chore: stamp workspace 0.19.1-sudo.14 #16
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: sudo-secretspec downstream release checks | |
| on: | |
| pull_request: | |
| paths: | |
| - "packaging/**" | |
| - "sudo-secretspec/**" | |
| - "sudo-secretspec-cli/**" | |
| - "skills/sudo-secretspec/**" | |
| - "tests/sudo_packaging/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".github/workflows/sudo-release.yml" | |
| - "CHANGELOG.md" | |
| push: | |
| tags: | |
| # Every downstream release tag, not one literal. This was pinned to | |
| # "v0.19.1-djbclark.1" and so fired exactly once, in the entire history | |
| # of the workflow -- .2, .3, sudo.4 and sudo.5 all published with the tag | |
| # leg silently skipped. The djbclark spelling stays because those tags | |
| # exist; it is the old version serial, not the org. | |
| - "v0.19.1-sudo.*" | |
| - "v0.19.1-djbclark.*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| packaging: | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v6.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install focused test dependencies | |
| run: | | |
| python -m pip install pytest ruff | |
| brew install sqlite | |
| # The companion is macOS-only, so this workflow is the only place its | |
| # Rust suite runs: the shared test.yml excludes it to keep the Linux and | |
| # Windows jobs building. Use Homebrew's SQLite rather than rusqlite's | |
| # `bundled` feature, which can hang in libsqlite3-sys build scripts. | |
| - name: Test downstream companion crate | |
| env: | |
| PKG_CONFIG_PATH: /opt/homebrew/opt/sqlite/lib/pkgconfig | |
| LIBRARY_PATH: /opt/homebrew/opt/sqlite/lib | |
| run: cargo test -p sudo-secretspec-cli | |
| - name: Test release helper | |
| run: | | |
| python -m ruff check packaging tests/sudo_packaging | |
| python -m ruff format --check packaging tests/sudo_packaging | |
| python -m pytest tests/sudo_packaging -q | |
| - name: Check formula style and syntax | |
| run: | | |
| ruby -c packaging/homebrew/sudo-secretspec.rb | |
| brew style packaging/homebrew/sudo-secretspec.rb | |
| # A tag must name the version the workspace is actually stamped with. | |
| # This is the same invariant `packaging/release.py` enforces in preflight; | |
| # asserting it here catches a tag pushed by hand, which is exactly how | |
| # v0.19.1-sudo.4 shipped uninstallable. | |
| - name: Verify tag matches the stamped workspace version | |
| if: github.ref_type == 'tag' | |
| run: | | |
| version="$(sed -n '/^\[workspace\.package\]/,/^\[/ s/^version = "\(.*\)"/\1/p' Cargo.toml)" | |
| test -n "$version" || { echo "could not read workspace version"; exit 1; } | |
| echo "tag=$GITHUB_REF_NAME workspace=$version" | |
| test "$GITHUB_REF_NAME" = "v$version" |