initial commit #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Run tests | |
| run: bun test | |
| build: | |
| needs: test | |
| strategy: | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| target: linux-x64 | |
| artifact: certman-linux-x64 | |
| - os: ubuntu-latest | |
| target: linux-arm64 | |
| artifact: certman-linux-arm64 | |
| - os: macos-latest | |
| target: darwin-x64 | |
| artifact: certman-darwin-x64 | |
| - os: macos-latest | |
| target: darwin-arm64 | |
| artifact: certman-darwin-arm64 | |
| - os: windows-latest | |
| target: windows-x64 | |
| artifact: certman-windows-x64.exe | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build TypeScript | |
| run: bun run build | |
| - name: Build binary | |
| run: bun build dist/index.js --compile --target=bun-${{ matrix.target }} --outfile=${{ matrix.artifact }} | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.artifact }} | |
| path: ${{ matrix.artifact }} | |
| retention-days: 7 | |
| build-deb: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| arch: [amd64, arm64] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Download linux binary | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: certman-linux-${{ matrix.arch == 'amd64' && 'x64' || 'arm64' }} | |
| path: bin/ | |
| - name: Build Debian package | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| ./scripts/build-deb.sh "$VERSION" "${{ matrix.arch }}" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: certman-${{ matrix.arch }}.deb | |
| path: deb/*.deb | |
| retention-days: 7 | |
| release: | |
| needs: [build, build-deb] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build | |
| run: bun run build | |
| - name: Publish to npm | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| path: artifacts/ | |
| - name: Create release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| artifacts/**/* | |
| generate_release_notes: true | |
| update-homebrew: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| path: artifacts/ | |
| - name: Generate Homebrew formula | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| VERSION="$VERSION" ARTIFACTS_DIR="artifacts" bun run scripts/update-homebrew.ts | |
| - name: Push to homebrew-tap | |
| env: | |
| SSH_PRIVATE_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key | |
| chmod 600 ~/.ssh/deploy_key | |
| ssh-keyscan github.com >> ~/.ssh/known_hosts | |
| git clone git@github.com:certman/homebrew-tap.git tap --config core.sshCommand="ssh -i ~/.ssh/deploy_key" | |
| cp certman.rb tap/certman.rb | |
| cd tap | |
| git config user.name "certman-release-bot" | |
| git config user.email "certman-release-bot@certman.app" | |
| git config core.sshCommand "ssh -i ~/.ssh/deploy_key" | |
| git add certman.rb | |
| git diff --staged --quiet || git commit -m "certman ${GITHUB_REF_NAME#v}" | |
| git push |