1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
name: Prebuilt libs
on:
push:
paths:
- "xgboost-sys/build.rs"
- "xgboost-sys/lib/**"
- "scripts/upload-release-libs.sh"
- ".github/workflows/prebuilt-libs.yml"
pull_request:
paths:
- "xgboost-sys/build.rs"
- "xgboost-sys/lib/**"
- "scripts/upload-release-libs.sh"
release:
types:
workflow_dispatch:
inputs:
tag:
description: "Release tag to upload to. Defaults to LIB_TAG in build.rs."
required: false
type: string
jobs:
# Catches drift between the checksums pinned in build.rs and the files committed under
# xgboost-sys/lib, which would otherwise only surface as a failed build on a user's machine.
verify:
name: verify pins
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check committed libraries against build.rs
run: ./scripts/upload-release-libs.sh --dry-run
# Assets are published against LIB_TAG, not against the release that triggered this run: the
# checksums in build.rs pin that tag's bytes, so that is the release the build script downloads
# from. Re-running is harmless, uploads use --clobber.
upload:
name: upload assets
needs: verify
if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- name: Upload and verify release assets
env:
GH_TOKEN: ${{ github.token }}
# Via the environment, not an inline expansion: the value is attacker-controlled on a
# workflow_dispatch. Empty on a release event, which lets the script fall back to LIB_TAG.
TAG: ${{ inputs.tag }}
run: ./scripts/upload-release-libs.sh "$TAG"