mirror of
https://github.com/bee-san/RustScan.git
synced 2026-11-07 09:46:04 -10:00
ci: upload build artifacts to GitHub releases (#858)
Build release archives with houseabsolute/actions-rust-release and publish them (plus the .deb and checksums) to the GitHub release when a tag is pushed. CD now runs on pushes to master and tags only. Also: read-only default workflow token (publish job gets contents: write), third-party actions pinned to release SHAs, fail on unmatched release assets, and the disabled trigger-less dependabot auto-merge workflow is removed. Fixes #700, fixes #801. Co-authored-by: Autumn Skerritt <[email protected]>
This commit is contained in:
Brad CowieandAutumn Skerritt authored and GitHub committed
1 parent
111316f446
commit
8b143f8ad7
2 files changed
+77
-69
No files matched your search
+77
-55
@@ -1,13 +1,22 @@
|
||||
name: CD Pipeline
|
||||
|
||||
on: [push]
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- "master"
|
||||
tags:
|
||||
- "*"
|
||||
|
||||
# Build jobs only need to read the repository. The publish job below is the
|
||||
# only job that gets write access, and it only runs for tag pushes.
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build-nix:
|
||||
env:
|
||||
IN_PIPELINE: true
|
||||
runs-on: ${{ matrix.os }}
|
||||
if: github.ref == 'refs/heads/master'
|
||||
strategy:
|
||||
matrix:
|
||||
type: [ubuntu-x64, ubuntu-x86, armv7, aarch64]
|
||||
@@ -39,28 +48,23 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
- name: Cache cargo & target directories
|
||||
uses: Swatinem/rust-cache@v2
|
||||
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
- name: Build binary
|
||||
uses: houseabsolute/actions-rust-cross@v1
|
||||
uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
|
||||
with:
|
||||
command: build
|
||||
target: ${{ matrix.target }}
|
||||
args: "--locked --release"
|
||||
strip: true
|
||||
toolchain: stable
|
||||
- name: Build tar.gz for homebrew installs
|
||||
if: matrix.type == 'ubuntu-x64'
|
||||
run: |
|
||||
tar czf ${{ matrix.name }}.tar.gz -C target/x86_64-unknown-linux-musl/release rustscan
|
||||
- uses: actions/upload-artifact@v7
|
||||
- name: Package and upload artifacts
|
||||
uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
|
||||
with:
|
||||
name: ${{ matrix.name }}
|
||||
path: ${{ matrix.path }}
|
||||
- uses: actions/upload-artifact@v7
|
||||
if: matrix.type == 'ubuntu-x64'
|
||||
with:
|
||||
name: ${{ matrix.name }}.tar.gz
|
||||
path: ${{ matrix.name }}.tar.gz
|
||||
executable-name: rustscan
|
||||
target: ${{ matrix.target }}
|
||||
archive-name: ${{ matrix.name }}
|
||||
changes-file: ""
|
||||
|
||||
build-deb:
|
||||
needs: [build-nix]
|
||||
runs-on: ubuntu-latest
|
||||
@@ -70,7 +74,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
- name: Install cargo-deb
|
||||
run: cargo install -f cargo-deb
|
||||
- uses: awalsh128/cache-apt-pkgs-action@v1
|
||||
- uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
|
||||
with:
|
||||
packages: musl-tools # provides musl-gcc
|
||||
version: 1.0
|
||||
@@ -88,65 +92,54 @@ jobs:
|
||||
env:
|
||||
IN_PIPELINE: true
|
||||
runs-on: macos-latest
|
||||
if: github.ref == 'refs/heads/master'
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
- name: Cache cargo & target directories
|
||||
uses: Swatinem/rust-cache@v2
|
||||
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
- name: Build binary
|
||||
uses: houseabsolute/actions-rust-cross@v1
|
||||
uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
|
||||
with:
|
||||
command: build
|
||||
target: x86_64-apple-darwin
|
||||
args: "--locked --release"
|
||||
strip: true
|
||||
toolchain: stable
|
||||
- name: Build tar.gz for homebrew installs
|
||||
run: |
|
||||
tar czf x86_64-macos-rustscan.tar.gz -C target/x86_64-apple-darwin/release rustscan
|
||||
- uses: actions/upload-artifact@v7
|
||||
- name: Package and upload artifacts
|
||||
uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
|
||||
with:
|
||||
name: x86_64-macos-rustscan
|
||||
path: target/x86_64-apple-darwin/release/rustscan
|
||||
- uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: x86_64-macos-rustscan.tar.gz
|
||||
path: x86_64-macos-rustscan.tar.gz
|
||||
|
||||
executable-name: rustscan
|
||||
target: x86_64-apple-darwin
|
||||
archive-name: x86_64-macos-rustscan
|
||||
changes-file: ""
|
||||
|
||||
build-macos-aarch64:
|
||||
env:
|
||||
IN_PIPELINE: true
|
||||
runs-on: macos-latest
|
||||
if: github.ref == 'refs/heads/master'
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
- name: Cache cargo & target directories
|
||||
uses: Swatinem/rust-cache@v2
|
||||
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
- name: Build binary
|
||||
uses: houseabsolute/actions-rust-cross@v1
|
||||
uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
|
||||
with:
|
||||
command: build
|
||||
target: aarch64-apple-darwin
|
||||
args: "--locked --release"
|
||||
strip: true
|
||||
toolchain: stable
|
||||
- name: Build tar.gz for homebrew installs
|
||||
run: |
|
||||
tar czf aarch64-macos-rustscan.tar.gz -C target/aarch64-apple-darwin/release rustscan
|
||||
- uses: actions/upload-artifact@v7
|
||||
- name: Package and upload artifacts
|
||||
uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
|
||||
with:
|
||||
name: aarch64-macos-rustscan
|
||||
path: target/aarch64-apple-darwin/release/rustscan
|
||||
- uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: aarch64-macos-rustscan.tar.gz
|
||||
path: aarch64-macos-rustscan.tar.gz
|
||||
executable-name: rustscan
|
||||
target: aarch64-apple-darwin
|
||||
archive-name: aarch64-macos-rustscan
|
||||
changes-file: ""
|
||||
|
||||
build-windows:
|
||||
env:
|
||||
IN_PIPELINE: true
|
||||
runs-on: ${{ matrix.os }}
|
||||
if: github.ref == 'refs/heads/master'
|
||||
strategy:
|
||||
matrix:
|
||||
type: [windows-x64, windows-x86]
|
||||
@@ -154,26 +147,55 @@ jobs:
|
||||
- type: windows-x64
|
||||
os: windows-latest
|
||||
target: x86_64-pc-windows-msvc
|
||||
name: x86_64-windows-rustscan.exe
|
||||
path: target\x86_64-pc-windows-msvc\release\rustscan.exe
|
||||
name: x86_64-windows-rustscan
|
||||
- type: windows-x86
|
||||
os: windows-latest
|
||||
target: i686-pc-windows-msvc
|
||||
name: x86-windows-rustscan.exe
|
||||
path: target\i686-pc-windows-msvc\release\rustscan.exe
|
||||
name: x86-windows-rustscan
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
- name: Cache cargo & target directories
|
||||
uses: Swatinem/rust-cache@v2
|
||||
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
- name: Build binary
|
||||
uses: houseabsolute/actions-rust-cross@v1
|
||||
uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
|
||||
with:
|
||||
command: build
|
||||
target: ${{ matrix.target }}
|
||||
target: ${{ matrix.target }}
|
||||
args: "--locked --release"
|
||||
strip: true
|
||||
toolchain: stable
|
||||
- uses: actions/upload-artifact@v7
|
||||
- name: Package and upload artifacts
|
||||
uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
|
||||
with:
|
||||
name: ${{ matrix.name }}
|
||||
path: ${{ matrix.path }}
|
||||
executable-name: rustscan
|
||||
target: ${{ matrix.target }}
|
||||
archive-name: ${{ matrix.name }}
|
||||
changes-file: ""
|
||||
|
||||
# Runs only for tag pushes (tags can only be created by maintainers), and
|
||||
# only after every build job succeeded, so a release never ships partially.
|
||||
publish:
|
||||
if: github.ref_type == 'tag'
|
||||
needs:
|
||||
- build-nix
|
||||
- build-deb
|
||||
- build-macos
|
||||
- build-macos-aarch64
|
||||
- build-windows
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write # create the release / upload release assets
|
||||
steps:
|
||||
- name: Download build artifacts
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
merge-multiple: true
|
||||
- name: Publish artifacts to GitHub release
|
||||
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
|
||||
with:
|
||||
fail_on_unmatched_files: true
|
||||
files: |
|
||||
*.deb
|
||||
*.sha256
|
||||
*.tar.gz
|
||||
*.zip
|
||||
@@ -1,14 +0,0 @@
|
||||
name: Dependabot Auto-Merge
|
||||
|
||||
jobs:
|
||||
dependabot:
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.actor == 'dependabot[bot]' }}
|
||||
steps:
|
||||
- name: Enable auto-merge for Dependabot PRs
|
||||
run: |
|
||||
gh pr review --approve "$PR_URL"
|
||||
gh pr merge --auto --merge "$PR_URL"
|
||||
env:
|
||||
PR_URL: ${{ github.event.pull_request.html_url }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
Reference in new issue
Block a user