kugiri 0.2.0

Marker-based block editing CLI
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

name: Release

on:
  push:
    branches:
      - main  # Only run on main branch pushes (PR merges)
  pull_request:
    types: [ opened, synchronize, reopened, labeled, unlabeled ]

permissions: {}

jobs:
  release-pr:
    permissions:
      contents: write
      pull-requests: write
      issues: write
      statuses: write
    runs-on: ubuntu-latest
    outputs:
      release_pr: ${{ toJSON(steps.release-pr.outputs) }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@v5
      - uses: actionutils/trusted-tag-verifier@68bef2f18f8ceb5c4dccc5542cadcfbc82ed4656 # v0.5.0
        with:
          verify: 'actionutils/create-release-pr'
      - uses: actionutils/create-release-pr@v0
        id: release-pr

  update-release-pr:
    needs: [release-pr]
    if: fromJSON(needs.release-pr.outputs.release_pr).state == 'release_pr_open'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write # Required for OIDC token exchange
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - uses: actions/checkout@v5
        with:
          ref: ${{ fromJSON(needs.release-pr.outputs.release_pr).pr_branch }}
      - uses: actions/dependency-review-action@v4
        id: dependency-review
        with:
          base-ref: ${{ fromJSON(needs.release-pr.outputs.release_pr).current_tag }}
          head-ref: main
      - uses: chainguard-dev/actions/setup-gitsign@0cda751b114eb55c388e88f7479292668165602a # v1.0.2

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install cargo-edit
        if: fromJSON(needs.release-pr.outputs.release_pr).next_tag != ''
        uses: taiki-e/cache-cargo-install-action@b33c63d3b3c85540f4eba8a4f71a5cc0ce030855 # v2.3.0
        with:
          tool: cargo-edit
      - name: Bump version in Cargo.{toml,lock}
        if: fromJSON(needs.release-pr.outputs.release_pr).next_tag != ''
        run: |
          VERSION=${{ fromJSON(needs.release-pr.outputs.release_pr).next_tag }}
          # Remove 'v' prefix if present for cargo set-version
          VERSION=${VERSION#v}
          cargo set-version "$VERSION"
          git add Cargo.{toml,lock}
          if git diff --cached --exit-code; then
            echo "No changes to commit"
          else
            git commit -m 'Bump version to ${{ fromJSON(needs.release-pr.outputs.release_pr).next_tag }}'
            git push
          fi

      - uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f # v2.0.5
      - uses: sigstore/cosign-installer@v3.9.2 # installs cosign
      - uses: anchore/sbom-action/download-syft@v0.20.5 # installs syft
      # Pre-install cargo-zigbuild before exposing MinGW to avoid Linux linker hijack
      - name: Preinstall cargo-zigbuild
        uses: taiki-e/cache-cargo-install-action@b33c63d3b3c85540f4eba8a4f71a5cc0ce030855 # v2.3.0
        with:
          tool: cargo-zigbuild
          locked: true
      # Provide dlltool for windows-gnu without hijacking cc/c++
      - name: Install mingw binutils (dlltool)
        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
        with:
          packages: binutils-mingw-w64
          version: 1.0
      - uses: goreleaser/goreleaser-action@v6
        id: goreleaser
        with:
          version: '~> v2'
          args: release --clean --draft --snapshot --skip publish
      - uses: actions/upload-artifact@v4
        with:
          name: snapshot
          path: ./dist

  verify-releaser:
    needs: [release-pr]
    if: fromJSON(needs.release-pr.outputs.release_pr).state == 'release_required'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit
      - name: Verify Trusted Tag Releaser
        uses: actionutils/trusted-tag-verifier@68bef2f18f8ceb5c4dccc5542cadcfbc82ed4656 # v0.5.0
        with:
          verify: 'actionutils/trusted-go-releaser@v1'

  release:
    needs: [verify-releaser, release-pr]
    if: fromJSON(needs.release-pr.outputs.release_pr).state == 'release_required'
    concurrency:
      group: "release"
      cancel-in-progress: false
    permissions:
      id-token: write    # Required for signed tags
      contents: write    # Required for release and tag creation
      pull-requests: write # Required for bumpr commenting
      attestations: write # Required for build provenance attestation
      actions: read      # Required for SLSA generator
    uses: actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@v1
    with:
      environment: release
      setup-zig: true
      install-mingw-dlltool: true
    secrets:
      github-token: ${{ secrets.GITHUB_TOKEN }}

  publish:
    needs: [release-pr, release]
    if: fromJSON(needs.release-pr.outputs.release_pr).state == 'release_required'
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Required for OIDC token exchange
    steps:
    - uses: actions/checkout@v5
    - uses: rust-lang/crates-io-auth-action@v1
      id: auth
    - run: cargo publish
      env:
        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}