1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Release
on:
# crates.io trusted publishing rejects OIDC tokens minted under
# `workflow_run`, so publishing runs on the `main` push itself — which
# can only come from a merged pull request (conventionally the dev ->
# main release PR) whose required checks already passed on the same
# tree. `release-pr` still waits for CI via `workflow_run`.
push:
branches:
workflow_run:
workflows:
branches:
types:
permissions:
contents: write
pull-requests: write
id-token: write
actions: write
jobs:
release:
name: Release unpublished packages
runs-on: ubuntu-latest
if: github.event_name == 'push'
steps:
- uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- uses: dtolnay/rust-toolchain@stable
# cargo publish verifies each package by building it; the native
# libraries the crates link (ALSA for waterkit-audio, ...) must be
# present here exactly as in the test workflow, or the verify build fails.
- name: Install Linux dependencies
if: runner.os == 'Linux'
uses: ./.github/actions/setup-linux-deps
# Mint a short-lived crates.io token from the GitHub OIDC identity
# instead of a stored CARGO_REGISTRY_TOKEN (trusted publishing is
# configured per crate on crates.io).
- uses: rust-lang/crates-io-auth-action@v1
id: crates-io-auth
- uses: MarcoIeni/release-plz-action@v0.5
with:
command: release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
release-pr:
name: Prepare the next release
runs-on: ubuntu-latest
if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main'
concurrency:
group: release-plz-${{ github.event.workflow_run.head_branch }}
cancel-in-progress: false
steps:
- uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- uses: dtolnay/rust-toolchain@stable
# cargo publish verifies each package by building it; the native
# libraries the crates link (ALSA for waterkit-audio, ...) must be
# present here exactly as in the test workflow, or the verify build fails.
- name: Install Linux dependencies
if: runner.os == 'Linux'
uses: ./.github/actions/setup-linux-deps
- uses: MarcoIeni/release-plz-action@v0.5
id: release-plz
with:
command: release-pr
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# The workflow token's pull request triggers no workflow, so its
# required gate is dispatched on the release branch here. The action
# reports `pr` as `{}` when there is no release pull request, so
# `prs_created` is what says whether there is one.
- name: Pass the release pull request's gate
if: steps.release-plz.outputs.prs_created == 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
HEAD_BRANCH: ${{ fromJSON(steps.release-plz.outputs.pr).head_branch }}
run: gh workflow run pr-base-gate.yml --repo "${GITHUB_REPOSITORY}" --ref "${HEAD_BRANCH}"