nandi/nimstatic · release.yml

⑂ a977b7e367fc28e3d961c85beb78bd0d2f5376df

release.yml · 158 lines · 6.5 KBYAML    Blame HistoryRaw
ci: build and attach release binaries on a v* tag   1# Cut a release binary when a v* tag is pushed.
3# nimstatic builds itself: a throwaway host build of the tool produces the
4# static one that ships, which means the release artifact is also the test that
5# the tool works on a clean machine.
6name: Release
  tags: ["v*"]
workflow_dispatch:
  inputs:
13
ci: quote the dispatch input description, and bump to 0.1.3   14        description: "Existing tag to rebuild; defaults to the newest v* tag"
ci: make the dispatch tag input optional   15        required: false
ci: build and attach release binaries on a v* tag   16
17permissions:
contents: write        # required — a job is read-only unless it asks
NIM_VERSION: "2.2.4"
ZIG_VERSION: "0.15.1"
25
  runs-on: ubuntu-latest
27
    - uses: actions/checkout@v4
      with:
ci: resolve the release tag in one place   30          fetch-depth: 0     # tags, so a dispatch can find the latest one
    # One place decides which tag is being released: the dispatch input, the
    # tag that triggered the run, or — for a bare dispatch, which carries no
    # inputs through the API — the newest v* tag. Anything else is a mistake
    # worth stopping for, since the alternative is a release named after a
    # branch.
    - name: Resolve the tag
      env:
        INPUT_TAG: ${{ inputs.tag }}
      run: |
        set -euo pipefail
ci: resolve the tag without GITHUB_REF_TYPE or git   42          # Every variable here is read with a default: this runner does not
        # set GITHUB_REF_TYPE, and under `set -u` one missing name is a dead
        # job three steps before anything interesting happens.
        REF="${GITHUB_REF:-}"
ci: resolve the release tag in one place   46          if [ -n "${INPUT_TAG:-}" ]; then
          TAG="$INPUT_TAG"
        else
ci: resolve the tag without GITHUB_REF_TYPE or git   49            case "$REF" in
            refs/tags/*) TAG="${REF#refs/tags/}" ;;
              # A dispatch: no tag in the ref, so ask the API for the newest.
              TAG=$(curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
                      "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/tags" \
                    | python3 -c "import json,sys; ts=[t['name'] for t in json.load(sys.stdin) if t['name'].startswith('v')]; print(ts[0] if ts else '')")
          esac
ci: resolve the release tag in one place   58
        case "$TAG" in
          v*) ;;
          *) echo "refusing to release '$TAG': not a v* tag" >&2; exit 1 ;;
        esac
ci: resolve the tag without GITHUB_REF_TYPE or git   63          # The runner hands a tag build the right tree already; a dispatch
        # gets whatever branch it ran on, so move only when we can.
        if [ -d .git ]; then
          git checkout --detach "$TAG" 2>/dev/null || echo "note: building the checked-out tree, not $TAG"
        echo "releasing $TAG"
ci: resolve the release tag in one place   69          echo "TAG=$TAG" >> "$GITHUB_ENV"
ci: build and attach release binaries on a v* tag   70
    # Toolchains come straight from upstream tarballs rather than setup
    # actions: two curls, pinned versions, nothing else to trust.
    - name: Install Nim and zig
      run: |
        set -euo pipefail
        mkdir -p "$HOME/toolchains"
        curl -sSfL "https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz" \
          | tar -xJ -C "$HOME/toolchains"
        curl -sSfL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
          | tar -xJ -C "$HOME/toolchains"
        echo "$HOME/toolchains/nim-${NIM_VERSION}/bin" >> "$GITHUB_PATH"
        echo "$HOME/toolchains/zig-x86_64-linux-${ZIG_VERSION}" >> "$GITHUB_PATH"
    - name: Versions
      run: |
        nim --version | head -1
        zig version
    # Alpine packages are cached so a re-run does not re-download them.
    - uses: actions/cache@v4
      with:
        path: ~/.cache/nimstatic
        key: nimstatic-alpine-${{ runner.os }}-v3.21
    - name: Test
      id: test
      run: nim c -d:ssl --hints:off -r tests/test_nimstatic.nim
    - name: Bootstrap nimstatic on the host
      run: nim c -d:release -d:ssl --hints:off -o:nimstatic-host src/nimstatic.nim
    - name: Build the static binary with itself
      run: |
        set -euo pipefail
ci: drop the file(1) check, and take the version from the tag input   105          VERSION="${TAG#v}"
ci: build and attach release binaries on a v* tag   106          NAME="nimstatic-${VERSION}-x86_64-linux"
        ./nimstatic-host src/nimstatic.nim -o "$NAME" -- -d:ssl --passL:-s
ci: drop the file(1) check, and take the version from the tag input   108          # `file` is not on the runner image; ldd answers the only question
        # that matters, and running it proves the thing actually starts.
ci: build and attach release binaries on a v* tag   110          ldd "$NAME" 2>&1 | grep -q "not a dynamic executable"
        ./"$NAME" --help > /dev/null
        xz -9e -k "$NAME"
        sha256sum "$NAME" "$NAME.xz" > SHA256SUMS
        cat SHA256SUMS
        echo "NAME=$NAME" >> "$GITHUB_ENV"
    # The release exists already (the tag was pushed, or it is being rebuilt),
    # so this attaches assets to it rather than creating one. The upload host
    # is whatever the API itself advertises in upload_url, which is the one
    # value that cannot go stale.
    # The release exists already (the tag was pushed, or it is being rebuilt),
    # so this attaches assets to it rather than creating one. The upload host
    # is whatever the API advertises in upload_url — the one value that
    # cannot go stale.
    - name: Attach the binaries to the release
      run: |
        set -euo pipefail
        api() { curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
                     -H "Accept: application/vnd.github+json" "$@"; }
        field() { python3 -c "import json,sys; print(json.load(sys.stdin).get(sys.argv[1],''))" "$1"; }
        if ! api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json; then
          api -X POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases" \
              -d "{\"tag_name\":\"$TAG\",\"name\":\"nimstatic $TAG\"}" > release.json
        upload_url=$(field upload_url < release.json | cut -d'{' -f1)
        echo "uploading to $upload_url"
        for asset in "$NAME" "$NAME.xz" SHA256SUMS; do
          # Replace an asset of the same name, so a re-run is idempotent.
          existing=$(python3 -c "import json,sys; print(next((a['url'] for a in (json.load(open('release.json')).get('assets') or []) if a['name']==sys.argv[1]),''))" "$asset")
          if [ -n "$existing" ]; then
            api -X DELETE "$existing" > /dev/null
          api -X POST "$upload_url?name=$asset" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@$asset" > /dev/null
          echo "uploaded $asset"
        done
    - uses: actions/upload-artifact@v4
      with:
        name: nimstatic-x86_64-linux
        path: |
          nimstatic-*-x86_64-linux
          nimstatic-*-x86_64-linux.xz
          SHA256SUMS

ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago	1	# Cut a release binary when a v* tag is pushed.
	2	#
	3	# nimstatic builds itself: a throwaway host build of the tool produces the
	4	# static one that ships, which means the release artifact is also the test that
	5	# the tool works on a clean machine.
	6	name: Release
	7
	8	on:
	9	push:
	10	tags: ["v*"]
	11	workflow_dispatch:
	12	inputs:
	13	tag:
ci: quote the dispatch input description, and bump to 0.1.3 691dd59 nandi 15h ago	14	description: "Existing tag to rebuild; defaults to the newest v* tag"
ci: make the dispatch tag input optional 6a1e2aa nandi 15h ago	15	required: false
ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago	16
	17	permissions:
	18	contents: write # required — a job is read-only unless it asks
	19
	20	env:
	21	NIM_VERSION: "2.2.4"
	22	ZIG_VERSION: "0.15.1"
	23
	24	jobs:
	25	release:
	26	runs-on: ubuntu-latest
	27	steps:
	28	- uses: actions/checkout@v4
	29	with:
ci: resolve the release tag in one place 6da556b nandi 15h ago	30	fetch-depth: 0 # tags, so a dispatch can find the latest one
	31
	32	# One place decides which tag is being released: the dispatch input, the
	33	# tag that triggered the run, or — for a bare dispatch, which carries no
	34	# inputs through the API — the newest v* tag. Anything else is a mistake
	35	# worth stopping for, since the alternative is a release named after a
	36	# branch.
	37	- name: Resolve the tag
	38	env:
	39	INPUT_TAG: ${{ inputs.tag }}
	40	run: \|
	41	set -euo pipefail
ci: resolve the tag without GITHUB_REF_TYPE or git a977b7e nandi 15h ago	42	# Every variable here is read with a default: this runner does not
	43	# set GITHUB_REF_TYPE, and under `set -u` one missing name is a dead
	44	# job three steps before anything interesting happens.
	45	REF="${GITHUB_REF:-}"
ci: resolve the release tag in one place 6da556b nandi 15h ago	46	if [ -n "${INPUT_TAG:-}" ]; then
	47	TAG="$INPUT_TAG"
	48	else
ci: resolve the tag without GITHUB_REF_TYPE or git a977b7e nandi 15h ago	49	case "$REF" in
	50	refs/tags/*) TAG="${REF#refs/tags/}" ;;
	51	*)
	52	# A dispatch: no tag in the ref, so ask the API for the newest.
	53	TAG=$(curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
	54	"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/tags" \
	55	\| python3 -c "import json,sys; ts=[t['name'] for t in json.load(sys.stdin) if t['name'].startswith('v')]; print(ts[0] if ts else '')")
	56	;;
	57	esac
ci: resolve the release tag in one place 6da556b nandi 15h ago	58	fi
	59	case "$TAG" in
	60	v*) ;;
	61	) echo "refusing to release '$TAG': not a v tag" >&2; exit 1 ;;
	62	esac
ci: resolve the tag without GITHUB_REF_TYPE or git a977b7e nandi 15h ago	63	# The runner hands a tag build the right tree already; a dispatch
	64	# gets whatever branch it ran on, so move only when we can.
	65	if [ -d .git ]; then
	66	git checkout --detach "$TAG" 2>/dev/null \|\| echo "note: building the checked-out tree, not $TAG"
	67	fi
	68	echo "releasing $TAG"
ci: resolve the release tag in one place 6da556b nandi 15h ago	69	echo "TAG=$TAG" >> "$GITHUB_ENV"
ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago	70
	71	# Toolchains come straight from upstream tarballs rather than setup
	72	# actions: two curls, pinned versions, nothing else to trust.
	73	- name: Install Nim and zig
	74	run: \|
	75	set -euo pipefail
	76	mkdir -p "$HOME/toolchains"
	77	curl -sSfL "https://nim-lang.org/download/nim-${NIM_VERSION}-linux_x64.tar.xz" \
	78	\| tar -xJ -C "$HOME/toolchains"
	79	curl -sSfL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
	80	\| tar -xJ -C "$HOME/toolchains"
	81	echo "$HOME/toolchains/nim-${NIM_VERSION}/bin" >> "$GITHUB_PATH"
	82	echo "$HOME/toolchains/zig-x86_64-linux-${ZIG_VERSION}" >> "$GITHUB_PATH"
	83
	84	- name: Versions
	85	run: \|
	86	nim --version \| head -1
	87	zig version
	88
	89	# Alpine packages are cached so a re-run does not re-download them.
	90	- uses: actions/cache@v4
	91	with:
	92	path: ~/.cache/nimstatic
	93	key: nimstatic-alpine-${{ runner.os }}-v3.21
	94
	95	- name: Test
	96	id: test
	97	run: nim c -d:ssl --hints:off -r tests/test_nimstatic.nim
	98
	99	- name: Bootstrap nimstatic on the host
	100	run: nim c -d:release -d:ssl --hints:off -o:nimstatic-host src/nimstatic.nim
	101
	102	- name: Build the static binary with itself
	103	run: \|
	104	set -euo pipefail
ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 15h ago	105	VERSION="${TAG#v}"
ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago	106	NAME="nimstatic-${VERSION}-x86_64-linux"
	107	./nimstatic-host src/nimstatic.nim -o "$NAME" -- -d:ssl --passL:-s
ci: drop the file(1) check, and take the version from the tag input 63a7159 nandi 15h ago	108	# `file` is not on the runner image; ldd answers the only question
	109	# that matters, and running it proves the thing actually starts.
ci: build and attach release binaries on a v* tag 95124a2 nandi 15h ago	110	ldd "$NAME" 2>&1 \| grep -q "not a dynamic executable"
	111	./"$NAME" --help > /dev/null
	112	xz -9e -k "$NAME"
	113	sha256sum "$NAME" "$NAME.xz" > SHA256SUMS
	114	cat SHA256SUMS
	115	echo "NAME=$NAME" >> "$GITHUB_ENV"
	116
	117	# The release exists already (the tag was pushed, or it is being rebuilt),
	118	# so this attaches assets to it rather than creating one. The upload host
	119	# is whatever the API itself advertises in upload_url, which is the one
	120	# value that cannot go stale.
	121	# The release exists already (the tag was pushed, or it is being rebuilt),
	122	# so this attaches assets to it rather than creating one. The upload host
	123	# is whatever the API advertises in upload_url — the one value that
	124	# cannot go stale.
	125	- name: Attach the binaries to the release
	126	run: \|
	127	set -euo pipefail
	128	api() { curl -sSfL -H "Authorization: Bearer $GITHUB_TOKEN" \
	129	-H "Accept: application/vnd.github+json" "$@"; }
	130	field() { python3 -c "import json,sys; print(json.load(sys.stdin).get(sys.argv[1],''))" "$1"; }
	131
	132	if ! api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json; then
	133	api -X POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases" \
	134	-d "{\"tag_name\":\"$TAG\",\"name\":\"nimstatic $TAG\"}" > release.json
	135	fi
	136
	137	upload_url=$(field upload_url < release.json \| cut -d'{' -f1)
	138	echo "uploading to $upload_url"
	139
	140	for asset in "$NAME" "$NAME.xz" SHA256SUMS; do
	141	# Replace an asset of the same name, so a re-run is idempotent.
	142	existing=$(python3 -c "import json,sys; print(next((a['url'] for a in (json.load(open('release.json')).get('assets') or []) if a['name']==sys.argv[1]),''))" "$asset")
	143	if [ -n "$existing" ]; then
	144	api -X DELETE "$existing" > /dev/null
	145	fi
	146	api -X POST "$upload_url?name=$asset" \
	147	-H "Content-Type: application/octet-stream" \
	148	--data-binary "@$asset" > /dev/null
	149	echo "uploaded $asset"
	150	done
	151
	152	- uses: actions/upload-artifact@v4
	153	with:
	154	name: nimstatic-x86_64-linux
	155	path: \|
	156	nimstatic-*-x86_64-linux
	157	nimstatic-*-x86_64-linux.xz
	158	SHA256SUMS