1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: Release
on:
push:
tags:
- 'v*'
workflow_dispatch:
inputs:
tag:
description: 'Release tag (e.g. v0.1.0)'
required: true
permissions:
contents: write
jobs:
build:
name: Build ${{ matrix.target }}
runs-on: ${{ matrix.os }}
strategy:
matrix:
include:
- os: macos-15
target: aarch64-apple-darwin
archive: tar
- os: macos-15-intel
target: x86_64-apple-darwin
archive: tar
- os: ubuntu-24.04
target: x86_64-unknown-linux-gnu
archive: tar
- os: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
archive: tar
- os: windows-2025
target: x86_64-pc-windows-msvc
archive: zip
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
ref: ${{ github.event.inputs.tag || github.ref_name }}
fetch-depth: 0
persist-credentials: false
- name: Verify release source
shell: bash
env:
TAG: ${{ github.event.inputs.tag || github.ref_name }}
run: ./scripts/release-assets.sh "$TAG"
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
with:
targets: ${{ matrix.target }}
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: ${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}
- name: Build
run: cargo build --release --bin afdata --target ${{ matrix.target }}
- name: Package
shell: bash
env:
TAG: ${{ github.event.inputs.tag || github.ref_name }}
TARGET: ${{ matrix.target }}
ARCHIVE_KIND: ${{ matrix.archive }}
run: |
set -euo pipefail
BIN_DIR="target/${TARGET}/release"
if [ "$ARCHIVE_KIND" = "zip" ]; then
ARCHIVE="afdata-${TAG}-${TARGET}.zip"
cd "$BIN_DIR" && 7z a "../../../$ARCHIVE" afdata.exe && cd -
else
ARCHIVE="afdata-${TAG}-${TARGET}.tar.gz"
tar -czf "$ARCHIVE" -C "$BIN_DIR" afdata
fi
"$BIN_DIR/afdata" --version | grep -q "\"version\":\"${TAG#v}\""
echo "TAG=$TAG" >> "$GITHUB_ENV"
# Take the digest and write the line, rather than letting each
# platform's tool spell it. Git Bash's sha256sum treats an archive as
# binary and writes `<digest> *<name>`, where GNU coreutils on Linux
# and shasum on macOS write `<digest> <name>`. This file is published
# for people and read by the package channels, so one spelling on
# every platform is the point — and it is the spelling
# release-assets.sh verifies the upload against.
if command -v sha256sum >/dev/null 2>&1; then
DIGEST="$(sha256sum "$ARCHIVE" | awk '{print $1}')"
else
DIGEST="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
fi
printf '%s %s\n' "$DIGEST" "$ARCHIVE" > "${ARCHIVE}.sha256"
echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"
- name: Upload immutable release assets
shell: bash
run: ./scripts/release-assets.sh "$TAG" "$ARCHIVE" "${ARCHIVE}.sha256"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}