Release 0.8.2 (#450) #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| paths: | |
| - cmd/scip/version.txt | |
| jobs: | |
| setup: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.resolve.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main | |
| - id: resolve | |
| run: | | |
| # tr strips CRLF, trailing whitespace, blank lines, etc. | |
| VERSION=$(tr -d '[:space:]' < cmd/scip/version.txt) | |
| if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::cmd/scip/version.txt ($VERSION) must be MAJOR.MINOR.PATCH" | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| publish: | |
| needs: setup | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| version: ${{ needs.setup.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main | |
| - name: Create and push tags | |
| run: | | |
| TAG="v${{ needs.setup.outputs.version }}" | |
| BINDINGS_TAG="bindings/go/scip/$TAG" | |
| for t in "$TAG" "$BINDINGS_TAG"; do | |
| if git rev-parse "$t" &>/dev/null; then | |
| if [ "$(git rev-parse "$t"^{})" != "$(git rev-parse HEAD)" ]; then | |
| echo "::error::Tag $t exists but points to a different commit" | |
| exit 1 | |
| fi | |
| echo "Tag $t already exists at HEAD, skipping" | |
| else | |
| git tag "$t" | |
| fi | |
| done | |
| git push origin "$TAG" "$BINDINGS_TAG" 2>/dev/null || echo "Tags already pushed" | |
| - name: Create draft GitHub release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="v${{ needs.setup.outputs.version }}" | |
| if gh release view "$TAG" &>/dev/null; then | |
| DRAFT=$(gh release view "$TAG" --json isDraft -q '.isDraft') | |
| if [ "$DRAFT" = "false" ]; then | |
| echo "::error::Release $TAG is already published" | |
| exit 1 | |
| fi | |
| echo "Draft release $TAG already exists, skipping creation" | |
| exit 0 | |
| fi | |
| { | |
| echo 'Download the CLI for your current platform using:' | |
| echo '' | |
| echo '```bash' | |
| echo 'env \' | |
| echo " TAG=\"$TAG\" \\" | |
| echo ' OS="$(uname -s | tr '"'"'[:upper:]'"'"' '"'"'[:lower:]'"'"')" \' | |
| echo ' ARCH="$(uname -m | sed -e '"'"'s/x86_64/amd64/'"'"')" \' | |
| echo ' bash -c '"'"'curl -L "https://github.com/scip-code/scip/releases/download/$TAG/scip-$OS-$ARCH.tar.gz"'"'"' \' | |
| echo '| tar xzf - scip' | |
| echo '```' | |
| } | gh release create "$TAG" --title "scip $TAG" --generate-notes --draft --notes-file - | |
| release-crate: | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.publish.outputs.version }} | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v14 | |
| with: | |
| use-flakehub: "disabled" | |
| - name: Publish crate | |
| run: | | |
| OUTPUT=$(nix develop -c cargo publish --token '${{ secrets.CRATES_TOKEN }}' 2>&1) && exit 0 | |
| if echo "$OUTPUT" | grep -q "already uploaded"; then | |
| echo "Crate version already published, skipping" | |
| else | |
| echo "$OUTPUT" | |
| exit 1 | |
| fi | |
| working-directory: bindings/rust | |
| publish-haskell-bindings: | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.publish.outputs.version }} | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v14 | |
| with: | |
| use-flakehub: "disabled" | |
| - name: Build sdist | |
| working-directory: bindings/haskell | |
| run: | | |
| nix develop -c cabal check | |
| nix develop -c cabal sdist | |
| - name: Publish to Hackage | |
| uses: haskell-actions/hackage-publish@v1.1 | |
| with: | |
| hackageServer: https://hackage.haskell.org | |
| hackageToken: ${{ secrets.HACKAGE_TOKEN }} | |
| packagesPath: bindings/haskell/dist-newstyle/sdist | |
| publish: true | |
| publish-jvm-bindings: | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| # Maven Central publication with waitUntil=published can block for | |
| # 10-30 min per module while Sonatype mirrors propagate. Two | |
| # sequential deploys (Java then Kotlin, which resolves Java from | |
| # Central) means worst-case ~60 min. | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.publish.outputs.version }} | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: 11 | |
| cache: maven | |
| server-id: central | |
| server-username: MAVEN_USERNAME | |
| server-password: MAVEN_PASSWORD | |
| gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| # scip-kotlin-bindings depends on scip-java-bindings at the same | |
| # version and resolves it from Central, not from this runner. The | |
| # release profile sets waitUntil=published, so the Java step | |
| # blocks until the artifact is live on repo1.maven.org before the | |
| # Kotlin step runs. | |
| - name: Deploy scip-java-bindings to Maven Central | |
| run: mvn -B -ntp -Prelease -f bindings/java/pom.xml deploy | |
| env: | |
| MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }} | |
| MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }} | |
| - name: Deploy scip-kotlin-bindings to Maven Central | |
| run: mvn -B -ntp -Prelease -f bindings/kotlin/pom.xml deploy | |
| env: | |
| MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }} | |
| MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }} | |
| publish-npm: | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # npm trusted-publishing OIDC | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.publish.outputs.version }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| # Trusted publishing needs npm >=11.5.1; Node 22 LTS ships npm 10.x. | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: bindings/typescript/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: bindings/typescript | |
| - name: Build | |
| run: npm run build | |
| working-directory: bindings/typescript | |
| # LICENSE is a symlink in-tree (matches bindings/{haskell,rust}); npm-pack drops symlinks. | |
| - name: Materialize LICENSE for npm pack | |
| run: | | |
| rm -f bindings/typescript/LICENSE | |
| cp LICENSE bindings/typescript/LICENSE | |
| - uses: JS-DevTools/npm-publish@v4 | |
| with: | |
| package: bindings/typescript | |
| access: public | |
| provenance: true | |
| build-go-binaries: | |
| needs: publish | |
| permissions: | |
| contents: write | |
| strategy: | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| goos: linux | |
| goarch: amd64 | |
| asset_name: scip-linux-amd64 | |
| - runner: ubuntu-latest | |
| goos: linux | |
| goarch: arm64 | |
| asset_name: scip-linux-arm64 | |
| - runner: macos-latest | |
| goos: darwin | |
| goarch: arm64 | |
| asset_name: scip-darwin-arm64 | |
| - runner: macos-latest | |
| goos: darwin | |
| goarch: amd64 | |
| asset_name: scip-darwin-amd64 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.publish.outputs.version }} | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - name: Build | |
| env: | |
| CGO_ENABLED: '0' | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| GOWORK: 'off' | |
| run: go build -ldflags '-X main.Reproducible=true' -o scip ./cmd/scip | |
| - name: Package | |
| env: | |
| ASSET: ${{ matrix.asset_name }} | |
| run: | | |
| tar czf "$ASSET.tar.gz" scip LICENSE | |
| sha256sum "$ASSET.tar.gz" > "$ASSET.tar.gz.sha256" 2>/dev/null || \ | |
| shasum -a 256 "$ASSET.tar.gz" > "$ASSET.tar.gz.sha256" | |
| - name: Upload release assets | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ASSET: ${{ matrix.asset_name }} | |
| run: | | |
| TAG="v${{ needs.publish.outputs.version }}" | |
| DRAFT=$(gh release view "$TAG" --json isDraft -q '.isDraft') | |
| if [ "$DRAFT" = "false" ]; then | |
| echo "::error::Release $TAG is already published, refusing to upload" | |
| exit 1 | |
| fi | |
| gh release upload "$TAG" "$ASSET.tar.gz" "$ASSET.tar.gz.sha256" --clobber | |
| finalize-release: | |
| needs: [publish, release-crate, publish-haskell-bindings, build-go-binaries, publish-jvm-bindings, publish-npm] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Mark release as non-draft | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh release edit "v${{ needs.publish.outputs.version }}" --draft=false |