name: Release
on:
workflow_dispatch:
push:
tags:
- "v*"
permissions: read-all
jobs:
wheels-linux:
runs-on: ubuntu-latest
permissions:
contents: read
strategy:
matrix:
target: [x86_64, aarch64]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 with:
python-version: "3.x"
- name: Build wheels
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad with:
target: ${{ matrix.target }}
manylinux: auto
args: --release --out dist --interpreter 3.10 3.11 3.12 3.13
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with:
name: wheels-linux-${{ matrix.target }}
path: dist
wheels-macos:
runs-on: macos-14
permissions:
contents: read
strategy:
matrix:
target: [x86_64, aarch64]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 with:
python-version: "3.x"
- name: Build wheels
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad with:
target: ${{ matrix.target }}
args: --release --out dist --interpreter 3.10 3.11 3.12 3.13
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with:
name: wheels-macos-${{ matrix.target }}
path: dist
wheels-windows:
runs-on: windows-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 with:
python-version: "3.x"
architecture: x64
- name: Build wheels
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad with:
target: x64
args: --release --out dist --interpreter 3.10 3.11 3.12 3.13
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with:
name: wheels-windows-x64
path: dist
sdist:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Build sdist
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad with:
command: sdist
args: --out dist
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with:
name: sdist
path: dist
cli-binaries:
permissions:
contents: read
strategy:
matrix:
include:
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
name: etoon-linux-x86_64
- target: aarch64-unknown-linux-gnu
os: ubuntu-latest
name: etoon-linux-aarch64
cross: true
- target: x86_64-apple-darwin
os: macos-14
name: etoon-macos-x86_64
- target: aarch64-apple-darwin
os: macos-14
name: etoon-macos-aarch64
- target: x86_64-pc-windows-msvc
os: windows-latest
name: etoon-windows-x86_64.exe
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- name: Install cross (for aarch64 Linux)
if: matrix.cross
run: cargo install cross --locked
- name: Build (native)
if: '!matrix.cross'
run: cargo build --release --bin etoon --no-default-features --target ${{ matrix.target }}
- name: Build (cross)
if: matrix.cross
run: cross build --release --bin etoon --no-default-features --target ${{ matrix.target }}
- name: Rename binary
shell: bash
run: |
if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
cp target/${{ matrix.target }}/release/etoon.exe ${{ matrix.name }}
else
cp target/${{ matrix.target }}/release/etoon ${{ matrix.name }}
fi
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with:
name: cli-${{ matrix.target }}
path: ${{ matrix.name }}
cargo-audit:
if: startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Run cargo audit
run: cargo audit
publish-pypi:
if: startsWith(github.ref, 'refs/tags/v')
needs: [wheels-linux, wheels-macos, wheels-windows, sdist]
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
pattern: "wheels-*"
path: dist
merge-multiple: true
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: sdist
path: dist
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e with:
password: ${{ secrets.PYPI_TOKEN }}
skip-existing: true
publish-crates:
if: startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: dtolnay/rust-toolchain@stable
- name: Publish to crates.io
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: cargo publish --no-default-features --allow-dirty
github-release:
if: startsWith(github.ref, 'refs/tags/v')
needs: [cli-binaries, cargo-audit]
runs-on: ubuntu-latest
permissions:
contents: write
id-token: write
attestations: write
steps:
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
pattern: "cli-*"
path: cli
merge-multiple: true
- name: Generate SHA256 checksums
run: |
cd cli
sha256sum * > ../SHA256SUMS.txt
cat ../SHA256SUMS.txt
- name: SLSA provenance attestation
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 with:
subject-path: cli/*
- name: Upload to VirusTotal
env:
VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
if: env.VT_API_KEY != ''
run: |
echo "## VirusTotal Scan Results" > vt_report.md
echo "" >> vt_report.md
for f in cli/*; do
name=$(basename "$f")
echo "Uploading $name to VirusTotal..."
response=$(curl -s --request POST \
--url https://www.virustotal.com/api/v3/files \
--header "x-apikey: $VT_API_KEY" \
--form "file=@$f")
analysis_id=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['id'])" 2>/dev/null || echo "")
if [ -n "$analysis_id" ]; then
sha256=$(sha256sum "$f" | cut -d' ' -f1)
echo "- [\`$name\`](https://www.virustotal.com/gui/file/$sha256)" >> vt_report.md
else
echo "- \`$name\`: upload failed" >> vt_report.md
fi
done
cat vt_report.md
- name: Collect release assets
run: |
mkdir release
cp cli/* release/
cp SHA256SUMS.txt release/
- name: Create release
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe with:
files: release/*
draft: false
prerelease: false
generate_release_notes: true
append_body: true
body_path: vt_report.md