1+ # Release modern workflow with crates.io Trusted Publishing.
2+ # Use this to test the new flow. On crates.io add Trusted Publisher with workflow filename: release.yml
3+ # Manual only: run from Actions → Release → Run workflow, and select the version tag (e.g. v1.0.0) as the ref.
14name : Release
25on :
36 workflow_dispatch :
4- push :
5- tags :
6- - ' v[0-9]+.[0-9]+.[0-9]+'
7+ # Uncomment this to release on tag push
8+ # push:
9+ # tags:
10+ # - 'v[0-9]+.[0-9]+.[0-9]+'
11+ inputs :
12+ tag :
13+ description : ' Release tag (must already exist in the repo, e.g. v1.0.0)'
14+ required : true
15+ type : string
716
817env :
918 BIN_NAME : scopelint
@@ -15,17 +24,17 @@ jobs:
1524 name : Dist
1625 runs-on : ${{ matrix.os }}
1726 strategy :
18- fail-fast : true # Fail other jobs if one fails.
27+ fail-fast : true
1928 matrix :
2029 build : [x86_64-linux, aarch64-linux, x86_64-macos, x86_64-windows, aarch64-macos]
2130 include :
2231 - build : x86_64-linux
23- os : ubuntu-20 .04
32+ os : ubuntu-22 .04
2433 rust : stable
2534 target : x86_64-unknown-linux-gnu
2635 cross : true
2736 - build : aarch64-linux
28- os : ubuntu-20 .04
37+ os : ubuntu-22 .04
2938 rust : stable
3039 target : aarch64-unknown-linux-gnu
3140 cross : true
4756
4857 steps :
4958 - name : Checkout sources
50- uses : actions/checkout@v3
59+ uses : actions/checkout@v4
5160
5261 - name : Install ${{ matrix.rust }} toolchain
5362 uses : actions-rs/toolchain@v1
5766 target : ${{ matrix.target }}
5867 override : true
5968
60- # Currently skipping tests because it fails with:
61- # thread 'test_check_proj1_all_findings' panicked at 'Failed to execute command: Os { code: 2, kind: NotFound, message: "No such file or directory" }', tests/cli.rs:18:10
62- # when run here, even though tests work fine in the other actions file.
63-
64- # # We skip tests for M1 (arm64), because the binary is for M1 but the github runner is Intel,
65- # # so it can't run the binary/tests. However, the Intel macOS can build the binaries for M1
66- # # which is what happens here.
67- # - name: Run cargo test
68- # uses: actions-rs/cargo@v1
69- # if: ${{ matrix.build != 'aarch64-macos' }}
70- # with:
71- # use-cross: ${{ matrix.cross }}
72- # command: test
73- # args: --release --locked --target ${{ matrix.target }}
74-
7569 - name : Build release binary
7670 uses : actions-rs/cargo@v1
7771 with :
10296 cp "target/${{ matrix.target }}/release/$BIN_NAME" "dist/"
10397 fi
10498
105- - uses : actions/upload-artifact@v2.2.4
99+ - uses : actions/upload-artifact@v4
106100 with :
107101 name : bins-${{ matrix.build }}
108102 path : dist
@@ -111,54 +105,54 @@ jobs:
111105 name : Publish
112106 needs : [dist]
113107 runs-on : ubuntu-latest
108+ permissions :
109+ contents : write # Required to create releases and upload assets
110+ id-token : write # Required for crates.io Trusted Publishing (OIDC)
114111 steps :
115112 - name : Checkout sources
116- uses : actions/checkout@v2
113+ uses : actions/checkout@v4
117114 with :
118115 submodules : false
119116
120- - uses : actions/download-artifact@v2
121- # with:
122- # path: dist
123- # - run: ls -al ./dist
117+ - uses : actions/download-artifact@v4
118+ with :
119+ pattern : ' bins-* '
120+ merge-multiple : false
124121 - run : ls -al bins-*
125122
126123 - name : Calculate tag name
127124 run : |
128125 name=dev
129- if [[ $GITHUB_REF == refs/tags/v* ]]; then
130- name=${GITHUB_REF:10}
126+ if [[ -z "$name" || "$name" != v* ]]; then
127+ echo "::error::Release tag must be set and start with 'v' (e.g. v1.0.0)"
128+ exit 1
131129 fi
132- echo ::set-output name= val:: $name
130+ echo " val= $name" >> $GITHUB_OUTPUT
133131 echo TAG=$name >> $GITHUB_ENV
134132 id : tagname
135133
136134 - name : Build archive
137135 shell : bash
138136 run : |
139137 set -ex
140-
141138 rm -rf tmp
142139 mkdir tmp
143140 mkdir dist
144-
145141 for dir in bins-* ; do
146- platform=${dir#"bins-"}
147- unset exe
148- if [[ $platform =~ "windows" ]]; then
149- exe=".exe"
150- fi
151- pkgname=$PROJECT_NAME-$platform
152- mkdir tmp/$pkgname
153- # cp LICENSE README.md tmp/$pkgname
154- mv bins-$platform/$BIN_NAME$exe tmp/$pkgname
155- chmod +x tmp/$pkgname/$BIN_NAME$exe
156-
157- if [ "$exe" = "" ]; then
158- tar cJf dist/$pkgname.tar.xz -C tmp $pkgname
159- else
160- (cd tmp && 7z a -r ../dist/$pkgname.zip $pkgname)
161- fi
142+ platform=${dir#"bins-"}
143+ unset exe
144+ if [[ $platform =~ "windows" ]]; then
145+ exe=".exe"
146+ fi
147+ pkgname=$PROJECT_NAME-$platform
148+ mkdir tmp/$pkgname
149+ mv bins-$platform/$BIN_NAME$exe tmp/$pkgname
150+ chmod +x tmp/$pkgname/$BIN_NAME$exe
151+ if [ "$exe" = "" ]; then
152+ tar cJf dist/$pkgname.tar.xz -C tmp $pkgname
153+ else
154+ (cd tmp && 7z a -r ../dist/$pkgname.zip $pkgname)
155+ fi
162156 done
163157
164158 - name : Upload binaries to release
@@ -170,21 +164,14 @@ jobs:
170164 tag : ${{ steps.tagname.outputs.val }}
171165 overwrite : true
172166
173- - name : Extract version
174- id : extract-version
175- run : |
176- printf "::set-output name=%s::%s\n" tag-name "${GITHUB_REF#refs/tags/}"
167+ - name : Authenticate with crates.io
168+ id : auth
169+ uses : rust-lang/crates-io-auth-action@v1
177170
178- # Uncomment this section if you want to release your package to crates.io
179- # Before publishing, make sure you have filled out the following fields:
180- # license or license-file, description, homepage, documentation, repository, readme.
181- # Read more: https://doc.rust-lang.org/cargo/reference/publishing.html
182- - name : Install ${{ matrix.rust }} toolchain
183- uses : actions-rs/toolchain@v1
184- with :
185- profile : minimal
186- toolchain : stable
187- target : ${{ matrix.target }}
188- - run : cargo publish --token ${CRATES_TOKEN} --allow-dirty
171+ - name : Install Rust toolchain
172+ uses : dtolnay/rust-toolchain@stable
173+
174+ - name : Publish to crates.io
175+ run : cargo publish --allow-dirty
189176 env :
190- CRATES_TOKEN : ${{ secrets.CRATES_TOKEN }}
177+ CARGO_REGISTRY_TOKEN : ${{ steps.auth.outputs.token }}
0 commit comments