name: Release
on:
push:
branches:
- main
workflow_dispatch:
inputs:
publish-existing-tag:
description: Re-publish an existing GitHub release tag's native artifacts.
required: false
type: string
default: ""
permissions:
contents: read
env:
MACOSX_DEPLOYMENT_TARGET: "13.3"
CARGO_HTTP_MULTIPLEXING: "false"
CARGO_NET_RETRY: "10"
jobs:
release-please:
name: release please
if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-existing-tag == '' }}
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: write
pull-requests: write
outputs:
release-created: ${{ steps.release.outputs.release_created }}
tag-name: ${{ steps.release.outputs.tag_name }}
version: ${{ steps.release.outputs.version }}
steps:
- name: Create release pull request or GitHub release
id: release
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 with:
token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
config-file: release-please-config.json
manifest-file: .release-please-manifest.json
release-target:
name: resolve release target
needs: release-please
if: ${{ always() && (github.event_name == 'workflow_dispatch' || needs.release-please.result == 'success') }}
runs-on: ubuntu-latest
timeout-minutes: 5
outputs:
should-publish: ${{ steps.resolve.outputs.should-publish }}
tag-name: ${{ steps.resolve.outputs.tag-name }}
steps:
- name: Resolve release tag
id: resolve
shell: bash
env:
PUBLISH_EXISTING_TAG: ${{ inputs.publish-existing-tag }}
RELEASE_CREATED: ${{ needs.release-please.outputs.release-created }}
RELEASE_TAG: ${{ needs.release-please.outputs.tag-name }}
run: |
if [[ -n "${PUBLISH_EXISTING_TAG}" ]]; then
{
echo "should-publish=true"
echo "tag-name=${PUBLISH_EXISTING_TAG}"
} >> "$GITHUB_OUTPUT"
elif [[ "${RELEASE_CREATED}" == "true" ]]; then
{
echo "should-publish=true"
echo "tag-name=${RELEASE_TAG}"
} >> "$GITHUB_OUTPUT"
else
{
echo "should-publish=false"
echo "tag-name="
} >> "$GITHUB_OUTPUT"
fi
production-gate:
name: production release gate
needs: release-target
if: needs.release-target.outputs.should-publish == 'true'
runs-on: ubuntu-latest
timeout-minutes: 10
environment:
name: cargo
permissions:
contents: read
env:
RELEASE_TAG: ${{ needs.release-target.outputs.tag-name }}
steps:
- name: Check out release tag
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 with:
ref: ${{ env.RELEASE_TAG }}
fetch-depth: 0
- name: Run production release gate
shell: bash
env:
CODEBASE_GRAPH_CONFIRM_RELEASE_ENVIRONMENT: ${{ vars.CODEBASE_GRAPH_CONFIRM_RELEASE_ENVIRONMENT }}
CODEBASE_GRAPH_CONFIRM_HOSTED_CI_GREEN: ${{ vars.CODEBASE_GRAPH_CONFIRM_HOSTED_CI_GREEN }}
CODEBASE_GRAPH_CONFIRM_PRIVATE_VULNERABILITY_REPORTING: ${{ vars.CODEBASE_GRAPH_CONFIRM_PRIVATE_VULNERABILITY_REPORTING }}
CODEBASE_GRAPH_REQUIRE_CONDA: ${{ vars.CODEBASE_GRAPH_REQUIRE_CONDA }}
run: |
args=(release-gate --production)
if [[ "${CODEBASE_GRAPH_CONFIRM_RELEASE_ENVIRONMENT}" == "true" ]]; then
args+=(--confirm release-environment)
fi
if [[ "${CODEBASE_GRAPH_CONFIRM_HOSTED_CI_GREEN}" == "true" ]]; then
args+=(--confirm hosted-ci-green)
fi
if [[ "${CODEBASE_GRAPH_CONFIRM_PRIVATE_VULNERABILITY_REPORTING}" == "true" ]]; then
args+=(--confirm private-vulnerability-reporting)
fi
if [[ "${CODEBASE_GRAPH_REQUIRE_CONDA}" == "true" ]]; then
args+=(--require-conda)
fi
cargo run -p xtask -- "${args[@]}"
build:
name: build native release artifacts (${{ matrix.os }})
needs:
- release-target
- production-gate
if: needs.release-target.outputs.should-publish == 'true'
runs-on: ${{ matrix.os }}
timeout-minutes: 30
permissions:
contents: write
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
binary: codebase-graph
artifact-suffix: linux-x86_64
prebuilt_lbug: false
lbug_archive: ""
rustflags: ""
cargo_features: ""
- os: macos-latest
binary: codebase-graph
artifact-suffix: macos-arm64
prebuilt_lbug: true
lbug_archive: liblbug-static-osx-arm64.tar.gz
rustflags: ""
cargo_features: ""
- os: macos-15-intel
binary: codebase-graph
artifact-suffix: macos-x86_64
prebuilt_lbug: true
lbug_archive: liblbug-static-osx-x86_64.tar.gz
rustflags: ""
cargo_features: ""
- os: windows-2022
binary: codebase-graph.exe
artifact-suffix: windows-x86_64
prebuilt_lbug: false
lbug_archive: ""
rustflags: ""
cargo_features: "--features bundled-windows-extensions"
env:
RELEASE_TAG: ${{ needs.release-target.outputs.tag-name }}
steps:
- name: Check out release tag
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 with:
ref: ${{ env.RELEASE_TAG }}
fetch-depth: 0
- name: Verify package version matches tag
shell: bash
run: cargo run -p xtask -- verify-release-version "$RELEASE_TAG"
- name: Prepare prebuilt liblbug
if: ${{ matrix.prebuilt_lbug }}
shell: bash
run: |
set -eu
lib_dir="$PWD/.cache/lbug-prebuilt"
archive="${{ matrix.lbug_archive }}"
lbug_version="$(awk '/^name = "lbug"/ { found=1 } found && /^version = / { gsub(/"/, "", $3); print $3; exit }' Cargo.lock)"
mkdir -p "$lib_dir"
curl --retry 5 --retry-all-errors --connect-timeout 20 -fSL \
"https://github.com/LadybugDB/ladybug/releases/download/v${lbug_version}/${archive}" \
-o "$RUNNER_TEMP/$archive"
tar xzf "$RUNNER_TEMP/$archive" -C "$lib_dir"
test -f "$lib_dir/liblbug.a"
test -f "$lib_dir/lbug.h"
{
echo "LBUG_LIBRARY_DIR=$lib_dir"
echo "LBUG_INCLUDE_DIR=$lib_dir"
} >> "$GITHUB_ENV"
- name: Build Rust production binary
env:
RUSTFLAGS: ${{ matrix.rustflags }}
CARGO_FEATURES: ${{ matrix.cargo_features }}
shell: bash
run: |
mkdir -p dist/smoke
cargo build --locked --release --bin codebase-graph ${CARGO_FEATURES}
cp "target/release/${{ matrix.binary }}" "dist/smoke/${{ matrix.binary }}"
chmod +x "dist/smoke/${{ matrix.binary }}"
archive="codebase-graph-${RELEASE_TAG#v}-${{ matrix.artifact-suffix }}.tar.gz"
tar -C dist/smoke -czf "dist/${archive}" "${{ matrix.binary }}"
checksum_python="$(command -v python3 || command -v python)"
"$checksum_python" -c 'import hashlib, pathlib, sys; path = pathlib.Path(sys.argv[1]); print(f"{hashlib.sha256(path.read_bytes()).hexdigest()} {path.as_posix()}")' "dist/${archive}" > "dist/${archive}.sha256"
- name: Smoke-test Rust production binary
shell: bash
run: cargo run -p xtask -- smoke-artifact "./dist/smoke/${{ matrix.binary }}"
- name: Upload native artifacts to GitHub release
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "$RELEASE_TAG" dist/codebase-graph-*.tar.gz dist/codebase-graph-*.tar.gz.sha256 --clobber
publish-crate:
name: publish crates.io package
needs:
- release-please
- build
if: needs.release-please.outputs.release-created == 'true'
runs-on: ubuntu-latest
timeout-minutes: 20
environment:
name: cargo
steps:
- name: Check out release tag
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 with:
ref: ${{ needs.release-please.outputs.tag-name }}
fetch-depth: 0
- name: Verify crates.io package
run: cargo publish --dry-run --locked
- name: Publish crates.io package
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: cargo publish --locked