enprot 0.5.51

Engyon Protected Text (EPT) — confidentiality processor and capability ledger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

name: Release

permissions:
  pull-requests: write
  contents: write

on:
  push:
    branches:
      - main

jobs:
  release-plz:
    name: Release-plz
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      # release-plz runs `cargo publish` which compiles enprot. enprot
      # transitively requires botan-sys (pkg-config botan-3) and rnp-rs
      # (<rnp/rnp.h>). ci/install.sh builds both from source so the
      # release job has matching versions regardless of distro lag.
      - name: Install system build deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            cmake libjson-c-dev zlib1g-dev libbz2-dev \
            git make g++ python3 jq unzip
      - name: Install Botan + librnp
        run: |
          ./ci/install.sh
          # ci/install.sh clones botan/ and tmp dirs into the working
          # tree, which `cargo publish` then refuses to package (3k+
          # untracked files). Clean up after the install — the system
          # install is what we need, not the source.
          rm -rf botan/ tmp.*/ 2>/dev/null || true
          git status --porcelain | head -5 || true
        env:
          BOTAN_VERSION: "3.7.0"
          PREFIX: /usr

      - name: Run release-plz
        uses: MarcoIeni/release-plz-action@v0.5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      # release-plz creates its tags with GITHUB_TOKEN, and tag pushes
      # made with that token do NOT trigger workflows (GitHub's
      # recursion guard) — so deploy.yml's `on: push: tags` never
      # fired and releases shipped with zero assets. The documented
      # exception is workflow_dispatch invoked via the API, which
      # works even with GITHUB_TOKEN. Dispatch deploy for every tag
      # this run created; deploy is idempotent per tag (concurrency
      # group keyed on the tag).
      - name: Dispatch deploy for released tags
        if: success()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euxo pipefail
          # Tags created in the last 30 minutes = this run's releases.
          # (points-at-HEAD does not work here: release PRs are
          # rebase-merged, which rewrites SHAs, so the tags release-plz
          # pushed no longer point at main's HEAD.)
          git fetch --tags
          now=$(date +%s)
          for tag in $(git for-each-ref --sort=-creatordate \
            --format='%(refname:short) %(creatordate:unix)' refs/tags \
            | awk -v cutoff=$((now - 1800)) '$2 >= cutoff {print $1}'); do
            case "$tag" in
              enprot-v*|v[0-9]*.[0-9]*.[0-9]*|[0-9]*.[0-9]*.[0-9]*)
                echo "dispatching deploy for $tag"
                gh workflow run deploy.yml -f "tag=$tag"
                ;;
              enprot-ffi-v*)
                # FFI cdylib has no standalone release artifacts.
                echo "skipping $tag (enprot-ffi has no binary to deploy)"
                ;;
            esac
          done