64f91a00d8
* ci(release): add concurrency group to prevent duplicate release builds When two tags are pushed in quick succession, the release workflow could run concurrently, producing corrupted or incomplete GitHub releases. Add a concurrency group scoped to the tag ref so that release runs for the same tag are serialized. cancel-in-progress is set to false to ensure a running release completes rather than being aborted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci(release): serialize all release runs globally Use a constant workflow concurrency group so release publish jobs run one-at-a-time across tags, avoiding cross-tag race conditions. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Will Sarg <12886992+willsarg@users.noreply.github.com>
122 lines
4.4 KiB
YAML
122 lines
4.4 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: write
|
|
id-token: write # Required for cosign keyless signing via OIDC
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
build-release:
|
|
name: Build ${{ matrix.target }}
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 40
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-linux-gnu
|
|
artifact: zeroclaw
|
|
- os: macos-latest
|
|
target: x86_64-apple-darwin
|
|
artifact: zeroclaw
|
|
- os: macos-latest
|
|
target: aarch64-apple-darwin
|
|
artifact: zeroclaw
|
|
- os: windows-latest
|
|
target: x86_64-pc-windows-msvc
|
|
artifact: zeroclaw.exe
|
|
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
|
|
|
|
- name: Build release
|
|
run: cargo build --release --locked --target ${{ matrix.target }}
|
|
|
|
- name: Check binary size (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: |
|
|
SIZE=$(stat -f%z target/${{ matrix.target }}/release/${{ matrix.artifact }} 2>/dev/null || stat -c%s target/${{ matrix.target }}/release/${{ matrix.artifact }})
|
|
echo "Binary size: $((SIZE / 1024 / 1024))MB ($SIZE bytes)"
|
|
if [ "$SIZE" -gt 5242880 ]; then
|
|
echo "::warning::Binary exceeds 5MB target"
|
|
fi
|
|
|
|
- name: Package (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: |
|
|
cd target/${{ matrix.target }}/release
|
|
tar czf ../../../zeroclaw-${{ matrix.target }}.tar.gz ${{ matrix.artifact }}
|
|
|
|
- name: Package (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: |
|
|
cd target/${{ matrix.target }}/release
|
|
7z a ../../../zeroclaw-${{ matrix.target }}.zip ${{ matrix.artifact }}
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
|
with:
|
|
name: zeroclaw-${{ matrix.target }}
|
|
path: zeroclaw-${{ matrix.target }}.*
|
|
retention-days: 7
|
|
|
|
publish:
|
|
name: Publish Release
|
|
needs: build-release
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Generate SHA256 checksums
|
|
run: |
|
|
cd artifacts
|
|
find . -type f \( -name '*.tar.gz' -o -name '*.zip' \) -exec sha256sum {} + | sed 's| \./[^/]*/| |' > SHA256SUMS
|
|
echo "Generated checksums:"
|
|
cat SHA256SUMS
|
|
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
|
|
|
|
- name: Sign artifacts with cosign (keyless)
|
|
run: |
|
|
for file in artifacts/**/*; do
|
|
[ -f "$file" ] || continue
|
|
cosign sign-blob --yes \
|
|
--oidc-issuer=https://token.actions.githubusercontent.com \
|
|
--output-signature="${file}.sig" \
|
|
--output-certificate="${file}.pem" \
|
|
"$file"
|
|
done
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
|
|
with:
|
|
generate_release_notes: true
|
|
files: |
|
|
artifacts/**/*
|
|
artifacts/SHA256SUMS
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|