Repository navigation
fix: topology (#25) #74
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| "on": | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| # The release must not publish while the test gate is red. | |
| check: | |
| if: github.event_name == 'push' | |
| uses: $/.github/workflows/checks.yml | |
| # build_command runs only during a release, so a broken one would surface on main | |
| # with the release already half done. Run it here against the version a release | |
| # would write, without committing, tagging or publishing anything. | |
| build-command: | |
| name: Release build command | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| # The build command comes from the pull request, so hand this job no write | |
| # access and no checkout credential. | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Fetch tags | |
| run: git fetch --tags --force | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| - name: Install the packaging toolchain | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y musl-tools man-db | |
| rustup target add x86_64-unknown-linux-musl | |
| cargo install --locked --version 3.8.0 cargo-deb | |
| cargo install --locked --version 0.21.0 cargo-generate-rpm | |
| uv sync --group dev | |
| # semantic-release releases from main only, so give the pull request that name. | |
| # --patch forces a bump so the build command runs whatever the commits say. | |
| - name: Run the release build without publishing | |
| run: | | |
| git checkout -B main | |
| uv run semantic-release version --patch --no-commit --no-tag --no-push --no-vcs-release | |
| semantic-release: | |
| name: Semantic Release | |
| needs: check | |
| # The release commit is pushed with a token, which starts this workflow again. | |
| if: >- | |
| github.event_name == 'push' | |
| && !startsWith(github.event.head_commit.message, 'chore(release):') | |
| runs-on: ubuntu-latest | |
| # Two merges close together must not race two releases onto the same tag. | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| steps: | |
| # The token is used for the fetch but deliberately not persisted: the later | |
| # cargo install and uv sync steps run third-party code that could read it from | |
| # .git/config. semantic-release pushes with its own token-built remote URL | |
| # (hvcs/github.py remote_url), so it needs no stored credential. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| token: ${{ secrets.RELEASE_TOKEN }} | |
| # actions/checkout fetches with --no-tags, so annotated tag objects can be | |
| # missing even with fetch-tags. Re-fetch so semantic-release can dereference | |
| # them. See https://github.com/actions/checkout/issues/2309 | |
| - name: Fetch tags | |
| run: git fetch --tags --force | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| - name: Install the packaging toolchain | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y musl-tools man-db | |
| rustup target add x86_64-unknown-linux-musl | |
| cargo install --locked --version 3.8.0 cargo-deb | |
| cargo install --locked --version 0.21.0 cargo-generate-rpm | |
| uv sync --group dev | |
| # `version` builds dist/ through build_command and creates the release, but it | |
| # never uploads dist_glob_patterns. Only `publish` does that. Publish the exact new | |
| # tag, because `publish` otherwise defaults to "latest" and would attach the | |
| # packages to the previous release when this run bumped nothing. The package set is | |
| # checked inside build_command, which runs before the tag exists. | |
| - name: Run semantic-release | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_TOKEN }} | |
| run: | | |
| before=$(git describe --tags --abbrev=0 2>/dev/null || echo none) | |
| uv run semantic-release version --changelog --push --vcs-release | |
| after=$(git describe --tags --abbrev=0 2>/dev/null || echo none) | |
| if [ "$after" = "$before" ]; then | |
| echo "No new tag, so there is nothing to publish." | |
| exit 0 | |
| fi | |
| uv run semantic-release publish --tag "$after" |