| ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago | 1 | # Cut a release binary when a v* tag is pushed. |
| 2 | # |
| 3 | # nimstatic builds itself: a throwaway host build of the tool produces the |
| 4 | # static one that ships, which means the release artifact is also the test that |
| 5 | # the tool works on a clean machine. |
| 6 | name: Release |
| 7 | |
| 8 | on: |
| 9 | push: |
| 10 | tags: ["v*"] |
| 11 | workflow_dispatch: |
| 12 | inputs: |
| 13 | tag: |
| 14 | description: Existing tag to (re)build and attach binaries to |
| 15 | required: true |
| 16 | |
| 17 | permissions: |
| 18 | contents: write # required — a job is read-only unless it asks |
| 19 | |
| 20 | env: |
| 21 | NIM_VERSION: "2.2.4" |
| 22 | ZIG_VERSION: "0.15.1" |
| 23 | |
| 24 | jobs: |
| 25 | release: |
| 26 | runs-on: ubuntu-latest |
| 27 | steps: |
| 28 | - uses: actions/checkout@v4 |
| 29 | with: |
| 30 | ref: ${{ inputs.tag || github.ref }} |
| 31 | |
| 32 | # Toolchains come straight from upstream tarballs rather than setup |
| 33 | # actions: two curls, pinned versions, nothing else to trust. |
| 34 | - name: Install Nim and zig |
| 35 | run: | |
| 36 | set -euo pipefail |
| 37 | mkdir -p "$HOME/toolchains" |
| 38 | curl -sSfL "https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz" \ |
| 39 | | tar -xJ -C "$HOME/toolchains" |
| 40 | curl -sSfL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \ |
| 41 | | tar -xJ -C "$HOME/toolchains" |
| 42 | echo "$HOME/toolchains/nim-${NIM_VERSION}/bin" >> "$GITHUB_PATH" |
| 43 | echo "$HOME/toolchains/zig-x86_64-linux-${ZIG_VERSION}" >> "$GITHUB_PATH" |
| 44 | |
| 45 | - name: Versions |
| 46 | run: | |
| 47 | nim --version | head -1 |
| 48 | zig version |
| 49 | |
| 50 | # Alpine packages are cached so a re-run does not re-download them. |
| 51 | - uses: actions/cache@v4 |
| 52 | with: |
| 53 | path: ~/.cache/nimstatic |
| 54 | key: nimstatic-alpine-${{ runner.os }}-v3.21 |
| 55 | |
| 56 | - name: Test |
| 57 | id: test |
| 58 | run: nim c -d:ssl --hints:off -r tests/test_nimstatic.nim |
| 59 | |
| 60 | - name: Bootstrap nimstatic on the host |
| 61 | run: nim c -d:release -d:ssl --hints:off -o:nimstatic-host src/nimstatic.nim |
| 62 | |
| 63 | - name: Build the static binary with itself |
| ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 15h ago | 64 | env: |
| 65 | TAG: ${{ inputs.tag || github.ref_name }} |
| ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago | 66 | run: | |
| 67 | set -euo pipefail |
| ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 15h ago | 68 | VERSION="${TAG#v}" |
| ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago | 69 | NAME="nimstatic-${VERSION}-x86_64-linux" |
| 70 | ./nimstatic-host src/nimstatic.nim -o "$NAME" -- -d:ssl --passL:-s |
| ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 15h ago | 71 | # `file` is not on the runner image; ldd answers the only question |
| 72 | # that matters, and running it proves the thing actually starts. |
| ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago | 73 | ldd "$NAME" 2>&1 | grep -q "not a dynamic executable" |
| 74 | ./"$NAME" --help > /dev/null |
| 75 | xz -9e -k "$NAME" |
| 76 | sha256sum "$NAME" "$NAME.xz" > SHA256SUMS |
| 77 | cat SHA256SUMS |
| 78 | echo "NAME=$NAME" >> "$GITHUB_ENV" |
| 79 | |
| 80 | # The release exists already (the tag was pushed, or it is being rebuilt), |
| 81 | # so this attaches assets to it rather than creating one. The upload host |
| 82 | # is whatever the API itself advertises in upload_url, which is the one |
| 83 | # value that cannot go stale. |
| 84 | # The release exists already (the tag was pushed, or it is being rebuilt), |
| 85 | # so this attaches assets to it rather than creating one. The upload host |
| 86 | # is whatever the API advertises in upload_url — the one value that |
| 87 | # cannot go stale. |
| 88 | - name: Attach the binaries to the release |
| 89 | env: |
| 90 | TAG: ${{ inputs.tag || github.ref_name }} |
| 91 | run: | |
| 92 | set -euo pipefail |
| 93 | api() { curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \ |
| 94 | -H "Accept: application/vnd.github+json" "$@"; } |
| 95 | field() { python3 -c "import json,sys; print(json.load(sys.stdin).get(sys.argv[1],''))" "$1"; } |
| 96 | |
| 97 | if ! api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json; then |
| 98 | api -X POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases" \ |
| 99 | -d "{\"tag_name\":\"$TAG\",\"name\":\"nimstatic $TAG\"}" > release.json |
| 100 | fi |
| 101 | |
| 102 | upload_url=$(field upload_url < release.json | cut -d'{' -f1) |
| 103 | echo "uploading to $upload_url" |
| 104 | |
| 105 | for asset in "$NAME" "$NAME.xz" SHA256SUMS; do |
| 106 | # Replace an asset of the same name, so a re-run is idempotent. |
| 107 | existing=$(python3 -c "import json,sys; print(next((a['url'] for a in (json.load(open('release.json')).get('assets') or []) if a['name']==sys.argv[1]),''))" "$asset") |
| 108 | if [ -n "$existing" ]; then |
| 109 | api -X DELETE "$existing" > /dev/null |
| 110 | fi |
| 111 | api -X POST "$upload_url?name=$asset" \ |
| 112 | -H "Content-Type: application/octet-stream" \ |
| 113 | --data-binary "@$asset" > /dev/null |
| 114 | echo "uploaded $asset" |
| 115 | done |
| 116 | |
| 117 | - uses: actions/upload-artifact@v4 |
| 118 | with: |
| 119 | name: nimstatic-x86_64-linux |
| 120 | path: | |
| 121 | nimstatic-*-x86_64-linux |
| 122 | nimstatic-*-x86_64-linux.xz |
| 123 | SHA256SUMS |