chore(release): v0.0.108 #34
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: {} | |
| env: | |
| BUN_VERSION: "1.3.14" | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Ensure tag commit is on main | |
| if: github.event_name == 'push' | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main | |
| TAG_COMMIT="$(git rev-parse "${GITHUB_SHA}^{commit}")" | |
| if ! git merge-base --is-ancestor "${TAG_COMMIT}" "origin/main"; then | |
| echo "Tag ${REF_NAME} is not on origin/main." | |
| exit 1 | |
| fi | |
| - name: Ensure tag matches package.json version | |
| if: github.event_name == 'push' | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| TAG_NAME="${REF_NAME#v}" | |
| PACKAGE_VERSION="$(node -p "require('./package.json').version")" | |
| if [ "${TAG_NAME}" != "${PACKAGE_VERSION}" ]; then | |
| echo "Tag ${REF_NAME} (stripped: ${TAG_NAME}) does not match package.json version ${PACKAGE_VERSION}." | |
| exit 1 | |
| fi | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Audit complete dependency graph | |
| run: bun audit | |
| - name: Audit production dependencies | |
| run: bun audit --audit-level=high --prod | |
| - name: Static checks, tests, coverage, and Fallow analysis | |
| run: bun run validate | |
| - name: Tests (Bun — DB) | |
| run: bun run test:db | |
| build: | |
| runs-on: windows-latest | |
| needs: validate | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Resolve version | |
| id: ver | |
| shell: pwsh | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| $v = $env:REF_NAME -replace "^v","" | |
| # Reject anything that isn't a clean semver to keep downstream shell-safe | |
| if ($v -notmatch '^[0-9]+(\.[0-9]+)*(-[A-Za-z0-9.]+)?$') { | |
| Write-Error "Refusing unsafe version string: $v" | |
| exit 1 | |
| } | |
| "version=$v" >> $env:GITHUB_OUTPUT | |
| Write-Host "Resolved: semver=$v" | |
| - run: bun install --frozen-lockfile | |
| - run: bun scripts/generate-icons.ts | |
| - name: Build hlid.exe | |
| env: | |
| HLID_BUILD_OUTFILE: build/hlid.exe | |
| run: bun run build:win | |
| - name: Smoke test hlid.exe | |
| shell: pwsh | |
| env: | |
| HLID_SKIP_SELF_INSTALL: "1" | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $exe = Resolve-Path "build/hlid.exe" | |
| $proc = Start-Process -FilePath $exe -ArgumentList "--background" -PassThru -WindowStyle Hidden | |
| try { | |
| $deadline = (Get-Date).AddSeconds(30) | |
| $ok = $false | |
| do { | |
| Start-Sleep -Milliseconds 500 | |
| if ($proc.HasExited) { break } | |
| try { | |
| $health = Invoke-RestMethod -Uri "http://127.0.0.1:3000/api/health" -TimeoutSec 2 | |
| if ($health.service -eq "hlid") { | |
| $ok = $true | |
| break | |
| } | |
| } catch {} | |
| } while ((Get-Date) -lt $deadline) | |
| if (-not $ok) { | |
| if ($proc.HasExited) { | |
| Write-Host "hlid.exe exited early with code $($proc.ExitCode)" | |
| } else { | |
| Write-Host "hlid.exe did not become healthy before timeout" | |
| } | |
| Get-ChildItem -Path "build" -Filter "crash.log" -ErrorAction SilentlyContinue | ForEach-Object { | |
| Write-Host "==== $($_.FullName) ====" | |
| Get-Content $_.FullName -Raw | |
| } | |
| throw "hlid.exe smoke test failed" | |
| } | |
| } finally { | |
| try { | |
| Invoke-RestMethod -Uri "http://127.0.0.1:3000/api/lifecycle" -Method POST -ContentType "application/json" -Body '{"action":"shutdown"}' -TimeoutSec 2 | Out-Null | |
| Start-Sleep -Milliseconds 800 | |
| } catch {} | |
| if (-not $proc.HasExited) { | |
| Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue | |
| } | |
| } | |
| - name: Rename for release | |
| shell: pwsh | |
| env: | |
| VERSION: ${{ steps.ver.outputs.version }} | |
| run: | | |
| $name = "hlid-v$($env:VERSION)-windows-x64.exe" | |
| Move-Item build/hlid.exe $name | |
| "ARTIFACT=$name" >> $env:GITHUB_ENV | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: hlid-windows-x64 | |
| path: ${{ env.ARTIFACT }} | |
| if-no-files-found: error | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout release commit | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Read release notes from commit body | |
| shell: bash | |
| run: | | |
| git show -s --format=%b "${GITHUB_SHA}^{commit}" > release-notes.md | |
| if ! grep -q '[^[:space:]]' release-notes.md; then | |
| echo "Release commit body is empty; add curated Markdown release notes." | |
| exit 1 | |
| fi | |
| - name: Download build artifact | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: hlid-windows-x64 | |
| path: dist/ | |
| - name: Generate checksums | |
| run: | | |
| cd dist | |
| sha256sum *.exe > hlid-checksums.txt | |
| cat hlid-checksums.txt | |
| - name: Publish release | |
| uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| body_path: release-notes.md | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| draft: false | |
| prerelease: ${{ contains(github.ref_name, '-') }} | |
| files: | | |
| dist/*.exe | |
| dist/hlid-checksums.txt |