|
| 1 | +name: release |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: |
| 6 | + - "v*" |
| 7 | + |
| 8 | +permissions: |
| 9 | + contents: read |
| 10 | + |
| 11 | +env: |
| 12 | + CARGO_TERM_COLOR: always |
| 13 | + |
| 14 | +jobs: |
| 15 | + verify: |
| 16 | + runs-on: ubuntu-latest |
| 17 | + steps: |
| 18 | + - uses: actions/checkout@v4 |
| 19 | + - uses: dtolnay/rust-toolchain@master |
| 20 | + with: |
| 21 | + toolchain: 1.94.0 |
| 22 | + components: rustfmt, clippy |
| 23 | + - name: Verify release tag matches Cargo version |
| 24 | + shell: bash |
| 25 | + run: | |
| 26 | + version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1) |
| 27 | + escaped_version=${version//./\.} |
| 28 | + if [[ $GITHUB_REF_NAME != "v$version" \ |
| 29 | + && ! $GITHUB_REF_NAME =~ ^v${escaped_version}-pre(\.[0-9]+)?$ ]]; then |
| 30 | + echo "expected v${version}, v${version}-pre, or v${version}-pre.N" >&2 |
| 31 | + exit 1 |
| 32 | + fi |
| 33 | + - run: cargo fmt --check |
| 34 | + - run: cargo clippy --locked --all-targets --all-features -- -D warnings |
| 35 | + - run: cargo test --locked |
| 36 | + env: |
| 37 | + OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY || 'ci-placeholder' }} |
| 38 | + |
| 39 | + linux-x64: |
| 40 | + needs: verify |
| 41 | + runs-on: ubuntu-22.04 |
| 42 | + steps: |
| 43 | + - uses: actions/checkout@v4 |
| 44 | + - uses: dtolnay/rust-toolchain@master |
| 45 | + with: |
| 46 | + toolchain: 1.94.0 |
| 47 | + targets: x86_64-unknown-linux-gnu |
| 48 | + - name: Build and package |
| 49 | + shell: bash |
| 50 | + run: | |
| 51 | + version=${GITHUB_REF_NAME#v} |
| 52 | + cargo build --locked --release --target x86_64-unknown-linux-gnu |
| 53 | + mkdir -p stage dist |
| 54 | + cp target/x86_64-unknown-linux-gnu/release/kit stage/kit |
| 55 | + stage/kit --version |
| 56 | + tar -C stage -czf "dist/kit-v${version}-x86_64-unknown-linux-gnu.tar.gz" kit |
| 57 | + - uses: actions/upload-artifact@v4 |
| 58 | + with: |
| 59 | + name: kit-linux-x64 |
| 60 | + path: dist/* |
| 61 | + if-no-files-found: error |
| 62 | + |
| 63 | + macos-arm64: |
| 64 | + needs: verify |
| 65 | + runs-on: macos-15 |
| 66 | + outputs: |
| 67 | + signed: ${{ steps.signing.outputs.enabled }} |
| 68 | + env: |
| 69 | + MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }} |
| 70 | + MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} |
| 71 | + MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} |
| 72 | + APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }} |
| 73 | + APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} |
| 74 | + APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} |
| 75 | + steps: |
| 76 | + - uses: actions/checkout@v4 |
| 77 | + - uses: dtolnay/rust-toolchain@master |
| 78 | + with: |
| 79 | + toolchain: 1.94.0 |
| 80 | + targets: aarch64-apple-darwin |
| 81 | + - name: Check optional signing credentials |
| 82 | + id: signing |
| 83 | + shell: bash |
| 84 | + run: | |
| 85 | + credentials=( |
| 86 | + MACOS_CERTIFICATE_P12_BASE64 |
| 87 | + MACOS_CERTIFICATE_PASSWORD |
| 88 | + MACOS_SIGNING_IDENTITY |
| 89 | + APPLE_API_KEY_P8_BASE64 |
| 90 | + APPLE_API_KEY_ID |
| 91 | + APPLE_API_ISSUER_ID |
| 92 | + ) |
| 93 | + configured=0 |
| 94 | + for name in "${credentials[@]}"; do |
| 95 | + if [[ -n ${!name:-} ]]; then |
| 96 | + configured=$((configured + 1)) |
| 97 | + fi |
| 98 | + done |
| 99 | + if [[ $configured -eq 0 ]]; then |
| 100 | + echo "Apple credentials are not configured; building an unsigned macOS release." |
| 101 | + echo "enabled=false" >> "$GITHUB_OUTPUT" |
| 102 | + elif [[ $configured -eq ${#credentials[@]} ]]; then |
| 103 | + echo "enabled=true" >> "$GITHUB_OUTPUT" |
| 104 | + else |
| 105 | + echo "Apple signing credentials are only partially configured." >&2 |
| 106 | + exit 1 |
| 107 | + fi |
| 108 | + - name: Import Developer ID certificate |
| 109 | + if: steps.signing.outputs.enabled == 'true' |
| 110 | + shell: bash |
| 111 | + run: | |
| 112 | + keychain=$RUNNER_TEMP/kit-signing.keychain-db |
| 113 | + certificate=$RUNNER_TEMP/kit-signing.p12 |
| 114 | + printf '%s' "$MACOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$certificate" |
| 115 | + security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" "$keychain" |
| 116 | + security set-keychain-settings -lut 21600 "$keychain" |
| 117 | + security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" "$keychain" |
| 118 | + security import "$certificate" -P "$MACOS_CERTIFICATE_PASSWORD" \ |
| 119 | + -f pkcs12 -k "$keychain" -T /usr/bin/codesign |
| 120 | + security set-key-partition-list -S apple-tool:,apple: -s \ |
| 121 | + -k "$MACOS_CERTIFICATE_PASSWORD" "$keychain" |
| 122 | + security list-keychains -d user -s "$keychain" login.keychain-db |
| 123 | + - name: Build and package |
| 124 | + shell: bash |
| 125 | + env: |
| 126 | + SIGN_RELEASE: ${{ steps.signing.outputs.enabled }} |
| 127 | + run: | |
| 128 | + version=${GITHUB_REF_NAME#v} |
| 129 | + cargo build --locked --release --target aarch64-apple-darwin |
| 130 | + mkdir -p stage dist |
| 131 | + cp target/aarch64-apple-darwin/release/kit stage/kit |
| 132 | + if [[ $SIGN_RELEASE == true ]]; then |
| 133 | + codesign --force --options runtime --timestamp \ |
| 134 | + --identifier com.danielkov.kit \ |
| 135 | + --sign "$MACOS_SIGNING_IDENTITY" stage/kit |
| 136 | + codesign --verify --strict --verbose=2 stage/kit |
| 137 | + ditto -c -k --keepParent stage/kit "$RUNNER_TEMP/kit-notarization.zip" |
| 138 | + api_key=$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8 |
| 139 | + trap 'rm -f "$api_key"' EXIT |
| 140 | + printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$api_key" |
| 141 | + chmod 600 "$api_key" |
| 142 | + notary_log=$RUNNER_TEMP/kit-notarization.log |
| 143 | + xcrun notarytool submit "$RUNNER_TEMP/kit-notarization.zip" \ |
| 144 | + --key "$api_key" \ |
| 145 | + --key-id "$APPLE_API_KEY_ID" \ |
| 146 | + --issuer "$APPLE_API_ISSUER_ID" \ |
| 147 | + --wait 2>&1 | tee "$notary_log" |
| 148 | + if ! grep -Eq '(^|[[:space:]])status: Accepted([[:space:]]|$)' "$notary_log"; then |
| 149 | + echo "Apple did not accept the notarization submission." >&2 |
| 150 | + exit 1 |
| 151 | + fi |
| 152 | + fi |
| 153 | + stage/kit --version |
| 154 | + tar -C stage -czf "dist/kit-v${version}-aarch64-apple-darwin.tar.gz" kit |
| 155 | + - uses: actions/upload-artifact@v4 |
| 156 | + with: |
| 157 | + name: kit-macos-arm64 |
| 158 | + path: dist/* |
| 159 | + if-no-files-found: error |
| 160 | + |
| 161 | + publish: |
| 162 | + needs: [linux-x64, macos-arm64] |
| 163 | + runs-on: ubuntu-latest |
| 164 | + permissions: |
| 165 | + contents: write |
| 166 | + env: |
| 167 | + GH_TOKEN: ${{ github.token }} |
| 168 | + MACOS_SIGNED: ${{ needs.macos-arm64.outputs.signed }} |
| 169 | + steps: |
| 170 | + - uses: actions/download-artifact@v4 |
| 171 | + with: |
| 172 | + pattern: kit-* |
| 173 | + path: dist |
| 174 | + merge-multiple: true |
| 175 | + - name: Publish release |
| 176 | + shell: bash |
| 177 | + run: | |
| 178 | + cd dist |
| 179 | + sha256sum kit-*.tar.gz > SHA256SUMS |
| 180 | + prerelease=false |
| 181 | + if [[ $GITHUB_REF_NAME == *-pre* ]]; then |
| 182 | + prerelease=true |
| 183 | + fi |
| 184 | + if [[ $MACOS_SIGNED == true ]]; then |
| 185 | + signing_note="The macOS binary is Developer ID signed and notarized." |
| 186 | + else |
| 187 | + signing_note="The macOS binary is unsigned and not notarized." |
| 188 | + fi |
| 189 | + title="Kit ${GITHUB_REF_NAME#v}" |
| 190 | + notes="Prebuilt Kit binaries. $signing_note" |
| 191 | + if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then |
| 192 | + gh release upload "$GITHUB_REF_NAME" kit-*.tar.gz SHA256SUMS \ |
| 193 | + --clobber --repo "$GITHUB_REPOSITORY" |
| 194 | + else |
| 195 | + create_args=( |
| 196 | + "$GITHUB_REF_NAME" kit-*.tar.gz SHA256SUMS |
| 197 | + --repo "$GITHUB_REPOSITORY" |
| 198 | + --title "$title" |
| 199 | + --notes "$notes" |
| 200 | + ) |
| 201 | + if [[ $prerelease == true ]]; then |
| 202 | + create_args+=(--prerelease) |
| 203 | + fi |
| 204 | + gh release create "${create_args[@]}" |
| 205 | + fi |
| 206 | + edit_args=( |
| 207 | + "$GITHUB_REF_NAME" |
| 208 | + --repo "$GITHUB_REPOSITORY" |
| 209 | + --title "$title" |
| 210 | + --notes "$notes" |
| 211 | + --draft=false |
| 212 | + --prerelease="$prerelease" |
| 213 | + ) |
| 214 | + if [[ $prerelease == false ]]; then |
| 215 | + edit_args+=(--latest) |
| 216 | + fi |
| 217 | + gh release edit "${edit_args[@]}" |
0 commit comments