fix(v0.7): serialise SHIELD_PROTECTED_BRANCHES env-touching tests #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| # Build and publish aperion-shield binaries + Docker image + Homebrew tap | |
| # bump on every git tag matching `shield-v*` (e.g. shield-v0.1.0). | |
| on: | |
| push: | |
| tags: | |
| - 'shield-v*' | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to release as (e.g. shield-v0.1.0). Required for manual runs." | |
| required: true | |
| jobs: | |
| # ──────────────────────────────────────────────────────────────────── | |
| # 1. Build per-target binaries | |
| # ──────────────────────────────────────────────────────────────────── | |
| build: | |
| name: build (${{ matrix.target }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| archive: tar.gz | |
| - target: aarch64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| archive: tar.gz | |
| linker: aarch64-linux-gnu-gcc | |
| # Both macOS targets run on macos-14 (Apple Silicon). The x86_64 | |
| # binary is produced via cross-compilation (`rustup target add | |
| # x86_64-apple-darwin`) -- the macos-13 runner has been | |
| # deprecated by GitHub and the queue is effectively dead. | |
| - target: x86_64-apple-darwin | |
| os: macos-14 | |
| archive: tar.gz | |
| - target: aarch64-apple-darwin | |
| os: macos-14 | |
| archive: tar.gz | |
| - target: x86_64-pc-windows-msvc | |
| os: windows-latest | |
| archive: zip | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Install cross-linker (aarch64-linux only) | |
| if: matrix.linker == 'aarch64-linux-gnu-gcc' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu | |
| mkdir -p .cargo | |
| echo "[target.aarch64-unknown-linux-gnu]" >> .cargo/config.toml | |
| echo "linker = \"aarch64-linux-gnu-gcc\"" >> .cargo/config.toml | |
| - name: Build release | |
| run: cargo build --release --locked --target ${{ matrix.target }} | |
| - name: Package | |
| shell: bash | |
| run: | | |
| mkdir -p dist | |
| BIN=aperion-shield | |
| if [[ "${{ matrix.target }}" == *windows* ]]; then BIN=aperion-shield.exe; fi | |
| cp target/${{ matrix.target }}/release/${BIN} dist/${BIN} | |
| cp README.md LICENSE 2>/dev/null || true | |
| cp shield.example.yaml dist/ 2>/dev/null || true | |
| cd dist | |
| ARCHIVE="aperion-shield-${{ github.ref_name }}-${{ matrix.target }}.${{ matrix.archive }}" | |
| if [[ "${{ matrix.archive }}" == "zip" ]]; then | |
| 7z a "${ARCHIVE}" * | |
| else | |
| tar -czf "${ARCHIVE}" * | |
| fi | |
| # Portable sha256: shasum on macOS/Linux, sha256sum on most | |
| # Linux distros, certutil on Windows (no shasum on the | |
| # windows-latest runner). | |
| if command -v shasum >/dev/null 2>&1; then | |
| shasum -a 256 "${ARCHIVE}" > "${ARCHIVE}.sha256" | |
| elif command -v sha256sum >/dev/null 2>&1; then | |
| sha256sum "${ARCHIVE}" > "${ARCHIVE}.sha256" | |
| else | |
| HASH=$(certutil -hashfile "${ARCHIVE}" SHA256 | sed -n '2p' | tr -d ' \r\n') | |
| echo "${HASH} ${ARCHIVE}" > "${ARCHIVE}.sha256" | |
| fi | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: aperion-shield-${{ matrix.target }} | |
| path: dist/aperion-shield-*.${{ matrix.archive }}* | |
| # ──────────────────────────────────────────────────────────────────── | |
| # 2. Build & push the Docker image (multi-arch) | |
| # ──────────────────────────────────────────────────────────────────── | |
| docker: | |
| name: docker (linux/amd64, linux/arm64) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build & push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: | | |
| ghcr.io/aperionai/shield:latest | |
| ghcr.io/aperionai/shield:${{ github.ref_name }} | |
| # ──────────────────────────────────────────────────────────────────── | |
| # 3. Publish a GitHub release with every per-target archive | |
| # ──────────────────────────────────────────────────────────────────── | |
| release: | |
| name: github release | |
| needs: [build, docker] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Create release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| name: ${{ github.ref_name }} | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| files: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/*.sha256 | |
| # ──────────────────────────────────────────────────────────────────── | |
| # 4. Update the Homebrew tap | |
| # ──────────────────────────────────────────────────────────────────── | |
| homebrew: | |
| name: homebrew tap bump | |
| needs: release | |
| runs-on: ubuntu-latest | |
| # Requires a fine-grained PAT (`HOMEBREW_TAP_TOKEN`) with write to | |
| # the AperionAI/homebrew-tap repository. Job runs every release; the | |
| # bump step is skipped automatically if the secret is unset (secrets | |
| # cannot be referenced from job-level `if:` expressions). | |
| steps: | |
| - name: Detect Homebrew tap token | |
| id: check | |
| env: | |
| TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| run: | | |
| if [ -n "$TAP_TOKEN" ]; then | |
| echo "has_token=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_token=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::HOMEBREW_TAP_TOKEN secret not set -- skipping tap bump." | |
| fi | |
| - name: Bump Homebrew formula | |
| if: steps.check.outputs.has_token == 'true' | |
| uses: dawidd6/action-homebrew-bump-formula@v3 | |
| with: | |
| token: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| tap: AperionAI/homebrew-tap | |
| formula: aperion-shield | |
| tag: ${{ github.ref_name }} |