wlproxy 0.2.1

Filter/modify Wayland messages from clients
Documentation
name: Release

on:
  push: # To create/update release PR and to make a release.
  pull_request: # To update release PR after manually changing version for the next release.
    types: [edited]

permissions:
  contents: write # To create/update release_pr branch, create a release and a tag.
  pull-requests: write # To create/update PR from release_pr branch.
  id-token: write # For cosign signing.

env:
  GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

jobs:
  release-pr:
    uses: powerman/workflows/.github/workflows/release-pr.yml@v0.4.4
    with:
      version_cmd: |
        sed -i "s/^version = \".*\"/version = \"${RELEASE_PR_VERSION#v}\"/" Cargo.toml
        cargo check
    secrets:
      TOKEN: ${{ secrets.RELEASE_TOKEN }}

  build-and-upload:
    needs: [release-pr]
    if: ${{ needs.release-pr.outputs.result == 'released' }}
    permissions:
      contents: write # To upload to GitHub release.
      id-token: write # For cosign signing.
    timeout-minutes: 30
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - aarch64-unknown-linux-gnu
          - x86_64-apple-darwin
          - aarch64-apple-darwin
    steps:
      - uses: actions/checkout@v6
        with:
          token: ${{ env.GITHUB_TOKEN }}
          ref: ${{ needs.release-pr.outputs.version }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-zigbuild

      - uses: mlugg/setup-zig@v2

      - name: Add rust target
        run: rustup target add ${{ matrix.target }}

      - name: Build binary
        id: build
        env:
          TARGET: ${{ matrix.target }}
          BINARY_NAME: ${{ github.event.repository.name }}
        run: |
          cargo zigbuild --release --target "$TARGET"
          EXT=""
          [[ "$TARGET" == *-windows-* ]] && EXT=".exe"
          ASSET_DIR="$(mktemp -d)"
          BIN="target/$TARGET/release/${BINARY_NAME}${EXT}"
          ASSET_NAME="${BINARY_NAME}-${TARGET}${EXT}"
          cp "$BIN" "$ASSET_DIR/$ASSET_NAME"
          echo "release_asset_dir=$ASSET_DIR" >> "$GITHUB_OUTPUT"

      - name: Install UPX
        if: ${{ !contains(matrix.target, 'darwin') }}
        uses: crazy-max/ghaction-upx@v4
        with:
          install-only: true

      - name: Compress binary with UPX
        if: ${{ !contains(matrix.target, 'darwin') }}
        working-directory: ${{ steps.build.outputs.release_asset_dir }}
        run: upx --best ./*

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.2

      - name: Sign assets with cosign
        working-directory: ${{ steps.build.outputs.release_asset_dir }}
        run: |
          for file in *; do
            if [[ -f "$file" && ! "$file" =~ \.(sha256|md5|sig|bundle)$ ]]; then
              echo "Signing $file..."
              cosign sign-blob --yes "$file" --bundle "${file}.bundle"
            fi
          done

      - name: Upload files to the release
        uses: softprops/action-gh-release@v3
        with:
          token: ${{ env.GITHUB_TOKEN }}
          tag_name: ${{ needs.release-pr.outputs.version }}
          body: ${{ needs.release-pr.outputs.changelog }}
          files: ${{ steps.build.outputs.release_asset_dir }}/*
          draft: true
          prerelease: ${{ needs.release-pr.outputs.prerelease }}
          make_latest: false

  # Mark release as non-draft and latest.
  finalize:
    needs: [release-pr, build-and-upload]
    if: ${{ needs.release-pr.outputs.result == 'released' }}
    permissions:
      contents: write # To update the GitHub release.
    timeout-minutes: 5
    runs-on: ubuntu-latest
    steps:
      - name: Publish release
        uses: softprops/action-gh-release@v3
        with:
          token: ${{ env.GITHUB_TOKEN }}
          tag_name: ${{ needs.release-pr.outputs.version }}
          body: ${{ needs.release-pr.outputs.changelog }}
          draft: false
          prerelease: ${{ needs.release-pr.outputs.prerelease }}
          make_latest: ${{ needs.release-pr.outputs.prerelease != 'true' }}

  publish-crates-io:
    needs: [release-pr, build-and-upload, finalize]
    if: ${{ needs.release-pr.outputs.result == 'released' }}
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.release-pr.outputs.version }}
      - name: Publish to crates.io
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish