Release #604
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| crate: | |
| description: "rust crate to be built into a bin and packaged into a debian pkg" | |
| required: true | |
| type: string | |
| build_aarch64: | |
| description: "Build for aarch64" | |
| type: boolean | |
| default: true | |
| build_x86_64: | |
| description: "Build for x86_64" | |
| type: boolean | |
| default: false | |
| profile: | |
| description: "Cargo build profile" | |
| type: choice | |
| options: | |
| - release | |
| - artifact | |
| default: artifact | |
| env: | |
| CRATE: ${{ inputs.crate }} | |
| BUILD_AARCH64: ${{ inputs.build_aarch64 }} | |
| BUILD_X86_64: ${{ inputs.build_x86_64 }} | |
| PROFILE: ${{ inputs.profile }} | |
| GH_TOKEN: ${{ github.token }} # For gh cli | |
| BRANCH: ${{ github.ref_name }} | |
| jobs: | |
| release-name: | |
| name: Creates the Release Name | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| release-name: ${{ steps.release-name.outputs.CI_RELEASE_NAME }} | |
| steps: | |
| - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3 | |
| - name: Calculate Release Name | |
| id: release-name | |
| run: | | |
| set -Eeuxo pipefail | |
| echo "CI_RELEASE_NAME=${CRATE}/${BRANCH}/${GITHUB_SHA::7}" >>${GITHUB_OUTPUT} | |
| test: | |
| name: Test | |
| runs-on: public-ubuntu-24.04-32core | |
| steps: | |
| - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3 | |
| with: | |
| token: ${{ secrets.ORB_GIT_HUB_TOKEN }} | |
| lfs: true | |
| - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4 | |
| with: | |
| github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }} | |
| - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15 | |
| continue-on-error: true | |
| with: | |
| name: worldcoin | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Authorize private git repos | |
| run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com | |
| - name: Cache cargo dependencies | |
| uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # pin@v2.8.0 | |
| with: | |
| key: custom-${{ hashFiles('**/*.nix', 'flake.lock') }} | |
| - name: Print environment | |
| run: | | |
| uname -a | |
| nix develop -c env | |
| - name: Cargo Test | |
| run: | | |
| set -Eeuxo pipefail | |
| # Get workspace metadata once | |
| METADATA=$(cargo metadata --format-version=1 --no-deps --frozen --offline) | |
| # Get workspace package names as JSON array | |
| WORKSPACE_PKGS=$(echo "${METADATA}" | jq '[.packages[].name]') | |
| # Get dependencies of target crate that are also workspace members | |
| WORKSPACE_DEPS=$(echo "${METADATA}" | jq -r --arg crate "${CRATE}" --argjson ws_pkgs "${WORKSPACE_PKGS}" ' | |
| .packages[] | |
| | select(.name == $crate) | |
| | .dependencies[].name | |
| | select(. as $d | $ws_pkgs | index($d)) | |
| ') | |
| # Build -p flags: target crate + its workspace dependencies | |
| P_FLAGS="-p ${CRATE}" | |
| for dep in ${WORKSPACE_DEPS}; do | |
| P_FLAGS="${P_FLAGS} -p ${dep}" | |
| done | |
| echo "Testing crates: ${P_FLAGS}" | |
| nix develop -c cargo nextest run ${P_FLAGS} --all-features | |
| build: | |
| name: Build | |
| runs-on: public-ubuntu-24.04-32core | |
| steps: | |
| - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3 | |
| with: | |
| token: ${{ secrets.ORB_GIT_HUB_TOKEN }} | |
| lfs: true | |
| - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4 | |
| with: | |
| github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }} | |
| - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15 | |
| continue-on-error: true | |
| with: | |
| name: worldcoin | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Authorize private git repos | |
| run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com | |
| - name: Cache cargo dependencies | |
| uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # pin@v2.8.0 | |
| with: | |
| key: custom-${{ hashFiles('**/*.nix', 'flake.lock') }} | |
| - name: Print environment | |
| run: | | |
| uname -a | |
| nix develop -c env | |
| - name: Build default and create deb | |
| run: | | |
| set -Eeuxo pipefail | |
| mkdir -p artifacts | |
| if [ "${BUILD_AARCH64}" = "true" ]; then | |
| echo "Building for aarch64..." | |
| nix develop -c \ | |
| cargo zigbuild --target aarch64-unknown-linux-gnu --profile ${PROFILE} -p ${CRATE} | |
| nix develop -c \ | |
| cargo deb --no-build --no-strip -p ${CRATE} --target aarch64-unknown-linux-gnu \ | |
| --profile ${PROFILE} -o artifacts/${CRATE}_aarch64.deb | |
| fi | |
| if [ "${BUILD_X86_64}" = "true" ]; then | |
| echo "Building for x86_64..." | |
| nix develop -c \ | |
| cargo zigbuild --target x86_64-unknown-linux-gnu --profile ${PROFILE} -p ${CRATE} | |
| nix develop -c \ | |
| cargo deb --no-build --no-strip -p ${CRATE} --target x86_64-unknown-linux-gnu \ | |
| --profile ${PROFILE} -o artifacts/${CRATE}_x86_64.deb | |
| fi | |
| - name: Build flavors and create debs | |
| run: | | |
| set -Eeuxo pipefail | |
| # Extract flavors from cargo metadata | |
| FLAVORS=$(cargo metadata --format-version=1 --no-deps --frozen --offline \ | |
| | jq -c ".packages[] | select(.name == \"${CRATE}\") | .metadata.orb.flavors // []") | |
| if [ "${FLAVORS}" = "[]" ] || [ -z "${FLAVORS}" ]; then | |
| echo "No flavors defined for ${CRATE}" | |
| exit 0 | |
| fi | |
| echo "Found flavors: ${FLAVORS}" | |
| # Loop through each flavor | |
| echo "${FLAVORS}" | jq -c '.[]' | while read -r flavor; do | |
| NAME=$(echo "${flavor}" | jq -r '.name') | |
| FEATURES=$(echo "${flavor}" | jq -r '.features | join(",")') | |
| echo "Building flavor: ${NAME} with features: ${FEATURES}" | |
| if [ "${BUILD_AARCH64}" = "true" ]; then | |
| nix develop -c \ | |
| cargo zigbuild --target aarch64-unknown-linux-gnu --profile ${PROFILE} -p ${CRATE} \ | |
| --no-default-features --features "${FEATURES}" | |
| nix develop -c \ | |
| cargo deb --no-build --no-strip -p ${CRATE} --target aarch64-unknown-linux-gnu \ | |
| --profile ${PROFILE} -o artifacts/${CRATE}_${NAME}_aarch64.deb | |
| fi | |
| if [ "${BUILD_X86_64}" = "true" ]; then | |
| nix develop -c \ | |
| cargo zigbuild --target x86_64-unknown-linux-gnu --profile ${PROFILE} -p ${CRATE} \ | |
| --no-default-features --features "${FEATURES}" | |
| nix develop -c \ | |
| cargo deb --no-build --no-strip -p ${CRATE} --target x86_64-unknown-linux-gnu \ | |
| --profile ${PROFILE} -o artifacts/${CRATE}_${NAME}_x86_64.deb | |
| fi | |
| done | |
| - name: Compute sha256 checksums | |
| run: | | |
| set -Eeuxo pipefail | |
| cd artifacts | |
| for f in *.deb; do | |
| sha256sum "${f}" > "${f}.sha256" | |
| done | |
| ls -la | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # pin@v4.3.3 | |
| with: | |
| name: debs | |
| path: artifacts/* | |
| if-no-files-found: error | |
| release: | |
| name: Release | |
| runs-on: ubuntu-24.04 | |
| needs: | |
| - release-name | |
| - test | |
| - build | |
| steps: | |
| - name: Download artifacts | |
| uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # pin@v4.1.7 | |
| with: | |
| name: debs | |
| path: artifacts | |
| - name: Create Release | |
| uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # pin@v1 | |
| with: | |
| tag_name: ${{ needs.release-name.outputs.release-name }} | |
| target_commitish: ${{ github.sha }} | |
| fail_on_unmatched_files: true | |
| files: artifacts/* | |
| vuln-scan: | |
| name: Vulnerability Scan | |
| needs: [release] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| uses: ./.github/workflows/cargo-vuln-scan.yaml | |
| with: | |
| platform-tag: orb-software |