errand-bot 0.2.0

Run a coding agent from a chat channel, in a sandbox it cannot escape.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

name: artifacts

on:
  release:
    types: [published]
  # So a build problem is found before a release depends on it.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Built on the architecture they run on, so the C sources rusqlite
          # bundles need no cross toolchain.
          - target: x86_64-unknown-linux-musl
            runner: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install musl
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y musl-tools

      - name: Install the Rust toolchain
        run: |
          rustup show active-toolchain || rustup toolchain install
          rustup target add ${{ matrix.target }}

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      # Before the daemon: the binary carries the interface, and one built
      # without it refuses to serve.
      - name: Build the interface
        run: cd web && bun install && bun run build

      - name: Build
        env:
          CC: musl-gcc
        run: cargo build --release --target ${{ matrix.target }}

      - name: Check it is static and runs
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          file target/${{ matrix.target }}/release/errand | grep -q 'statically linked\|static-pie'
          ./target/${{ matrix.target }}/release/errand help

      - name: Compress
        id: archive
        run: |
          name="errand-${GITHUB_REF_NAME#v}-${{ matrix.target }}"
          mkdir -p "dist/$name"
          cp target/${{ matrix.target }}/release/errand "dist/$name/"
          cp README.md LICENSE-MIT LICENSE-APACHE config.example.json "dist/$name/"
          tar -C dist -cJf "dist/$name.tar.xz" "$name"
          sha256sum "dist/$name.tar.xz" | sed "s| dist/| |" > "dist/$name.tar.xz.sha256"
          echo "name=$name" >> "$GITHUB_OUTPUT"

      - name: Attach to the release
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$GITHUB_REF_NAME" \
            "dist/${{ steps.archive.outputs.name }}.tar.xz" \
            "dist/${{ steps.archive.outputs.name }}.tar.xz.sha256" \
            --clobber

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.archive.outputs.name }}
          path: dist/*.tar.xz*