name: Release
on:
push:
tags:
- "v*"
workflow_call:
inputs:
tag:
description: The tag to release, including the leading v.
required: true
type: string
permissions:
contents: write
env:
RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
jobs:
verify:
name: Verify
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
- name: Verify tag matches Cargo.toml version
run: |
set -euo pipefail
tag="${RELEASE_TAG#v}"
# Without `|| true` a non-matching grep aborts the assignment under `bash -e`
# and the ::error:: below never prints.
manifest=$(grep '^version = ' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/' || true)
if [ -z "$manifest" ]; then
echo "::error::could not read a version from Cargo.toml"
exit 1
fi
if [ "$tag" != "$manifest" ]; then
echo "::error::tag ${RELEASE_TAG} does not match Cargo.toml version ${manifest}"
exit 1
fi
echo "tag ${RELEASE_TAG} matches Cargo.toml version ${manifest}"
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
- name: Cache Cargo
uses: Swatinem/rust-cache@v2
- name: Format
run: cargo fmt --check
- name: Clippy
run: cargo clippy --locked --all-targets -- -D warnings
- name: Test
run: cargo test --locked --all-features
env:
UPKEEP_REQUIRE_NETWORK_TESTS: "1"
- name: Dry-run package
run: cargo publish --dry-run --locked
msrv:
name: MSRV
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
- name: Read MSRV from Cargo.toml
id: msrv
run: echo "version=$(grep '^rust-version = ' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')" >> "$GITHUB_OUTPUT"
- name: Install Rust ${{ steps.msrv.outputs.version }}
uses: dtolnay/rust-toolchain@master
with:
toolchain: ${{ steps.msrv.outputs.version }}
- name: Cache Cargo
uses: Swatinem/rust-cache@v2
- name: Check against declared MSRV
run: cargo check --locked --all-targets
build:
name: Build ${{ matrix.target }}
runs-on: ${{ matrix.os }}
needs: [verify, msrv]
strategy:
fail-fast: false
matrix:
include:
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
archive_ext: tar.gz
bin_ext: ""
use_cross: false
- target: aarch64-unknown-linux-gnu
os: ubuntu-latest
archive_ext: tar.gz
bin_ext: ""
use_cross: true
- target: x86_64-apple-darwin
os: macos-latest
archive_ext: tar.gz
bin_ext: ""
use_cross: false
- target: aarch64-apple-darwin
os: macos-latest
archive_ext: tar.gz
bin_ext: ""
use_cross: false
- target: x86_64-pc-windows-msvc
os: windows-latest
archive_ext: zip
bin_ext: ".exe"
use_cross: false
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- name: Install cross
if: matrix.use_cross
uses: taiki-e/install-action@v2
with:
tool: cross
- name: Build
shell: bash
run: |
if [ "${{ matrix.use_cross }}" = "true" ]; then
cross build --locked --release --target "${{ matrix.target }}"
else
cargo build --locked --release --target "${{ matrix.target }}"
fi
- name: Package (Unix)
if: runner.os != 'Windows'
shell: bash
run: |
mkdir -p dist
archive="cargo-upkeep-${{ matrix.target }}.${{ matrix.archive_ext }}"
tar -czf "dist/${archive}" -C "target/${{ matrix.target }}/release" "cargo-upkeep"
(cd dist && shasum -a 256 "${archive}" > "${archive}.sha256")
- name: Package (Windows)
if: runner.os == 'Windows'
shell: pwsh
run: |
New-Item -ItemType Directory -Force dist | Out-Null
New-Item -ItemType Directory -Force staging | Out-Null
$archive = "cargo-upkeep-${{ matrix.target }}.${{ matrix.archive_ext }}"
$binary = "target/${{ matrix.target }}/release/cargo-upkeep${{ matrix.bin_ext }}"
Copy-Item $binary -Destination "staging/cargo-upkeep${{ matrix.bin_ext }}"
Compress-Archive -Path "staging/cargo-upkeep${{ matrix.bin_ext }}" -DestinationPath "dist/$archive"
$hash = (Get-FileHash -Algorithm SHA256 "dist/$archive").Hash.ToLower()
"$hash $archive" | Out-File -Encoding ascii "dist/$archive.sha256"
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: cargo-upkeep-${{ matrix.target }}
path: dist/*
release:
name: Publish Release
runs-on: ubuntu-latest
needs: publish-crate
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
fetch-depth: 0
- name: Download artifacts
uses: actions/download-artifact@v4
with:
path: dist
merge-multiple: true
- name: Generate changelog
uses: orhun/git-cliff-action@v4
id: changelog
with:
config: cliff.toml
args: --latest --strip header
env:
OUTPUT: CHANGELOG.md
- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
tag_name: ${{ env.RELEASE_TAG }}
files: dist/**
body: ${{ steps.changelog.outputs.content }}
draft: false
prerelease: false
publish-crate:
name: Publish to crates.io
runs-on: ubuntu-latest
needs: build
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Skip if this version is already published
id: published
run: |
set -euo pipefail
version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
# crates.io returns 403 without a User-Agent, so an unauthenticated probe
# would always look like "not published".
http_code=$(curl -s -o /dev/null -w '%{http_code}' \
-H 'User-Agent: cargo-upkeep-release-ci' \
"https://crates.io/api/v1/crates/cargo-upkeep/${version}" || echo 000)
# Skip ONLY on a definitive 200. A wrong skip would leave the crate
# unpublished while the release job still advertises it, which is far worse
# than a redundant publish attempt that fails safely on "already uploaded".
case "$http_code" in
200) echo "cargo-upkeep ${version} is already on crates.io; skipping publish"
echo "skip=true" >> "$GITHUB_OUTPUT" ;;
404) echo "cargo-upkeep ${version} is not published; publishing" ;;
*) echo "::warning::crates.io probe returned ${http_code}; attempting publish anyway" ;;
esac
- name: Publish to crates.io
if: steps.published.outputs.skip != 'true'
run: cargo publish --locked
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}