1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: Release
# Cutting a release is a tag push. Promote dev -> qa -> main, and once main is
# green tag the commit (e.g. `git tag v0.13.0 && git push origin v0.13.0`).
# This workflow then verifies, publishes to crates.io, and creates the GitHub
# release. Requires the `CARGO_REGISTRY_TOKEN` repository secret.
on:
push:
tags:
- "v*"
permissions:
contents: write
jobs:
verify:
name: verify before publish
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
components: clippy, rustfmt
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Install dependencies
run: sudo apt-get install -y openssl libkrb5-dev
- name: Check tag matches Cargo.toml version
shell: bash
run: |
tag="${GITHUB_REF_NAME#v}"
crate="$(cargo metadata --no-deps --format-version 1 | python3 -c 'import json,sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"]=="tiberius-ng"))')"
echo "tag=$tag crate=$crate"
if [ "$tag" != "$crate" ]; then
echo "::error::Tag v$tag does not match Cargo.toml version $crate" >&2
exit 1
fi
- name: Rustfmt
run: cargo fmt --check
- name: Clippy
run: cargo clippy --features=all -- -D warnings
- name: Unit tests
run: cargo test --lib --features all
- name: Package (dry-run)
# `--workspace` publishes members in dependency order and, during the
# dry run, verifies `tiberius-ng` against a temp registry copy of the
# not-yet-published `tiberius-ng-macros`. Running the two crates as
# separate `-p ... --dry-run` invocations would fail here on the first
# release (macros not on crates.io yet). `runtimes-macro` is skipped
# automatically (publish = false).
run: cargo publish --workspace --dry-run
publish:
name: publish to crates.io
needs: verify
runs-on: ubuntu-latest
environment: release
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Install dependencies
run: sudo apt-get install -y openssl libkrb5-dev
- name: Publish (macro crate first, then the library)
# Publish each publishable member in dependency order (tiberius-ng-macros
# before tiberius-ng). We do NOT use `cargo publish --workspace` here:
# it aborts the whole run if ANY member version already exists on the
# index — which happens on a patch release where `tiberius-ng-macros` is
# unchanged and already published, leaving the library unpublished.
# Publishing per-crate and treating "already exists" as a skip lets the
# library go out while an unchanged macro crate is left alone. cargo
# waits for the index between crates automatically. `runtimes-macro` is
# skipped (publish = false).
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: |
set -uo pipefail
for crate in tiberius-ng-macros tiberius-ng; do
echo "::group::publish $crate"
if out=$(cargo publish -p "$crate" 2>&1); then
echo "$out"
echo "published $crate"
else
echo "$out"
if echo "$out" | grep -q "already exists on crates.io"; then
echo "$crate is already published at this version — skipping"
else
echo "::endgroup::"
exit 1
fi
fi
echo "::endgroup::"
done
- name: Create GitHub release
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.4.0
with:
generate_release_notes: true