portail 0.1.0

Unified proxy/gateway: AI Gateway + MCP Gateway + CDN cache
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

name: Release

on:
  push:
    tags: ["v*"]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings
  CARGO_INCREMENTAL: 0
  SCCACHE_GHA_ENABLED: "true"

jobs:
  release:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            upx_args: --best --lzma
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            upx_args: --best --lzma
          - os: macos-latest
            target: aarch64-apple-darwin
            upx_args: --best
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          target: ${{ matrix.target }}

      - uses: mozilla-actions/sccache-action@v0.0.7

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }} --bin portail

      - name: Install UPX
        uses: crazy-max/ghaction-upx@v3
        with:
          install-only: true

      - name: Compress with UPX
        run: |
          binary="target/${{ matrix.target }}/release/portail"
          upx ${{ matrix.upx_args }} "$binary"
          mv "$binary" "portail-${{ matrix.target }}"

      - name: Generate checksums
        run: |
          sha256sum portail-${{ matrix.target }} > portail-${{ matrix.target }}.sha256
          cat portail-${{ matrix.target }}.sha256

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign binary with cosign (keyless)
        run: |
          cosign sign-blob --yes \
            --output-signature portail-${{ matrix.target }}.sig \
            --output-certificate portail-${{ matrix.target }}.pem \
            portail-${{ matrix.target }}

      - name: Sign checksum with cosign (keyless)
        run: |
          cosign sign-blob --yes \
            --output-signature portail-${{ matrix.target }}.sha256.sig \
            --output-certificate portail-${{ matrix.target }}.sha256.pem \
            portail-${{ matrix.target }}.sha256

      - uses: actions/upload-artifact@v4
        with:
          name: portail-${{ matrix.target }}
          path: |
            portail-${{ matrix.target }}
            portail-${{ matrix.target }}.sha256
            portail-${{ matrix.target }}.sig
            portail-${{ matrix.target }}.pem
            portail-${{ matrix.target }}.sha256.sig
            portail-${{ matrix.target }}.sha256.pem

  github-release:
    needs: [release]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: portail-*
          merge-multiple: true

      - name: Verify cosign signatures
        uses: sigstore/cosign-installer@v3
      - run: |
          for f in portail-*.sig; do
            stem="${f%.sig}"
            cosign verify-blob --cert "$stem.pem" --signature "$f" "$stem"
          done

      - name: Generate combined SHA256SUMS
        run: cat portail-*.sha256 | tee SHA256SUMS

      - name: Sign combined checksums
        run: |
          cosign sign-blob --yes \
            --output-signature SHA256SUMS.sig \
            --output-certificate SHA256SUMS.pem \
            SHA256SUMS

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: Portail ${{ github.ref_name }}
          body_path: CHANGELOG.md
          files: |
            portail-*
            SHA256SUMS
            SHA256SUMS.sig
            SHA256SUMS.pem
          generate_release_notes: true

  crates-io:
    needs: [github-release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions-rust-lang/setup-rust-toolchain@v1
      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}