BitFun 0.2.19-beta.1 Beta #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI Package | |
| on: | |
| release: | |
| types: | |
| - published | |
| workflow_dispatch: | |
| inputs: | |
| tag_name: | |
| description: "Tag name to build (e.g. v0.2.7). Leave empty to build from HEAD." | |
| required: false | |
| type: string | |
| upload_to_release: | |
| description: "Upload built artifacts to the release specified by tag_name." | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: cli-package-${{ github.event.release.tag_name || inputs.tag_name || github.sha }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ── Resolve version info (mirrors desktop-package.yml) ───────────── | |
| prepare: | |
| name: Prepare | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.meta.outputs.version }} | |
| release_tag: ${{ steps.meta.outputs.release_tag }} | |
| upload_to_release: ${{ steps.meta.outputs.upload_to_release }} | |
| checkout_ref: ${{ steps.meta.outputs.checkout_ref }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Resolve version metadata | |
| id: meta | |
| shell: bash | |
| env: | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| GITHUB_SHA: ${{ github.sha }} | |
| RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} | |
| INPUT_TAG_NAME: ${{ inputs.tag_name }} | |
| INPUT_UPLOAD_TO_RELEASE: ${{ inputs.upload_to_release }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then | |
| TAG="${RELEASE_TAG_NAME}" | |
| VERSION="${TAG#v}" | |
| UPLOAD="true" | |
| CHECKOUT_REF="${TAG}" | |
| elif [[ -n "${INPUT_TAG_NAME}" ]]; then | |
| TAG="${INPUT_TAG_NAME}" | |
| VERSION="${TAG#v}" | |
| CHECKOUT_REF="${TAG}" | |
| if [[ "${INPUT_UPLOAD_TO_RELEASE}" == "true" ]]; then | |
| UPLOAD="true" | |
| else | |
| UPLOAD="false" | |
| fi | |
| else | |
| VERSION="$(jq -r '.version' package.json)" | |
| TAG="v${VERSION}" | |
| UPLOAD="false" | |
| CHECKOUT_REF="${GITHUB_SHA}" | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "release_tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "upload_to_release=$UPLOAD" >> "$GITHUB_OUTPUT" | |
| echo "checkout_ref=$CHECKOUT_REF" >> "$GITHUB_OUTPUT" | |
| # ── Build the CLI per (os, target) ───────────────────────────────── | |
| build: | |
| name: Build (${{ matrix.platform.name }}) | |
| runs-on: ${{ matrix.platform.os }} | |
| needs: prepare | |
| # Linux x86_64/aarch64 are intentionally absent. They are built and published | |
| # by .github/workflows/linux-binaries.yml, which is the only producer that | |
| # also covers nightly and which must hold the CLI and Relay archives together | |
| # to emit linux-binaries.json. Adding them back here would upload identical | |
| # asset names from two workflows racing on the same `release: published`. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - os: macos-15 | |
| name: macos-arm64 | |
| target: aarch64-apple-darwin | |
| - os: macos-15-intel | |
| name: macos-x64 | |
| target: x86_64-apple-darwin | |
| - os: windows-latest | |
| name: windows-x64 | |
| target: x86_64-pc-windows-msvc | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.prepare.outputs.checkout_ref }} | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.platform.target }} | |
| - name: Cache Rust build | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "cli-v1-${{ matrix.platform.name }}" | |
| cache-bin: false | |
| - name: Build CLI (Unix) | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| env: | |
| # Keep the CLI self-updater and SSH installer on the same embedded | |
| # minisign trust root used by the Desktop updater. | |
| BITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| cargo build --release \ | |
| --target ${{ matrix.platform.target }} \ | |
| -p bitfun-cli | |
| - name: Build CLI (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| env: | |
| RUSTFLAGS: -C target-feature=+crt-static | |
| run: cargo build --release --target ${{ matrix.platform.target }} -p bitfun-cli | |
| - name: Test installer (Unix) | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| env: | |
| CARGO_BUILD_TARGET: ${{ matrix.platform.target }} | |
| run: bash scripts/cli/test-install-unix.sh "${{ matrix.platform.target }}" | |
| - name: Test installer (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| env: | |
| CARGO_BUILD_TARGET: ${{ matrix.platform.target }} | |
| RUSTFLAGS: -C target-feature=+crt-static | |
| run: ./scripts/cli/test-install-windows.ps1 -Target $env:CARGO_BUILD_TARGET | |
| - name: Package and smoke test (Unix) | |
| if: runner.os != 'Windows' | |
| id: stage | |
| shell: bash | |
| env: | |
| VERSION: ${{ needs.prepare.outputs.version }} | |
| TARGET: ${{ matrix.platform.target }} | |
| run: | | |
| set -euo pipefail | |
| bash scripts/cli/package-unix.sh "$VERSION" "$TARGET" | |
| - name: Package and smoke test (Windows) | |
| if: runner.os == 'Windows' | |
| id: stage-windows | |
| shell: pwsh | |
| env: | |
| VERSION: ${{ needs.prepare.outputs.version }} | |
| TARGET: ${{ matrix.platform.target }} | |
| run: | | |
| ./scripts/cli/package-windows.ps1 -Version $env:VERSION -Target $env:TARGET | |
| - name: Sign CLI archive and checksum (macOS) | |
| if: runner.os == 'macOS' | |
| shell: bash | |
| env: | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| bash scripts/sign-release-assets.sh \ | |
| "${{ steps.stage.outputs.archive }}" \ | |
| "${{ steps.stage.outputs.checksum }}" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: bitfun-cli-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }} | |
| if-no-files-found: error | |
| path: | | |
| ${{ steps.stage.outputs.archive || steps.stage-windows.outputs.archive }} | |
| ${{ steps.stage.outputs.checksum || steps.stage-windows.outputs.checksum }} | |
| bitfun-cli-*.tar.gz.sig | |
| bitfun-cli-*.tar.gz.sha256.sig | |
| # ── Aggregate and upload to GitHub Release ───────────────────────── | |
| upload-release-assets: | |
| name: Upload Release Assets | |
| needs: [prepare, build] | |
| if: needs.prepare.outputs.upload_to_release == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download CLI artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-cli-${{ needs.prepare.outputs.release_tag }}-* | |
| path: cli-release-assets | |
| merge-multiple: true | |
| - name: List release assets | |
| run: | | |
| echo "CLI release assets:" | |
| find cli-release-assets -type f | sort | |
| - name: Generate SHA256SUMS for macOS and Windows archives | |
| working-directory: cli-release-assets | |
| run: | | |
| set -euo pipefail | |
| # Scope note: Linux archives are published by linux-binaries.yml in a | |
| # different workflow run that finishes after this one, so they cannot | |
| # be folded in here deterministically. Every archive on the release — | |
| # Linux included — still ships its own `<archive>.sha256` sidecar, which | |
| # is the complete and uniform verification surface. Keep this file's | |
| # contents deterministic rather than dependent on cross-workflow timing. | |
| mapfile -t archives < <( | |
| find . -maxdepth 1 -type f \ | |
| \( -name 'bitfun-cli-*.tar.gz' -o -name 'bitfun-cli-*.zip' \) \ | |
| -printf '%f\n' | sort | |
| ) | |
| [[ "${#archives[@]}" -gt 0 ]] | |
| sha256sum "${archives[@]}" > SHA256SUMS | |
| echo "---- SHA256SUMS ----" | |
| cat SHA256SUMS | |
| - name: Upload to release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ needs.prepare.outputs.release_tag }} | |
| files: | | |
| cli-release-assets/bitfun-cli-*.tar.gz | |
| cli-release-assets/bitfun-cli-*.tar.gz.sha256 | |
| cli-release-assets/bitfun-cli-*.tar.gz.sig | |
| cli-release-assets/bitfun-cli-*.tar.gz.sha256.sig | |
| cli-release-assets/bitfun-cli-*.zip | |
| cli-release-assets/bitfun-cli-*.zip.sha256 | |
| cli-release-assets/SHA256SUMS | |
| fail_on_unmatched_files: true | |
| # This post-publication dispatch only proves that GitHub accepted the | |
| # notification. The external tap owns formula rollout and readback. | |
| - name: Notify homebrew-tap (post-publication) | |
| env: | |
| GH_TOKEN: ${{ secrets.HOMEBREW_TAP_DISPATCH_TOKEN }} | |
| RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }} | |
| OFFICIAL_REPOSITORY: ${{ github.repository == 'GCWing/BitFun' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${GH_TOKEN}" ]]; then | |
| if [[ "${OFFICIAL_REPOSITORY}" == "true" ]]; then | |
| echo "::error::HOMEBREW_TAP_DISPATCH_TOKEN is required for the official post-publication notification." | |
| exit 1 | |
| fi | |
| echo "HOMEBREW_TAP_DISPATCH_TOKEN not set on fork; skipping tap dispatch." | |
| exit 0 | |
| fi | |
| echo "Dispatching bitfun-release-published for ${RELEASE_TAG} to GCWing/homebrew-tap" | |
| PAYLOAD="$(jq -cn --arg tag_name "${RELEASE_TAG}" '{ | |
| event_type: "bitfun-release-published", | |
| client_payload: { | |
| tag_name: $tag_name, | |
| primary_binary: "bitfun", | |
| deprecated_binary: "bitfun-cli", | |
| deprecated: true | |
| } | |
| }')" | |
| curl -fsSL -X POST \ | |
| -H "Authorization: Bearer ${GH_TOKEN}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| -H "X-GitHub-Api-Version: 2022-11-28" \ | |
| https://api.github.com/repos/GCWing/homebrew-tap/dispatches \ | |
| -d "$PAYLOAD" |