on:
push:
tags:
- "v[0-9]*"
- "v[0-9]*-rc*"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
name: 🚀 Release 🚀
jobs:
build-binaries:
name: 📦 Build (${{ matrix.target }}) 📦
runs-on: ${{ matrix.os }}
permissions:
contents: read
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
use-cross: false
- os: ubuntu-latest
target: x86_64-unknown-linux-musl
use-cross: true
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
use-cross: true
- os: macos-latest
target: x86_64-apple-darwin
use-cross: false
- os: macos-latest
target: aarch64-apple-darwin
use-cross: false
- os: windows-latest
target: x86_64-pc-windows-msvc
use-cross: false
steps:
- name: ✅ Checkout ✅
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: 🦀 Install Rust toolchain 🦀
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
with:
toolchain: stable
targets: ${{ matrix.target }}
- name: 📦 Install cargo-binstall 📦
uses: cargo-bins/cargo-binstall@aaa84a43aec4955a42c5ffc65d258961e39f276e
- name: 🔧 Install cross 🔧
if: matrix.use-cross
run: cargo binstall --no-confirm --maximum-resolution-timeout 20 cross
- name: 🏗️ Build 🏗️
run: |
if [ "${{ matrix.use-cross }}" = "true" ]; then
cross build --release --target ${{ matrix.target }}
else
cargo build --release --target ${{ matrix.target }}
fi
shell: bash
- name: 📁 Package (Unix) 📁
if: runner.os != 'Windows'
run: |
VERSION="${GITHUB_REF_NAME#v}"
ARCHIVE="audit-check-${{ matrix.target }}-v${VERSION}.tar.gz"
cp "target/${{ matrix.target }}/release/audit-check" ./audit-check
tar czf "$ARCHIVE" audit-check
echo "ASSET=$ARCHIVE" >> "$GITHUB_ENV"
shell: bash
- name: 📁 Package (Windows) 📁
if: runner.os == 'Windows'
run: |
$VERSION = $env:GITHUB_REF_NAME -replace '^v', ''
$ARCHIVE = "audit-check-${{ matrix.target }}-v${VERSION}.zip"
Copy-Item "target\${{ matrix.target }}\release\audit-check.exe" "audit-check.exe"
Compress-Archive -Path audit-check.exe -DestinationPath $ARCHIVE
"ASSET=$ARCHIVE" | Out-File -FilePath $env:GITHUB_ENV -Append
shell: pwsh
- name: ⬆️ Upload artifact ⬆️
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with:
name: binary-${{ matrix.target }}
path: ${{ env.ASSET }}
if-no-files-found: error
release:
name: 📝 Create GitHub Release 📝
needs: build-binaries
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: ✅ Checkout ✅
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: ⬇️ Download artifacts ⬇️
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
pattern: binary-*
path: dist
merge-multiple: true
- name: 🚀 Create GitHub Release 🚀
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
with:
tag_name: ${{ github.ref_name }}
generate_release_notes: true
prerelease: ${{ contains(github.ref_name, '-rc') }}
files: dist/*
publish-docker:
name: 🐳 Publish Docker Image 🐳
needs: release
runs-on: ubuntu-latest
permissions:
packages: write
contents: read
steps:
- name: ✅ Checkout ✅
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: ⬇️ Download audit-check musl artifact ⬇️
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
name: binary-x86_64-unknown-linux-musl
path: dist/
- name: 📦 Extract audit-check binary 📦
run: |
mkdir -p binary
tar xzf dist/audit-check-x86_64-unknown-linux-musl-*.tar.gz -C dist/
mv dist/audit-check binary/audit-check
shell: bash
- name: ⬇️ Download cargo-audit musl binary ⬇️
run: |
RELEASE=$(curl -s \
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
"https://api.github.com/repos/rustsec/rustsec/releases" \
| jq -r '[.[] | select(.tag_name | startswith("cargo-audit/"))][0].tag_name')
VERSION="${RELEASE#cargo-audit/v}"
URL="https://github.com/rustsec/rustsec/releases/download/cargo-audit%2Fv${VERSION}/cargo-audit-x86_64-unknown-linux-musl-v${VERSION}.tgz"
curl -fL "$URL" -o cargo-audit.tgz
mkdir -p cargo-audit-extract
tar xzf cargo-audit.tgz -C cargo-audit-extract
find cargo-audit-extract -type f -name 'cargo-audit' -exec mv {} binary/cargo-audit \;
shell: bash
- name: 🐳 Set up Docker Buildx 🐳
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
- name: 🔑 Log in to GHCR 🔑
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: 🏷️ Extract Docker metadata 🏷️
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern=v{{major}}
type=raw,value=latest,enable=${{ !contains(github.ref_name, '-rc') }}
- name: 🐳 Build and push Docker image 🐳
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
update-major-tag:
name: 🏷️ Update Major Version Tag 🏷️
needs: release
runs-on: ubuntu-latest
if: ${{ !contains(github.ref_name, '-rc') }}
permissions:
contents: write
steps:
- name: ✅ Checkout ✅
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: 🏷️ Move major version tag 🏷️
run: |
major="v$(echo '${{ github.ref_name }}' | sed 's/^v//' | cut -d. -f1)"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git tag -f "$major" ${{ github.sha }}
git push origin -f "refs/tags/$major"