1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Release
on:
push:
tags:
workflow_dispatch:
permissions:
contents: write
env:
CARGO_TERM_COLOR: always
# Cargo binary name derived from the GitHub repo so this template
# works unchanged for any CLI using these templates without per-PJ patching.
# If your `[[bin]] name` in Cargo.toml differs from the repo name,
# override this on the spot.
BIN_NAME: ${{ github.event.repository.name }}
jobs:
build:
name: build ${{ matrix.target }}
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- target: x86_64-unknown-linux-musl
os: ubuntu-latest
- target: x86_64-pc-windows-msvc
os: windows-latest
# Intel Mac (x86_64-apple-darwin) dropped — Apple Silicon only.
- target: aarch64-apple-darwin
os: macos-latest
steps:
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- uses: Swatinem/rust-cache@v2
- name: install musl toolchain
if: matrix.target == 'x86_64-unknown-linux-musl'
run: sudo apt-get install -y musl-tools
- run: cargo build --release --target ${{ matrix.target }}
# Run the `smoke` example on the same runner that produced the
# binary. The example's default body is a no-op (see
# `examples/smoke.rs` in the consumer crate); each crate is
# expected to override it with a real-world startup check
# (HTTPS handshake, I/O probe, etc.) so this step blocks a
# release before bad binaries reach users — `cargo test` runs
# only library code and missed shoka v0.10.0's rustls panic.
- name: smoke
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: cargo run --release --target ${{ matrix.target }} --example smoke
- name: package (unix)
if: runner.os != 'Windows'
run: |
mkdir -p dist
pkg=target/${{ matrix.target }}/release
tar czf "dist/${BIN_NAME}-${{ matrix.target }}.tar.gz" -C "$pkg" "${BIN_NAME}"
- name: package (windows)
if: runner.os == 'Windows'
shell: pwsh
run: |
New-Item -ItemType Directory -Force dist
$pkg = "target/${{ matrix.target }}/release"
Compress-Archive -Path "$pkg/$env:BIN_NAME.exe" `
-DestinationPath "dist/$env:BIN_NAME-${{ matrix.target }}.zip"
- uses: actions/upload-artifact@v7
with:
name: ${{ env.BIN_NAME }}-${{ matrix.target }}
path: dist/*
release:
name: github release
needs: build
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/')
steps:
- uses: actions/download-artifact@v8
with:
path: dist
merge-multiple: true
- uses: softprops/action-gh-release@v3
with:
files: dist/*
generate_release_notes: true
publish:
name: publish to crates.io
needs: build
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/')
steps:
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
# --locked keeps the committed Cargo.lock so the publish
# verification step cannot fail the dirty-git-state check by
# rewriting the lock.
- run: cargo publish --locked --token ${{ secrets.CARGO_REGISTRY_TOKEN }}