windows-latest using the runner's | |
| # system MSVC. build.zig installs a translate-c shim (src/tools/ | |
| # msvc_translatec_shim) and predefines SIZE_MAX so aro doesn't choke on | |
| # MSVC stdint.h's `0xff…ui64` literal. | |
| - channel: x86-64-windows | |
| target: x86_64-windows-msvc | |
| runner: windows-latest | |
| - channel: arm64-windows | |
| target: aarch64-windows-msvc | |
| runner: windows-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| env: | |
| ZIG_GLOBAL_CACHE_DIR: ${{ github.workspace }}/.zig-cache-${{ github.run_id }}-${{ matrix.channel }} | |
| ZIG_LOCAL_CACHE_DIR: ${{ github.workspace }}/.zig-cache-${{ github.run_id }}-${{ matrix.channel }}-local | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| fetch-tags: true | |
| fetch-depth: 0 | |
| - uses: mlugg/setup-zig@v2 | |
| with: | |
| version: ${{ env.ZIG_VERSION }} | |
| use-cache: false | |
| - name: Pre-create Zig cache tmp/ | |
| run: | | |
| mkdir -p "$ZIG_GLOBAL_CACHE_DIR/tmp" | |
| [[ "$ZIG_LOCAL_CACHE_DIR" != "$ZIG_GLOBAL_CACHE_DIR" ]] && mkdir -p "$ZIG_LOCAL_CACHE_DIR/tmp" || true | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: "8.0" | |
| # Prefetch before msvcup/package so lazy deps (e.g. zigwin32 from GitHub) get retry | |
| # backoff; zig build msvcup-setup alone can hit HttpConnectionClosing with no retries. | |
| - name: Fetch deps with retries | |
| run: | | |
| fetch() { | |
| local args="$1" | |
| local n=0 | |
| until [ "$n" -ge 5 ]; do | |
| zig build --fetch $args && return 0 | |
| n=$((n+1)) | |
| echo "Fetch attempt $n ($args) failed, sleeping $((n*10))s..." | |
| sleep $((n*10)) | |
| done | |
| return 1 | |
| } | |
| fetch "" || exit 1 | |
| fetch "-Dtarget=${{ matrix.target }}" || exit 1 | |
| - name: Package (${{ matrix.channel }}) | |
| run: | | |
| set -euo pipefail | |
| zig build package -Doptimize=ReleaseFast "-Dtarget=${{ matrix.target }}" | |
| - name: Upload zig-out-${{ matrix.channel }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: zig-out-${{ matrix.channel }} | |
| path: zig-out/${{ matrix.channel }} | |
| if-no-files-found: error | |
| package-macos: | |
| runs-on: ${{ matrix.runner }} | |
| environment: fizzy_release | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - channel: x86-64-macos | |
| target: x86_64-macos | |
| runner: macos-latest | |
| - channel: arm64-macos | |
| target: aarch64-macos | |
| runner: macos-latest | |
| env: | |
| ZIG_GLOBAL_CACHE_DIR: ${{ github.workspace }}/.zig-cache-${{ github.run_id }}-${{ matrix.channel }} | |
| ZIG_LOCAL_CACHE_DIR: ${{ github.workspace }}/.zig-cache-${{ github.run_id }}-${{ matrix.channel }}-local | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| fetch-tags: true | |
| fetch-depth: 0 | |
| - uses: mlugg/setup-zig@v2 | |
| with: | |
| version: ${{ env.ZIG_VERSION }} | |
| use-cache: false | |
| - name: Pre-create Zig cache tmp/ | |
| shell: bash | |
| run: | | |
| mkdir -p "$ZIG_GLOBAL_CACHE_DIR/tmp" | |
| [[ "$ZIG_LOCAL_CACHE_DIR" != "$ZIG_GLOBAL_CACHE_DIR" ]] && mkdir -p "$ZIG_LOCAL_CACHE_DIR/tmp" || true | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: "8.0" | |
| - name: Fetch deps with retries | |
| shell: bash | |
| run: | | |
| fetch() { | |
| local args="$1" | |
| local n=0 | |
| until [ "$n" -ge 5 ]; do | |
| zig build --fetch $args && return 0 | |
| n=$((n+1)) | |
| echo "Fetch attempt $n ($args) failed, sleeping $((n*10))s..." | |
| sleep $((n*10)) | |
| done | |
| return 1 | |
| } | |
| fetch "" || exit 1 | |
| fetch "-Dtarget=${{ matrix.target }}" || exit 1 | |
| - name: Check signing config | |
| id: signing_config | |
| env: | |
| HAS_CERT: ${{ secrets.FIZZY_MACOS_CERT_P12_BASE64 != '' }} | |
| HAS_NOTARY: ${{ secrets.FIZZY_APPLE_ID != '' }} | |
| run: | | |
| echo "cert=$HAS_CERT" >> "$GITHUB_OUTPUT" | |
| echo "notary=$HAS_NOTARY" >> "$GITHUB_OUTPUT" | |
| if [[ "$HAS_CERT" == "true" ]]; then echo "macOS signing: ENABLED"; else echo "macOS signing: disabled"; fi | |
| - name: Import signing certificate | |
| if: steps.signing_config.outputs.cert == 'true' | |
| uses: apple-actions/import-codesign-certs@v3 | |
| with: | |
| p12-file-base64: ${{ secrets.FIZZY_MACOS_CERT_P12_BASE64 }} | |
| p12-password: ${{ secrets.FIZZY_MACOS_CERT_PASSWORD }} | |
| keychain: fizzy-release-${{ matrix.channel }} | |
| create-keychain: true | |
| - name: Configure notarytool credentials | |
| if: steps.signing_config.outputs.notary == 'true' | |
| env: | |
| APPLE_ID: ${{ secrets.FIZZY_APPLE_ID }} | |
| APPLE_APP_PASSWORD: ${{ secrets.FIZZY_APPLE_APP_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.FIZZY_APPLE_TEAM_ID }} | |
| run: | | |
| set -euo pipefail | |
| xcrun notarytool store-credentials "fizzy-ci-notary-${{ matrix.channel }}" \ | |
| --apple-id "$APPLE_ID" \ | |
| --password "$APPLE_APP_PASSWORD" \ | |
| --team-id "$APPLE_TEAM_ID" | |
| echo "FIZZY_MACOS_NOTARY_PROFILE=fizzy-ci-notary-${{ matrix.channel }}" >> "$GITHUB_ENV" | |
| - name: Package (${{ matrix.channel }}) | |
| env: | |
| FIZZY_MACOS_SIGN_APP: ${{ secrets.FIZZY_MACOS_SIGN_APP }} | |
| FIZZY_MACOS_SIGN_INSTALLER: ${{ secrets.FIZZY_MACOS_SIGN_INSTALLER }} | |
| run: | | |
| set -euo pipefail | |
| zig build package -Doptimize=ReleaseFast "-Dtarget=${{ matrix.target }}" | |
| - name: Upload zig-out-${{ matrix.channel }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: zig-out-${{ matrix.channel }} | |
| path: zig-out/${{ matrix.channel }} | |
| if-no-files-found: error | |
| assemble: | |
| needs: [package, package-macos] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| fetch-tags: true | |
| fetch-depth: 0 | |
| # Each package job uploads zig-out/<channel>; merge into zig-out/<channel>/ for release.sh. | |
| - name: Download all channel outputs | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: zig-out-* | |
| path: _artifacts | |
| merge-multiple: false | |
| - name: Layout zig-out for release script | |
| run: | | |
| set -euo pipefail | |
| mkdir -p zig-out | |
| for d in _artifacts/zig-out-*; do | |
| [[ -d "$d" ]] || continue | |
| base="$(basename "$d")" | |
| ch="${base#zig-out-}" | |
| mkdir -p "zig-out/$ch" | |
| mv "$d"/* "zig-out/$ch/" | |
| done | |
| ls -la zig-out/*/ | |
| - name: Run release script (stage + gh release) | |
| shell: bash | |
| env: | |
| FIZZY_RELEASE_SKIP_BUILD: "1" | |
| FIZZY_RELEASE_PUBLISH: "0" | |
| run: ./scripts/release.sh |