release #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist | |
| # | |
| # Copyright 2022-2024, axodotdev | |
| # SPDX-License-Identifier: MIT or Apache-2.0 | |
| # | |
| # CI that: | |
| # | |
| # * checks for a Git Tag that looks like a release | |
| # * builds artifacts with dist (archives, installers, hashes) | |
| # * uploads those artifacts to temporary workflow zip | |
| # * on success, uploads the artifacts to a GitHub Release | |
| # | |
| # Note that the GitHub Release will be created with a generated | |
| # title/body based on your changelogs. | |
| name: Release | |
| permissions: | |
| "contents": "read" | |
| env: | |
| CARGO_DIST_VERSION: "0.32.0" | |
| CARGO_DIST_PLAN_SHA256: "eb52f9fae0d0506774e9f1801c1168f87fa2c87a45e2d64d3ae7c89401929946" | |
| # Repository dispatch always loads this workflow from the default branch. Its payload accepts | |
| # `dry-run` or an exact SemVer release tag. | |
| on: | |
| repository_dispatch: | |
| types: [release] | |
| jobs: | |
| # Run 'dist plan' (or host) to determine what tasks we need to do | |
| plan: | |
| runs-on: "ubuntu-22.04" | |
| outputs: | |
| tag: ${{ steps.release.outputs.tag }} | |
| commit: ${{ steps.release.outputs.commit }} | |
| publishing: ${{ steps.release.outputs.publishing }} | |
| dry_run: ${{ steps.release.outputs.dry_run }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Validate release tag | |
| id: release | |
| shell: bash | |
| env: | |
| WORKFLOW_REF: ${{ github.ref }} | |
| INPUT_TAG: ${{ github.event.client_payload.tag || '' }} | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| run: | | |
| set -euo pipefail | |
| tag_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$' | |
| if [[ -z "$INPUT_TAG" ]]; then | |
| { | |
| echo "tag=" | |
| echo "commit=$GITHUB_SHA" | |
| echo "publishing=false" | |
| echo "dry_run=false" | |
| } >> "$GITHUB_OUTPUT" | |
| elif [[ "$INPUT_TAG" == "dry-run" ]]; then | |
| if [[ "$WORKFLOW_REF" != "refs/heads/$DEFAULT_BRANCH" ]]; then | |
| echo "Dry runs must execute the default-branch workflow." >&2 | |
| exit 1 | |
| fi | |
| { | |
| echo "tag=" | |
| echo "commit=$GITHUB_SHA" | |
| echo "publishing=false" | |
| echo "dry_run=true" | |
| } >> "$GITHUB_OUTPUT" | |
| elif [[ "$INPUT_TAG" =~ $tag_pattern ]]; then | |
| if [[ "$WORKFLOW_REF" != "refs/heads/$DEFAULT_BRANCH" ]]; then | |
| echo "Publishing must execute the default-branch workflow." >&2 | |
| exit 1 | |
| fi | |
| git fetch --force --tags origin | |
| git fetch --no-tags origin "+refs/heads/${DEFAULT_BRANCH}:refs/remotes/origin/${DEFAULT_BRANCH}" | |
| release_commit="$(git rev-parse --verify "refs/tags/${INPUT_TAG}^{commit}")" | |
| if ! git merge-base --is-ancestor "$release_commit" "refs/remotes/origin/$DEFAULT_BRANCH"; then | |
| echo "Release tag $INPUT_TAG is not reachable from $DEFAULT_BRANCH." >&2 | |
| exit 1 | |
| fi | |
| git checkout --detach "$release_commit" | |
| { | |
| echo "tag=$INPUT_TAG" | |
| echo "commit=$release_commit" | |
| echo "publishing=true" | |
| echo "dry_run=false" | |
| } >> "$GITHUB_OUTPUT" | |
| else | |
| echo "Invalid release tag. Expected dry-run or vMAJOR.MINOR.PATCH with optional SemVer prerelease/build metadata." >&2 | |
| exit 1 | |
| fi | |
| - name: Install dist | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| target="x86_64-unknown-linux-gnu" | |
| archive="$RUNNER_TEMP/cargo-dist-${target}.tar.xz" | |
| extracted="$RUNNER_TEMP/cargo-dist-plan" | |
| curl --proto '=https' --tlsv1.2 -LsSf "https://github.com/axodotdev/cargo-dist/releases/download/v${CARGO_DIST_VERSION}/cargo-dist-${target}.tar.xz" -o "$archive" | |
| actual_sha256="$(sha256sum "$archive" | awk '{print $1}')" | |
| if [[ "$actual_sha256" != "$CARGO_DIST_PLAN_SHA256" ]]; then | |
| echo "cargo-dist archive checksum mismatch" >&2 | |
| exit 1 | |
| fi | |
| mkdir -p "$extracted" "$HOME/.cargo/bin" | |
| tar -xJf "$archive" -C "$extracted" | |
| install -m 0755 "$extracted/cargo-dist-${target}/dist" "$HOME/.cargo/bin/dist" | |
| dist --version | |
| - name: Cache dist | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/dist | |
| - id: plan | |
| shell: bash | |
| env: | |
| RELEASE_TAG: ${{ steps.release.outputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -n "$RELEASE_TAG" ]]; then | |
| dist host --steps=create "--tag=$RELEASE_TAG" --output-format=json > plan-dist-manifest.json | |
| else | |
| dist plan --output-format=json > plan-dist-manifest.json | |
| fi | |
| echo "dist ran successfully" | |
| cat plan-dist-manifest.json | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: artifacts-plan-dist-manifest | |
| path: plan-dist-manifest.json | |
| # Build and packages all the platform-specific things | |
| build-local-artifacts: | |
| name: build-local-artifacts (${{ matrix.target }}) | |
| needs: | |
| - plan | |
| if: ${{ github.event_name == 'repository_dispatch' && (needs.plan.outputs.publishing == 'true' || needs.plan.outputs.dry_run == 'true') }} | |
| environment: release | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: macos-14 | |
| target: aarch64-apple-darwin | |
| dist_host: aarch64-apple-darwin | |
| dist_sha256: aa343b2ff78ec2981f17a65140250c5ad6062c74072163f68c5c2686d94763a7 | |
| - runner: ubuntu-22.04-arm | |
| target: aarch64-unknown-linux-musl | |
| dist_host: aarch64-unknown-linux-gnu | |
| dist_sha256: d29bcffeb3f8b0c517b4ce0dd2470926ed5cb0bb29d78c6bdd5f88d76ee14a6a | |
| - runner: macos-15-intel | |
| target: x86_64-apple-darwin | |
| dist_host: x86_64-apple-darwin | |
| dist_sha256: 6243464a8389e006b9256ee548bc795638f1a17113c1b6669c0e05ce89fd05c5 | |
| - runner: windows-2022 | |
| target: x86_64-pc-windows-msvc | |
| dist_host: x86_64-pc-windows-msvc | |
| dist_sha256: 26e845cabff12a92911ce960af73a86c8f9b2b2d9072b01dfe5b662acf044fa3 | |
| - runner: ubuntu-22.04 | |
| target: x86_64-unknown-linux-musl | |
| dist_host: x86_64-unknown-linux-gnu | |
| dist_sha256: eb52f9fae0d0506774e9f1801c1168f87fa2c87a45e2d64d3ae7c89401929946 | |
| runs-on: ${{ matrix.runner }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/${{ matrix.target }}-dist-manifest.json | |
| steps: | |
| - name: enable windows longpaths | |
| run: | | |
| git config --global core.longpaths true | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| ref: ${{ needs.plan.outputs.commit }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: "Require macOS signing credentials" | |
| if: "runner.os == 'macOS'" | |
| run: | | |
| missing=() | |
| for name in CODESIGN_CERTIFICATE CODESIGN_CERTIFICATE_PASSWORD CODESIGN_IDENTITY; do | |
| if [ -z "${!name:-}" ]; then | |
| missing+=("$name") | |
| fi | |
| done | |
| if [ "${#missing[@]}" -ne 0 ]; then | |
| printf 'Missing required macOS signing secrets: %s\n' "${missing[*]}" >&2 | |
| exit 1 | |
| fi | |
| echo "CODESIGN_OPTIONS=runtime" >> "$GITHUB_ENV" | |
| shell: "bash" | |
| env: | |
| "CODESIGN_CERTIFICATE": "${{ secrets.CODESIGN_CERTIFICATE }}" | |
| "CODESIGN_CERTIFICATE_PASSWORD": "${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}" | |
| "CODESIGN_IDENTITY": "${{ secrets.CODESIGN_IDENTITY }}" | |
| - name: Install dist (Unix) | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| env: | |
| DIST_HOST: ${{ matrix.dist_host }} | |
| DIST_SHA256: ${{ matrix.dist_sha256 }} | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/cargo-dist-${DIST_HOST}.tar.xz" | |
| extracted="$RUNNER_TEMP/cargo-dist-local" | |
| curl --proto '=https' --tlsv1.2 -LsSf "https://github.com/axodotdev/cargo-dist/releases/download/v${CARGO_DIST_VERSION}/cargo-dist-${DIST_HOST}.tar.xz" -o "$archive" | |
| if command -v sha256sum >/dev/null 2>&1; then | |
| actual_sha256="$(sha256sum "$archive" | awk '{print $1}')" | |
| else | |
| actual_sha256="$(shasum -a 256 "$archive" | awk '{print $1}')" | |
| fi | |
| if [[ "$actual_sha256" != "$DIST_SHA256" ]]; then | |
| echo "cargo-dist archive checksum mismatch" >&2 | |
| exit 1 | |
| fi | |
| mkdir -p "$extracted" "$HOME/.cargo/bin" | |
| tar -xJf "$archive" -C "$extracted" | |
| install -m 0755 "$extracted/cargo-dist-${DIST_HOST}/dist" "$HOME/.cargo/bin/dist" | |
| dist --version | |
| - name: Install dist (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| env: | |
| DIST_HOST: ${{ matrix.dist_host }} | |
| DIST_SHA256: ${{ matrix.dist_sha256 }} | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $archive = Join-Path $env:RUNNER_TEMP "cargo-dist-$($env:DIST_HOST).zip" | |
| $extracted = Join-Path $env:RUNNER_TEMP "cargo-dist-local" | |
| $uri = "https://github.com/axodotdev/cargo-dist/releases/download/v$($env:CARGO_DIST_VERSION)/cargo-dist-$($env:DIST_HOST).zip" | |
| Invoke-WebRequest -Uri $uri -OutFile $archive | |
| $actualSha256 = (Get-FileHash -Path $archive -Algorithm SHA256).Hash.ToLowerInvariant() | |
| if ($actualSha256 -ne $env:DIST_SHA256) { | |
| throw "cargo-dist archive checksum mismatch" | |
| } | |
| Expand-Archive -Path $archive -DestinationPath $extracted | |
| $cargoBin = Join-Path $env:USERPROFILE ".cargo\bin" | |
| New-Item -ItemType Directory -Force -Path $cargoBin | Out-Null | |
| Copy-Item -Force -Path (Join-Path $extracted "dist.exe") -Destination (Join-Path $cargoBin "dist.exe") | |
| & (Join-Path $cargoBin "dist.exe") --version | |
| # Get the dist-manifest | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - name: Install Linux build dependencies | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install --yes musl-tools | |
| - name: Build artifacts | |
| shell: bash | |
| env: | |
| RELEASE_TAG: ${{ needs.plan.outputs.tag }} | |
| RELEASE_COMMIT: ${{ needs.plan.outputs.commit }} | |
| DIST_TARGET: ${{ matrix.target }} | |
| CODESIGN_CERTIFICATE: ${{ runner.os == 'macOS' && secrets.CODESIGN_CERTIFICATE || '' }} | |
| CODESIGN_CERTIFICATE_PASSWORD: ${{ runner.os == 'macOS' && secrets.CODESIGN_CERTIFICATE_PASSWORD || '' }} | |
| CODESIGN_IDENTITY: ${{ runner.os == 'macOS' && secrets.CODESIGN_IDENTITY || '' }} | |
| run: | | |
| set -euo pipefail | |
| case "$DIST_TARGET" in | |
| aarch64-apple-darwin|x86_64-apple-darwin|aarch64-unknown-linux-musl|x86_64-unknown-linux-musl|x86_64-pc-windows-msvc) ;; | |
| *) | |
| echo "Unexpected dist target: $DIST_TARGET" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| dist_args=("--artifacts=local" "--target=$DIST_TARGET") | |
| if [[ -n "$RELEASE_TAG" ]]; then | |
| git fetch --force --tags origin | |
| current_tag_commit="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")" | |
| if [[ "$current_tag_commit" != "$RELEASE_COMMIT" ]]; then | |
| echo "Release tag moved after validation." >&2 | |
| exit 1 | |
| fi | |
| fi | |
| # Actually do builds and make zips and whatnot | |
| if [[ -n "$RELEASE_TAG" ]]; then | |
| dist build "--tag=$RELEASE_TAG" --print=linkage --output-format=json "${dist_args[@]}" > dist-manifest.json | |
| else | |
| dist build --print=linkage --output-format=json "${dist_args[@]}" > dist-manifest.json | |
| fi | |
| echo "dist ran successfully" | |
| - id: cargo-dist | |
| name: Post-build | |
| # We force bash here just because github makes it really hard to get values up | |
| # to "real" actions without writing to env-vars, and writing to env-vars has | |
| # inconsistent syntax between shell and powershell. | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| # Parse out what we just built and upload it to scratch storage | |
| { | |
| echo "paths<<EOF" | |
| dist print-upload-files-from-manifest --manifest dist-manifest.json | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: artifacts-build-local-${{ matrix.target }} | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| # Build and package all the platform-agnostic(ish) things | |
| build-global-artifacts: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| if: ${{ github.event_name == 'repository_dispatch' && (needs.plan.outputs.publishing == 'true' || needs.plan.outputs.dry_run == 'true') }} | |
| runs-on: "ubuntu-22.04" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| ref: ${{ needs.plan.outputs.commit }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| # Get all the local artifacts for the global tasks to use (for e.g. checksums) | |
| - name: Fetch local artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: cargo-dist | |
| shell: bash | |
| env: | |
| RELEASE_TAG: ${{ needs.plan.outputs.tag }} | |
| RELEASE_COMMIT: ${{ needs.plan.outputs.commit }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -n "$RELEASE_TAG" ]]; then | |
| git fetch --force --tags origin | |
| current_tag_commit="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")" | |
| if [[ "$current_tag_commit" != "$RELEASE_COMMIT" ]]; then | |
| echo "Release tag moved after validation." >&2 | |
| exit 1 | |
| fi | |
| dist build "--tag=$RELEASE_TAG" --output-format=json "--artifacts=global" > dist-manifest.json | |
| else | |
| dist build --output-format=json "--artifacts=global" > dist-manifest.json | |
| fi | |
| echo "dist ran successfully" | |
| # Parse out what we just built and upload it to scratch storage | |
| { | |
| echo "paths<<EOF" | |
| jq --raw-output ".upload_files[]" dist-manifest.json | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| cp dist-manifest.json "$BUILD_MANIFEST_NAME" | |
| - name: "Upload artifacts" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: artifacts-build-global | |
| path: | | |
| ${{ steps.cargo-dist.outputs.paths }} | |
| ${{ env.BUILD_MANIFEST_NAME }} | |
| custom-notarize-macos: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| if: ${{ github.event_name == 'repository_dispatch' && (needs.plan.outputs.publishing == 'true' || needs.plan.outputs.dry_run == 'true') }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| secrets: | |
| APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }} | |
| APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} | |
| APPLE_NOTARY_PRIVATE_KEY: ${{ secrets.APPLE_NOTARY_PRIVATE_KEY }} | |
| uses: ./.github/workflows/notarize-macos.yml | |
| # Determines if we should publish/announce | |
| host: | |
| needs: | |
| - plan | |
| - build-local-artifacts | |
| - build-global-artifacts | |
| - custom-notarize-macos | |
| # Publishing requires every build and notarization prerequisite to complete successfully. | |
| if: ${{ always() && github.event_name == 'repository_dispatch' && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && needs.build-local-artifacts.result == 'success' && needs.build-global-artifacts.result == 'success' && needs.custom-notarize-macos.result == 'success' }} | |
| environment: release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| runs-on: "ubuntu-22.04" | |
| permissions: | |
| "attestations": "write" | |
| "contents": "write" | |
| "id-token": "write" | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| ref: ${{ needs.plan.outputs.commit }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Install cached dist | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: cargo-dist-cache | |
| path: ~/.cargo/bin/ | |
| - run: chmod +x ~/.cargo/bin/dist | |
| # Fetch artifacts from scratch-storage | |
| - name: Fetch artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: artifacts-* | |
| path: target/distrib/ | |
| merge-multiple: true | |
| - id: host | |
| shell: bash | |
| env: | |
| RELEASE_TAG: ${{ needs.plan.outputs.tag }} | |
| RELEASE_COMMIT: ${{ needs.plan.outputs.commit }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "$RELEASE_TAG" || -z "$RELEASE_COMMIT" ]]; then | |
| echo "Validated release tag or commit is missing" >&2 | |
| exit 1 | |
| fi | |
| git fetch --force --tags origin | |
| current_tag_commit="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")" | |
| if [[ "$current_tag_commit" != "$RELEASE_COMMIT" ]]; then | |
| echo "Release tag moved after validation." >&2 | |
| exit 1 | |
| fi | |
| dist host "--tag=$RELEASE_TAG" --steps=upload --steps=release --output-format=json > dist-manifest.json | |
| echo "artifacts uploaded and released successfully" | |
| cat dist-manifest.json | |
| echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT" | |
| - name: "Upload dist-manifest.json" | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| # Overwrite the previous copy | |
| name: artifacts-dist-manifest | |
| path: dist-manifest.json | |
| # Create a GitHub Release while uploading all files to it | |
| - name: "Download GitHub Artifacts" | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: artifacts-* | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Cleanup | |
| run: | | |
| # Remove the granular manifests | |
| rm -f artifacts/*-dist-manifest.json | |
| - name: Attest | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 | |
| with: | |
| subject-path: | | |
| artifacts/* | |
| - name: Create GitHub Release | |
| env: | |
| RELEASE_TAG: "${{ needs.plan.outputs.tag }}" | |
| PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}" | |
| ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}" | |
| ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}" | |
| RELEASE_COMMIT: "${{ needs.plan.outputs.commit }}" | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "$RELEASE_TAG" ]]; then | |
| echo "Validated release tag is missing" >&2 | |
| exit 1 | |
| fi | |
| # Write and read notes from a file to avoid quoting breaking things | |
| printf '%s\n' "$ANNOUNCEMENT_BODY" > "$RUNNER_TEMP/notes.txt" | |
| if [[ "$PRERELEASE_FLAG" == "--prerelease" ]]; then | |
| gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" --prerelease --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/* | |
| elif [[ -z "$PRERELEASE_FLAG" ]]; then | |
| gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/* | |
| else | |
| echo "Invalid prerelease flag" >&2 | |
| exit 1 | |
| fi |