1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
name: Release
on:
push:
tags:
- "v*.*.*"
permissions:
contents: write # required to create GitHub Releases and upload assets
jobs:
# ── Prebuilt binaries for every supported platform ──────────────────────────
# Attaches `tessera-<target>.tar.gz` (or `.zip` on Windows) to the GitHub
# Release for the tag. These archives back the curl|sh installer, the Homebrew
# formula, and the npm wrapper. aarch64-linux cross-compiles via `cross`,
# which the action installs automatically.
binaries:
name: binary (${{ matrix.target }})
strategy:
fail-fast: false
matrix:
include:
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
- target: aarch64-unknown-linux-gnu
os: ubuntu-latest
- target: x86_64-apple-darwin
os: macos-13
- target: aarch64-apple-darwin
os: macos-latest
- target: x86_64-pc-windows-msvc
os: windows-latest
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- uses: taiki-e/upload-rust-binary-action@v1
with:
bin: tessera
target: ${{ matrix.target }}
archive: tessera-$target
token: ${{ secrets.GITHUB_TOKEN }}
# ── crates.io ───────────────────────────────────────────────────────────────
# Idempotent: skips cleanly if no token, succeeds if the version already exists.
crates:
name: publish crates.io
runs-on: ubuntu-latest
environment: crates-io
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
- uses: Swatinem/rust-cache@v2
- run: cargo fmt --check
- run: cargo clippy --all-targets --all-features -- -D warnings
- run: cargo test --all-targets --all-features
- name: Publish to crates.io (idempotent)
env:
CRATES_IO_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
run: |
set -uo pipefail
if [ -z "${CRATES_IO_TOKEN:-}" ]; then
echo "::notice::CRATES_IO_TOKEN not configured for this environment; skipping crates.io publish. Publish manually with \`cargo publish\` or set the secret in the 'crates-io' environment."
exit 0
fi
output=$(cargo publish --token "$CRATES_IO_TOKEN" 2>&1)
status=$?
echo "$output"
if [ $status -eq 0 ]; then
exit 0
fi
if echo "$output" | grep -Eq "already (uploaded|exists)|crate version .* is already uploaded"; then
echo "::notice::Version already on crates.io; treating as success."
exit 0
fi
exit $status
# ── npm wrapper ─────────────────────────────────────────────────────────────
# Publishes the thin npm package that downloads the matching prebuilt binary
# on install (so `npm i -g` / `npx` work without a Rust toolchain). Runs after
# the release assets exist; skips cleanly when NPM_TOKEN is unset.
npm:
name: publish npm
needs: binaries
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
registry-url: https://registry.npmjs.org
- name: Publish wrapper
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
set -uo pipefail
if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
echo "::notice::NPM_TOKEN not set; skipping npm publish."
exit 0
fi
VERSION="${GITHUB_REF_NAME#v}"
cd npm
npm version "$VERSION" --no-git-tag-version --allow-same-version
npm publish --access public || {
echo "::warning::npm publish failed (name may be taken or version exists). See npm/README.md.";
exit 0;
}