馃悰 fix(s3): pin ranged reads to ETag #1892
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Based on dist 0.32.0 output; this version keeps GitHub expressions out of shell commands. | |
| # | |
| # Copyright 2022-2024, axodotdev | |
| # SPDX-License-Identifier: MIT or Apache-2.0 | |
| # | |
| name: Release | |
| permissions: | |
| "contents": "read" | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| CARGO_HTTP_MULTIPLEXING: "false" | |
| CARGO_NET_RETRY: "10" | |
| GIT_CONFIG_COUNT: "1" | |
| GIT_CONFIG_KEY_0: init.defaultBranch | |
| GIT_CONFIG_VALUE_0: main | |
| on: | |
| pull_request: | |
| push: | |
| tags: | |
| - "**[0-9]+.[0-9]+.[0-9]+*" | |
| jobs: | |
| plan: | |
| runs-on: "ubuntu-22.04" | |
| timeout-minutes: 20 | |
| outputs: | |
| val: ${{ steps.plan.outputs.manifest }} | |
| tag: ${{ !github.event.pull_request && github.ref_name || '' }} | |
| publishing: ${{ !github.event.pull_request }} | |
| env: | |
| CARGO_HTTP_MULTIPLEXING: "false" | |
| CARGO_NET_RETRY: "10" | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - uses: ./.github/actions/setup | |
| with: | |
| tools: cargo:cargo-dist | |
| - name: Cache dist | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/dist | |
| # Fork pull requests cannot access target-repository secrets. | |
| - id: plan | |
| env: | |
| TAG: ${{ !github.event.pull_request && github.ref_name || '' }} | |
| shell: bash | |
| run: | | |
| if [[ -n "$TAG" ]]; then | |
| dist host --steps=create --tag="$TAG" --output-format=json > plan-dist-manifest.json | |
| else | |
| dist plan --output-format=json > plan-dist-manifest.json | |
| fi | |
| echo "dist ran successfully" | |
| cat plan-dist-manifest.json | |
| echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT" | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: artifacts-plan-dist-manifest | |
| path: plan-dist-manifest.json | |
| build-local-artifacts: | |
| # An implicit name keeps skipped matrix jobs legible. | |
| needs: | |
| - plan | |
| if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }} | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }} | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 90 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json | |
| steps: | |
| - name: enable windows longpaths | |
| run: | | |
| git config --global core.longpaths true | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - uses: ./.github/actions/setup | |
| with: | |
| tools: cargo:cargo-dist | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - name: Build artifacts | |
| env: | |
| TAG: ${{ needs.plan.outputs.tag }} | |
| TARGETS: ${{ join(matrix.targets, ',') }} | |
| shell: bash | |
| run: | | |
| args=(build --artifacts=local --target="$TARGETS" --print=linkage --output-format=json) | |
| if [[ -n "$TAG" ]]; then | |
| args+=(--tag="$TAG") | |
| fi | |
| dist "${args[@]}" > dist-manifest.json | |
| echo "dist ran successfully" | |
| - id: cargo-dist | |
| name: Post-build | |
| # Bash writes action outputs consistently across runner platforms. | |
| shell: bash | |
| run: | | |
| echo "paths<<EOF" >> "$GITHUB_OUTPUT" | |
| dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT" | |
| echo "EOF" >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: artifacts-build-local-${{ join(matrix.targets, '_') }} | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| build-global-artifacts: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| runs-on: "ubuntu-22.04" | |
| timeout-minutes: 30 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: cargo-dist | |
| env: | |
| TAG: ${{ needs.plan.outputs.tag }} | |
| shell: bash | |
| run: | | |
| args=(build --artifacts=global --output-format=json) | |
| if [[ -n "$TAG" ]]; then | |
| args+=(--tag="$TAG") | |
| fi | |
| dist "${args[@]}" > dist-manifest.json | |
| echo "dist ran successfully" | |
| echo "paths<<EOF" >> "$GITHUB_OUTPUT" | |
| jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT" | |
| echo "EOF" >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: artifacts-build-global | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| host: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| - build-global-artifacts | |
| if: | |
| ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result | |
| == 'skipped' || needs.build-local-artifacts.result == 'success') }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| runs-on: "ubuntu-22.04" | |
| timeout-minutes: 20 | |
| permissions: | |
| "attestations": "write" # Sign release artifacts. | |
| "contents": "write" # Create the GitHub release. | |
| "id-token": "write" # Bind attestations to this workflow. | |
| outputs: | |
| val: ${{ steps.host.outputs.manifest }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| - name: Fetch artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: host | |
| env: | |
| TAG: ${{ needs.plan.outputs.tag }} | |
| shell: bash | |
| run: | | |
| dist host --tag="$TAG" --steps=upload --steps=release --output-format=json > dist-manifest.json | |
| echo "artifacts uploaded and released successfully" | |
| cat dist-manifest.json | |
| echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT" | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: artifacts-dist-manifest | |
| path: dist-manifest.json | |
| - name: "Download GitHub Artifacts" | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| env: | |
| NODE_OPTIONS: --no-deprecation # https://github.com/actions/download-artifact/issues/484 | |
| with: | |
| pattern: artifacts-* | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Cleanup | |
| run: | | |
| rm -f artifacts/*-dist-manifest.json | |
| - name: Attest release artifacts | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: artifacts/* | |
| - name: Create GitHub Release | |
| env: | |
| PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}" | |
| ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}" | |
| ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}" | |
| RELEASE_COMMIT: "${{ github.sha }}" | |
| RELEASE_TAG: "${{ needs.plan.outputs.tag }}" | |
| run: | | |
| # A file avoids shell quoting changes in release notes. | |
| echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt | |
| gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/* | |
| custom-publish-pypi: | |
| needs: | |
| - plan | |
| - host | |
| if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }} | |
| uses: ./.github/workflows/publish-pypi.yml | |
| with: | |
| plan: ${{ needs.plan.outputs.val }} | |
| permissions: | |
| "attestations": "write" # Sign the Python packages. | |
| "contents": "read" # Read release metadata. | |
| "id-token": "write" # Authenticate to PyPI without a stored token. | |
| announce: | |
| needs: | |
| - plan | |
| - host | |
| - custom-publish-pypi | |
| # Wait for skipped prerelease jobs, but require host completion. | |
| if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-pypi.result == 'skipped' || needs.custom-publish-pypi.result == 'success') }} | |
| runs-on: "ubuntu-22.04" | |
| timeout-minutes: 15 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive |