communique 1.3.4

Editorialized release notes powered by AI
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210

name: Release

permissions:
  contents: write

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
    secrets:
      CERTIFICATES_P12:
        required: true
      CERTIFICATES_P12_PASS:
        required: true
      APPLE_API_KEY_P8:
        required: true
      APPLE_API_KEY_ID:
        required: true
      APPLE_API_ISSUER_ID:
        required: true

env:
  CARGO_TERM_COLOR: always

jobs:
  upload-assets:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
          - target: aarch64-pc-windows-msvc
            os: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: refs/tags/${{ inputs.tag }}
          persist-credentials: false
      - name: Import codesign certs
        if: startsWith(matrix.os, 'macos')
        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
        with:
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
          p12-password: ${{ secrets.CERTIFICATES_P12_PASS }}
      - name: Install cross-compilation tools
        uses: taiki-e/setup-cross-toolchain-action@12b7ad4acfa95a1476779d6c06699b96ec1691f8 # v1
        with:
          target: ${{ matrix.target }}
      - name: Upload binary (macOS signed)
        if: startsWith(matrix.os, 'macos')
        uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: communique
          target: ${{ matrix.target }}
          ref: refs/tags/${{ inputs.tag }}
          token: ${{ secrets.GITHUB_TOKEN }}
          codesign: "Developer ID Application: Jeffrey Dickey (4993Y37DX6)"
          codesign_prefix: dev.jdx.
          # Apple will not notarize a binary without the hardened runtime.
          codesign_options: runtime
      # Signing settles who built the binary; notarization is what Gatekeeper
      # demands once an archive carries the quarantine bit, which is to say
      # whenever someone downloads it in a browser rather than with curl.
      # Without a ticket it is blocked behind a "cannot be verified" dialog that
      # only a deliberate override gets past.
      #
      # The ticket lives on Apple's side and is keyed to the binary's cdhash, so
      # nothing here rewrites what was already built or uploaded -- stapling
      # would, but `stapler` only writes into bundles, disk images, and
      # installer packages, and this is a bare Mach-O in an archive. Gatekeeper
      # resolves the ticket online instead.
      - name: Notarize macOS binary
        if: startsWith(matrix.os, 'macos')
        shell: bash
        env:
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
          BINARIES: target/${{ matrix.target }}/release/communique
        run: |
          set -euo pipefail

          if [ -z "$APPLE_API_KEY_P8" ] || [ -z "$APPLE_API_KEY_ID" ] || [ -z "$APPLE_API_ISSUER_ID" ]; then
            echo "::error title=Notarization credentials missing::App Store Connect credentials are required for macOS releases."
            exit 1
          fi

          # Outside the workspace, so no later step can sweep the key into an
          # artifact, and removed even when notarization fails.
          work="$(mktemp -d)"
          trap 'rm -rf "$work"' EXIT
          printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$work/key.p8"

          # notarytool takes a container, never a bare executable. Copies are
          # fine: a Mach-O carries its signature inline, so the cdhash the
          # ticket is keyed to is the one already shipped.
          mkdir "$work/stage"
          for binary in $BINARIES; do
            cp "$binary" "$work/stage/"
          done
          # Apple rejects a binary without the hardened runtime or a secure
          # timestamp. Naming a missing one here turns an opaque Invalid verdict
          # into a diagnosis; Apple stays the authority on whether to accept.
          for binary in $BINARIES; do
            details="$(codesign --display --verbose=4 "$binary" 2>&1 || true)"
            case "$details" in
              *runtime*) ;;
              *) echo "::warning title=No hardened runtime::$binary is signed without --options runtime, which Apple requires; expect an Invalid verdict below." ;;
            esac
            case "$details" in
              *Timestamp=*) ;;
              *) echo "::warning title=No secure timestamp::$binary carries no secure timestamp, which Apple requires; expect an Invalid verdict below." ;;
            esac
          done

          ditto -c -k --norsrc --noextattr "$work/stage" "$work/submission.zip"

          # `--wait` is not a gate on its own: it can return zero on an Invalid
          # submission, so the reported status is what decides. plutil reads
          # JSON and ships with macOS, which keeps this off jq.
          result="$(xcrun notarytool submit "$work/submission.zip" \
            --key "$work/key.p8" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --output-format json \
            --timeout 30m \
            --wait)"
          echo "$result"

          status="$(printf '%s' "$result" | plutil -extract status raw -o - -)"
          id="$(printf '%s' "$result" | plutil -extract id raw -o - -)"
          if [ "$status" != "Accepted" ]; then
            echo "::error::notarization returned $status for submission $id"
            xcrun notarytool log "$id" \
              --key "$work/key.p8" \
              --key-id "$APPLE_API_KEY_ID" \
              --issuer "$APPLE_API_ISSUER_ID" || true
            exit 1
          fi
          echo "notarized: submission $id"
      - name: Upload binary (non-macOS)
        if: ${{ !startsWith(matrix.os, 'macos') }}
        uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: communique
          target: ${{ matrix.target }}
          ref: refs/tags/${{ inputs.tag }}
          token: ${{ secrets.GITHUB_TOKEN }}

  # The packslip is this release's signed inventory: every archive's digest,
  # the executable inside it, the shared objects it needs from the host, and
  # the workflow identity that signed for all of it. An installer checks a
  # download against jdx/communique's identity rather than against a key this
  # project would have to hold. See https://packslip.dev.
  #
  # Its own job because the matrix above uploads straight to the release from
  # seven runners; one document covering the whole release can only be written
  # once every one of them has landed.
  packslip:
    name: Publish the packslip
    needs: upload-assets
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Download the release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ inputs.tag }}
          REPO: ${{ github.repository }}
        run: |
          mkdir -p dist
          gh release download "$TAG" --repo "$REPO" --dir dist --clobber \
            --pattern 'communique-*.tar.gz' --pattern 'communique-*.zip'
          ls -la dist
      # A consumer that has this file can generate completions, a man page,
      # and documentation with its own copy of usage, so nothing of
      # Communiqué's runs on the machine it is installed on.
      - name: Publish the CLI specification
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ inputs.tag }}
          REPO: ${{ github.repository }}
        run: |
          mkdir -p bin
          tar -xzf dist/communique-x86_64-unknown-linux-gnu.tar.gz -C bin
          bin/communique usage > communique.usage.kdl
          gh release upload "$TAG" communique.usage.kdl --repo "$REPO" --clobber
      - uses: jdx/packslip@433c0c0f033e64c22f12433471768c255ef2bd93 # v0.3.0
        with:
          tag: ${{ inputs.tag }}
          artifacts: dist/communique-*.tar.gz dist/communique-*.zip
          bin: communique
          resources: cli-spec/usage=asset:communique.usage.kdl