shex 2.0.2

An OPAQUE-authenticated, end-to-end encrypted Redis remote shell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

name: Native release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            deb_arch: amd64
          - runner: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
            deb_arch: arm64
          - runner: macos-15-intel
            target: x86_64-apple-darwin
            deb_arch: ""
          - runner: macos-15
            target: aarch64-apple-darwin
            deb_arch: ""
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Verify release version
        shell: bash
        run: |
          set -euo pipefail
          version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
          test "v$version" = "$GITHUB_REF_NAME"
      - name: Install Rust
        shell: bash
        run: |
          rustup set profile minimal
          rustup toolchain install stable --no-self-update
          rustup default stable
      - name: Build
        run: cargo build --locked --release --target ${{ matrix.target }}
      - name: Package archive
        shell: bash
        run: |
          set -euo pipefail
          version=${GITHUB_REF_NAME#v}
          package="shex-$version-${{ matrix.target }}"
          mkdir -p "dist/$package"
          cp "target/${{ matrix.target }}/release/shex" "dist/$package/shex"
          cp README.md "dist/$package/README.md"
          tar -C dist -czf "dist/$package.tar.gz" "$package"
          rm -rf "dist/$package"
      - name: Package Debian archive
        if: matrix.deb_arch != ''
        shell: bash
        run: |
          chmod +x packaging/build-deb.sh
          packaging/build-deb.sh \
            "target/${{ matrix.target }}/release/shex" \
            "${GITHUB_REF_NAME#v}" \
            "${{ matrix.deb_arch }}" \
            dist
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.target }}
          path: dist/*
          if-no-files-found: error

  release:
    name: Publish GitHub release
    needs: build
    runs-on: ubuntu-22.04
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          merge-multiple: true
      - name: Create checksums
        run: cd dist && sha256sum ./* >SHA256SUMS
      - name: Publish release
        run: >-
          gh release create "$GITHUB_REF_NAME"
          dist/*
          --repo "$GITHUB_REPOSITORY"
          --title "shex $GITHUB_REF_NAME"
          --generate-notes
          --verify-tag

  apt:
    name: Publish signed APT repository
    needs: build
    runs-on: ubuntu-22.04
    env:
      GH_TOKEN: ${{ github.token }}
      APT_GPG_PRIVATE_KEY: ${{ secrets.APT_GPG_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          merge-multiple: true
      - name: Install repository tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes apt-utils gnupg
      - name: Import signing key
        shell: bash
        run: |
          set -euo pipefail
          test -n "$APT_GPG_PRIVATE_KEY"
          printf '%s' "$APT_GPG_PRIVATE_KEY" | gpg --batch --import
      - name: Check out pages branch
        shell: bash
        run: |
          set -euo pipefail
          remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          if git ls-remote --exit-code --heads "$remote" gh-pages; then
            git clone --depth 1 --branch gh-pages "$remote" pages
          else
            git init pages
            git -C pages checkout --orphan gh-pages
            git -C pages remote add origin "$remote"
          fi
      - name: Build signed repository
        run: |
          chmod +x packaging/publish-apt.sh
          packaging/publish-apt.sh dist pages
      - name: Publish pages branch
        shell: bash
        run: |
          set -euo pipefail
          git -C pages config user.name github-actions[bot]
          git -C pages config user.email 41898282+github-actions[bot]@users.noreply.github.com
          git -C pages add --all
          if git -C pages diff --cached --quiet; then
            exit 0
          fi
          git -C pages commit -m "Publish APT packages for $GITHUB_REF_NAME"
          git -C pages push origin gh-pages