offsetscan 0.2.2

Standalone native corpus-scale engine for PE parsing, entropy, string extraction, and IOC panels — schema-compatible with OffsetInspect.Result/ThreatScanResult JSON output.
name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write # create the release and upload assets

jobs:
  build:
    name: build ${{ matrix.asset }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            bin: offsetscan
            asset: offsetscan-linux-x86_64
          - os: windows-latest
            bin: offsetscan.exe
            asset: offsetscan-windows-x86_64.exe
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - run: cargo build --release --locked
      - name: Stage binary
        shell: bash
        run: |
          mkdir -p dist
          cp "target/release/${{ matrix.bin }}" "dist/${{ matrix.asset }}"
      - name: Attach to GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          files: dist/${{ matrix.asset }}
          generate_release_notes: true

  publish-crate:
    name: publish to crates.io
    # Gated on the binaries building on both platforms, so a broken build can never
    # publish an unusable crate version (crates.io versions are immutable).
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Verify the tag matches Cargo.toml version
        shell: bash
        run: |
          tag="${GITHUB_REF_NAME#v}"
          crate="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
          echo "tag=$tag crate=$crate"
          if [ "$tag" != "$crate" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match Cargo.toml version $crate; refusing to publish."
            exit 1
          fi
      - name: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish --locked