ci: switch to push-to-main semantic-release pipeline #11
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,28 @@ | ||
| name: CI | ||
|
|
||
| on: | ||
| pull_request: | ||
| push: | ||
| branches: [main] | ||
|
|
||
| concurrency: | ||
| group: ci-${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| verify: | ||
| # Skip the bot-authored bump commit's `[skip ci]` push. PR runs always go | ||
| # through (no `head_commit` on pull_request events; gating on event_name | ||
| # avoids the null-deref that would otherwise prevent the job scheduling). | ||
| if: ${{ github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]') }} | ||
| name: Verify | ||
| runs-on: macos-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install Rust toolchain (from rust-toolchain.toml) | ||
| run: rustup show | ||
|
|
@@ -37,3 +47,105 @@ jobs: | |
|
|
||
| - name: Build release | ||
| run: cargo build --release | ||
|
|
||
| # Push-to-main release. semantic-release decides the next version from | ||
| # Conventional Commits since the last `v*` tag, runs scripts/release- | ||
| # prepare.sh to bump Cargo.toml + Cargo.lock, commits the bump back to | ||
| # main with [skip ci], creates the GitHub Release, then we build dual-arch | ||
| # macOS tarballs and bump the Homebrew formula on uinaf/homebrew-tap. | ||
| # | ||
| # Mirrors the shape used by uinaf/react-json-logic. | ||
| release: | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip ci]') }} | ||
| name: Release | ||
| needs: [verify] | ||
| runs-on: macos-latest | ||
| permissions: | ||
| contents: write | ||
| issues: write | ||
| pull-requests: write | ||
| concurrency: | ||
| group: release-${{ github.repository }}-main | ||
| cancel-in-progress: false | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: true | ||
|
|
||
| - name: Install Rust toolchain (with darwin cross-compile targets) | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| targets: aarch64-apple-darwin,x86_64-apple-darwin | ||
|
There was a problem hiding this comment. Cross-compile targets installed on overridden toolchainHigh Severity
Additional Locations (1)  Reviewed by Cursor Bugbot for commit 4278e44. Configure here. |
||
|
|
||
| - name: Setup Node (for semantic-release plugins) | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
|
|
||
| - name: Run semantic-release | ||
| id: release | ||
| uses: cycjimmy/semantic-release-action@v6 | ||
| with: | ||
| extra_plugins: | | ||
| @semantic-release/commit-analyzer | ||
| @semantic-release/release-notes-generator | ||
| @semantic-release/exec | ||
| @semantic-release/git | ||
| @semantic-release/github | ||
| conventional-changelog-conventionalcommits | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GIT_AUTHOR_NAME: glitch418x | ||
| GIT_AUTHOR_EMAIL: 189487110+glitch418x@users.noreply.github.com | ||
| GIT_COMMITTER_NAME: glitch418x | ||
| GIT_COMMITTER_EMAIL: 189487110+glitch418x@users.noreply.github.com | ||
|
|
||
| - name: Build dual-arch macOS binaries | ||
| if: steps.release.outputs.new_release_published == 'true' | ||
| run: | | ||
| cargo build --release --target aarch64-apple-darwin | ||
| cargo build --release --target x86_64-apple-darwin | ||
|
|
||
| - name: Package release artifacts | ||
| if: steps.release.outputs.new_release_published == 'true' | ||
| run: | | ||
| VERSION="${{ steps.release.outputs.new_release_version }}" | ||
| mkdir -p dist/arm64 dist/amd64 | ||
| cp target/aarch64-apple-darwin/release/tccutil-rs dist/arm64/tccutil-rs | ||
| cp target/x86_64-apple-darwin/release/tccutil-rs dist/amd64/tccutil-rs | ||
| chmod +x dist/arm64/tccutil-rs dist/amd64/tccutil-rs | ||
|
|
||
| tar -C dist/arm64 -czf "tccutil-rs_v${VERSION}_darwin-arm64.tar.gz" tccutil-rs | ||
| tar -C dist/amd64 -czf "tccutil-rs_v${VERSION}_darwin-amd64.tar.gz" tccutil-rs | ||
|
|
||
| shasum -a 256 \ | ||
| "tccutil-rs_v${VERSION}_darwin-arm64.tar.gz" \ | ||
| "tccutil-rs_v${VERSION}_darwin-amd64.tar.gz" \ | ||
| > checksums.txt | ||
|
|
||
| - name: Attach assets to GitHub Release | ||
| # semantic-release already created the Release with changelog notes; | ||
| # this step appends the binaries and checksums to the same Release. | ||
| if: steps.release.outputs.new_release_published == 'true' | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| tag_name: ${{ steps.release.outputs.new_release_git_tag }} | ||
| generate_release_notes: false | ||
| files: | | ||
| tccutil-rs_v*_darwin-arm64.tar.gz | ||
| tccutil-rs_v*_darwin-amd64.tar.gz | ||
| checksums.txt | ||
|
|
||
| - name: Bump Homebrew formula on uinaf/homebrew-tap | ||
| # Computes the tarball sha256 from the GitHub-hosted release archive, | ||
| # rewrites Formula/tccutil-rs.rb on the tap, and opens a PR. Runs | ||
| # after the assets are attached so the action can fetch them. | ||
| if: steps.release.outputs.new_release_published == 'true' | ||
| uses: dawidd6/action-homebrew-bump-formula@v5 | ||
| with: | ||
| token: ${{ secrets.TAP_GITHUB_TOKEN }} | ||
| tap: uinaf/homebrew-tap | ||
| formula: tccutil-rs | ||
| tag: ${{ steps.release.outputs.new_release_git_tag }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { | ||
| "branches": ["main"], | ||
| "tagFormat": "v${version}", | ||
| "plugins": [ | ||
| [ | ||
| "@semantic-release/commit-analyzer", | ||
| { | ||
| "preset": "conventionalcommits" | ||
| } | ||
| ], | ||
| [ | ||
| "@semantic-release/release-notes-generator", | ||
| { | ||
| "preset": "conventionalcommits" | ||
| } | ||
| ], | ||
| [ | ||
| "@semantic-release/exec", | ||
| { | ||
| "prepareCmd": "scripts/release-prepare.sh ${nextRelease.version}" | ||
| } | ||
| ], | ||
| [ | ||
| "@semantic-release/git", | ||
| { | ||
| "assets": ["Cargo.toml", "Cargo.lock"], | ||
| "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" | ||
| } | ||
| ], | ||
| "@semantic-release/github" | ||
| ] | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| #!/usr/bin/env bash | ||
| # Bumps the version in Cargo.toml + Cargo.lock to the version semantic-release | ||
| # computed for the upcoming release. Invoked by @semantic-release/exec via | ||
| # `prepareCmd` in .releaserc.json. | ||
| # | ||
| # Runs in CI only — you should not need to run this locally. | ||
| set -euo pipefail | ||
|
|
||
| if [ "$#" -ne 1 ]; then | ||
| echo "usage: $0 <version>" >&2 | ||
| exit 2 | ||
| fi | ||
|
|
||
| version="$1" | ||
|
|
||
| # Bump only the [package] version line, not any dependency version specs. | ||
| # awk replaces the first matching `^version = ` line and leaves the rest of | ||
| # the file alone; this is portable across BSD awk (macOS) and GNU awk. | ||
| tmp="$(mktemp)" | ||
| awk -v v="$version" ' | ||
| /^version = / && !done { print "version = \"" v "\""; done=1; next } | ||
| { print } | ||
| ' Cargo.toml > "$tmp" | ||
| mv "$tmp" Cargo.toml | ||
|
|
||
| # Refresh Cargo.lock so the local-crate entry matches the new version. | ||
| # `cargo check` updates Cargo.lock when Cargo.toml's version changes. | ||
| cargo check --quiet | ||
|
|
||
| echo "Bumped Cargo.toml + Cargo.lock to version $version" |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.