name: publish
on:
push:
tags:
- v[0-9]+.[0-9]+.[0-9]+
- v[0-9]+.[0-9]+.[0-9]+-[0-9]+
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
validate:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/create-github-app-token@v2
id: app
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}
- name: app user id
run: echo "user-id=$(gh api "/users/${{ steps.app.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
id: user-id
env:
GH_TOKEN: ${{ steps.app.outputs.token }}
- name: creds
run: |
git config --global url.'https://x-access-token:${{ steps.app.outputs.token }}@github.com/'.insteadOf https://github.com/
git config --global user.name '${{ steps.app.outputs.app-slug }}[bot]'
git config --global user.email '${{ steps.user-id.outputs.user-id }}+${{ steps.app.outputs.app-slug }}[bot]@users.noreply.github.com'
- uses: actions/checkout@v6
with:
token: ${{ steps.app.outputs.token }}
ref: ${{ github.event.repository.default_branch }}
persist-credentials: false
- uses: DeterminateSystems/determinate-nix-action@main
- uses: DeterminateSystems/flakehub-cache-action@main
- name: build
run: nix build
- name: bump
run: nix develop -c 'bash' -c "cargo set-version '${GITHUB_REF_NAME#v}'"
- name: push
run: |
git add Cargo.{toml,lock}
git commit -m $'chore: bump version to ${{ github.ref_name }}\n[skip ci]'
git push
crates:
needs: validate
runs-on: ubuntu-latest
environment: publish
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v6
with:
ref: ${{ github.event.repository.default_branch }}
- id: auth
uses: rust-lang/crates-io-auth-action@v1
- uses: DeterminateSystems/determinate-nix-action@main
- uses: DeterminateSystems/flakehub-cache-action@main
- run: nix develop -c 'bash' -c 'cargo publish'
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
fh:
needs: validate
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v6
- uses: DeterminateSystems/determinate-nix-action@main
- uses: DeterminateSystems/flakehub-push@main
with:
visibility: public
name: molarmanful/euphrates
tag: ${{ github.ref_name }}
include-output-paths: true