nandi/nimstatic · release.yml

⑂ 8f17878c4684c445488082901882d46710a82481

release.yml · 144 lines · 5.7 KBYAML    Blame HistoryRaw
ci: build and attach release binaries on a v* tag   1# Cut a release binary when a v* tag is pushed.
3# nimstatic builds itself: a throwaway host build of the tool produces the
4# static one that ships, which means the release artifact is also the test that
5# the tool works on a clean machine.
6name: Release
  tags: ["v*"]
workflow_dispatch:
  inputs:
13
ci: make the dispatch tag input optional   14        description: Existing tag to (re)build and attach binaries to (default: the newest v*)
      required: false
ci: build and attach release binaries on a v* tag   16
17permissions:
contents: write        # required — a job is read-only unless it asks
NIM_VERSION: "2.2.4"
ZIG_VERSION: "0.15.1"
25
  runs-on: ubuntu-latest
27
    - uses: actions/checkout@v4
      with:
ci: resolve the release tag in one place   30          fetch-depth: 0     # tags, so a dispatch can find the latest one
    # One place decides which tag is being released: the dispatch input, the
    # tag that triggered the run, or — for a bare dispatch, which carries no
    # inputs through the API — the newest v* tag. Anything else is a mistake
    # worth stopping for, since the alternative is a release named after a
    # branch.
    - name: Resolve the tag
      env:
        INPUT_TAG: ${{ inputs.tag }}
      run: |
        set -euo pipefail
        if [ -n "${INPUT_TAG:-}" ]; then
          TAG="$INPUT_TAG"
        elif [ "$GITHUB_REF_TYPE" = tag ]; then
          TAG="$GITHUB_REF_NAME"
        else
          TAG=$(git tag --list 'v*' --sort=-v:refname | head -1)
        case "$TAG" in
          v*) ;;
          *) echo "refusing to release '$TAG': not a v* tag" >&2; exit 1 ;;
        esac
        git checkout --detach "$TAG"
        echo "releasing $TAG at $(git rev-parse --short HEAD)"
        echo "TAG=$TAG" >> "$GITHUB_ENV"
ci: build and attach release binaries on a v* tag   56
    # Toolchains come straight from upstream tarballs rather than setup
    # actions: two curls, pinned versions, nothing else to trust.
    - name: Install Nim and zig
      run: |
        set -euo pipefail
        mkdir -p "$HOME/toolchains"
        curl -sSfL "https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz" \
          | tar -xJ -C "$HOME/toolchains"
        curl -sSfL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
          | tar -xJ -C "$HOME/toolchains"
        echo "$HOME/toolchains/nim-${NIM_VERSION}/bin" >> "$GITHUB_PATH"
        echo "$HOME/toolchains/zig-x86_64-linux-${ZIG_VERSION}" >> "$GITHUB_PATH"
    - name: Versions
      run: |
        nim --version | head -1
        zig version
    # Alpine packages are cached so a re-run does not re-download them.
    - uses: actions/cache@v4
      with:
        path: ~/.cache/nimstatic
        key: nimstatic-alpine-${{ runner.os }}-v3.21
    - name: Test
      id: test
      run: nim c -d:ssl --hints:off -r tests/test_nimstatic.nim
    - name: Bootstrap nimstatic on the host
      run: nim c -d:release -d:ssl --hints:off -o:nimstatic-host src/nimstatic.nim
    - name: Build the static binary with itself
      run: |
        set -euo pipefail
ci: drop the file(1) check, and take the version from the tag input   91          VERSION="${TAG#v}"
ci: build and attach release binaries on a v* tag   92          NAME="nimstatic-${VERSION}-x86_64-linux"
        ./nimstatic-host src/nimstatic.nim -o "$NAME" -- -d:ssl --passL:-s
ci: drop the file(1) check, and take the version from the tag input   94          # `file` is not on the runner image; ldd answers the only question
        # that matters, and running it proves the thing actually starts.
ci: build and attach release binaries on a v* tag   96          ldd "$NAME" 2>&1 | grep -q "not a dynamic executable"
        ./"$NAME" --help > /dev/null
        xz -9e -k "$NAME"
        sha256sum "$NAME" "$NAME.xz" > SHA256SUMS
        cat SHA256SUMS
        echo "NAME=$NAME" >> "$GITHUB_ENV"
    # The release exists already (the tag was pushed, or it is being rebuilt),
    # so this attaches assets to it rather than creating one. The upload host
    # is whatever the API itself advertises in upload_url, which is the one
    # value that cannot go stale.
    # The release exists already (the tag was pushed, or it is being rebuilt),
    # so this attaches assets to it rather than creating one. The upload host
    # is whatever the API advertises in upload_url — the one value that
    # cannot go stale.
    - name: Attach the binaries to the release
      run: |
        set -euo pipefail
        api() { curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
                     -H "Accept: application/vnd.github+json" "$@"; }
        field() { python3 -c "import json,sys; print(json.load(sys.stdin).get(sys.argv[1],''))" "$1"; }
        if ! api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json; then
          api -X POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases" \
              -d "{\"tag_name\":\"$TAG\",\"name\":\"nimstatic $TAG\"}" > release.json
        upload_url=$(field upload_url < release.json | cut -d'{' -f1)
        echo "uploading to $upload_url"
        for asset in "$NAME" "$NAME.xz" SHA256SUMS; do
          # Replace an asset of the same name, so a re-run is idempotent.
          existing=$(python3 -c "import json,sys; print(next((a['url'] for a in (json.load(open('release.json')).get('assets') or []) if a['name']==sys.argv[1]),''))" "$asset")
          if [ -n "$existing" ]; then
            api -X DELETE "$existing" > /dev/null
          api -X POST "$upload_url?name=$asset" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@$asset" > /dev/null
          echo "uploaded $asset"
        done
    - uses: actions/upload-artifact@v4
      with:
        name: nimstatic-x86_64-linux
        path: |
          nimstatic-*-x86_64-linux
          nimstatic-*-x86_64-linux.xz
          SHA256SUMS

ci: build and attach release binaries on a v* tag 95124a2 nandi 18h ago	1	# Cut a release binary when a v* tag is pushed.
	2	#
	3	# nimstatic builds itself: a throwaway host build of the tool produces the
	4	# static one that ships, which means the release artifact is also the test that
	5	# the tool works on a clean machine.
	6	name: Release
	7
	8	on:
	9	push:
	10	tags: ["v*"]
	11	workflow_dispatch:
	12	inputs:
	13	tag:
ci: make the dispatch tag input optional 6a1e2aa nandi 18h ago	14	description: Existing tag to (re)build and attach binaries to (default: the newest v*)
	15	required: false
ci: build and attach release binaries on a v* tag 95124a2 nandi 18h ago	16
	17	permissions:
	18	contents: write # required — a job is read-only unless it asks
	19
	20	env:
	21	NIM_VERSION: "2.2.4"
	22	ZIG_VERSION: "0.15.1"
	23
	24	jobs:
	25	release:
	26	runs-on: ubuntu-latest
	27	steps:
	28	- uses: actions/checkout@v4
	29	with:
ci: resolve the release tag in one place 6da556b nandi 18h ago	30	fetch-depth: 0 # tags, so a dispatch can find the latest one
	31
	32	# One place decides which tag is being released: the dispatch input, the
	33	# tag that triggered the run, or — for a bare dispatch, which carries no
	34	# inputs through the API — the newest v* tag. Anything else is a mistake
	35	# worth stopping for, since the alternative is a release named after a
	36	# branch.
	37	- name: Resolve the tag
	38	env:
	39	INPUT_TAG: ${{ inputs.tag }}
	40	run: \|
	41	set -euo pipefail
	42	if [ -n "${INPUT_TAG:-}" ]; then
	43	TAG="$INPUT_TAG"
	44	elif [ "$GITHUB_REF_TYPE" = tag ]; then
	45	TAG="$GITHUB_REF_NAME"
	46	else
	47	TAG=$(git tag --list 'v*' --sort=-v:refname \| head -1)
	48	fi
	49	case "$TAG" in
	50	v*) ;;
	51	) echo "refusing to release '$TAG': not a v tag" >&2; exit 1 ;;
	52	esac
	53	git checkout --detach "$TAG"
	54	echo "releasing $TAG at $(git rev-parse --short HEAD)"
	55	echo "TAG=$TAG" >> "$GITHUB_ENV"
ci: build and attach release binaries on a v* tag 95124a2 nandi 18h ago	56
	57	# Toolchains come straight from upstream tarballs rather than setup
	58	# actions: two curls, pinned versions, nothing else to trust.
	59	- name: Install Nim and zig
	60	run: \|
	61	set -euo pipefail
	62	mkdir -p "$HOME/toolchains"
	63	curl -sSfL "https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz" \
	64	\| tar -xJ -C "$HOME/toolchains"
	65	curl -sSfL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
	66	\| tar -xJ -C "$HOME/toolchains"
	67	echo "$HOME/toolchains/nim-${NIM_VERSION}/bin" >> "$GITHUB_PATH"
	68	echo "$HOME/toolchains/zig-x86_64-linux-${ZIG_VERSION}" >> "$GITHUB_PATH"
	69
	70	- name: Versions
	71	run: \|
	72	nim --version \| head -1
	73	zig version
	74
	75	# Alpine packages are cached so a re-run does not re-download them.
	76	- uses: actions/cache@v4
	77	with:
	78	path: ~/.cache/nimstatic
	79	key: nimstatic-alpine-${{ runner.os }}-v3.21
	80
	81	- name: Test
	82	id: test
	83	run: nim c -d:ssl --hints:off -r tests/test_nimstatic.nim
	84
	85	- name: Bootstrap nimstatic on the host
	86	run: nim c -d:release -d:ssl --hints:off -o:nimstatic-host src/nimstatic.nim
	87
	88	- name: Build the static binary with itself
	89	run: \|
	90	set -euo pipefail
ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 18h ago	91	VERSION="${TAG#v}"
ci: build and attach release binaries on a v* tag 95124a2 nandi 18h ago	92	NAME="nimstatic-${VERSION}-x86_64-linux"
	93	./nimstatic-host src/nimstatic.nim -o "$NAME" -- -d:ssl --passL:-s
ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 18h ago	94	# `file` is not on the runner image; ldd answers the only question
	95	# that matters, and running it proves the thing actually starts.
ci: build and attach release binaries on a v* tag 95124a2 nandi 18h ago	96	ldd "$NAME" 2>&1 \| grep -q "not a dynamic executable"
	97	./"$NAME" --help > /dev/null
	98	xz -9e -k "$NAME"
	99	sha256sum "$NAME" "$NAME.xz" > SHA256SUMS
	100	cat SHA256SUMS
	101	echo "NAME=$NAME" >> "$GITHUB_ENV"
	102
	103	# The release exists already (the tag was pushed, or it is being rebuilt),
	104	# so this attaches assets to it rather than creating one. The upload host
	105	# is whatever the API itself advertises in upload_url, which is the one
	106	# value that cannot go stale.
	107	# The release exists already (the tag was pushed, or it is being rebuilt),
	108	# so this attaches assets to it rather than creating one. The upload host
	109	# is whatever the API advertises in upload_url — the one value that
	110	# cannot go stale.
	111	- name: Attach the binaries to the release
	112	run: \|
	113	set -euo pipefail
	114	api() { curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
	115	-H "Accept: application/vnd.github+json" "$@"; }
	116	field() { python3 -c "import json,sys; print(json.load(sys.stdin).get(sys.argv[1],''))" "$1"; }
	117
	118	if ! api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json; then
	119	api -X POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases" \
	120	-d "{\"tag_name\":\"$TAG\",\"name\":\"nimstatic $TAG\"}" > release.json
	121	fi
	122
	123	upload_url=$(field upload_url < release.json \| cut -d'{' -f1)
	124	echo "uploading to $upload_url"
	125
	126	for asset in "$NAME" "$NAME.xz" SHA256SUMS; do
	127	# Replace an asset of the same name, so a re-run is idempotent.
	128	existing=$(python3 -c "import json,sys; print(next((a['url'] for a in (json.load(open('release.json')).get('assets') or []) if a['name']==sys.argv[1]),''))" "$asset")
	129	if [ -n "$existing" ]; then
	130	api -X DELETE "$existing" > /dev/null
	131	fi
	132	api -X POST "$upload_url?name=$asset" \
	133	-H "Content-Type: application/octet-stream" \
	134	--data-binary "@$asset" > /dev/null
	135	echo "uploaded $asset"
	136	done
	137
	138	- uses: actions/upload-artifact@v4
	139	with:
	140	name: nimstatic-x86_64-linux
	141	path: \|
	142	nimstatic-*-x86_64-linux
	143	nimstatic-*-x86_64-linux.xz
	144	SHA256SUMS