Skip to content

Commit c63f546

Browse files
jacderidajacderida
authored
Merge pull request #14 from jacderida/chore-release_process_for_ant
chore: add release process for ant binary and ant-core crate
2 parents f3b9e40 + 743eef6 commit c63f546

13 files changed

Lines changed: 812 additions & 1 deletion

File tree

‎.github/workflows/ant-cli-release.yml‎

Lines changed: 323 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,323 @@
1+
name: ant release
2+
3+
on:
4+
push:
5+
tags:
6+
- "ant-cli-v*"
7+
8+
env:
9+
CARGO_TERM_COLOR: always
10+
11+
permissions:
12+
contents: write
13+
14+
jobs:
15+
build:
16+
name: build (${{ matrix.target }})
17+
runs-on: ${{ matrix.os }}
18+
strategy:
19+
fail-fast: false
20+
matrix:
21+
include:
22+
- os: ubuntu-latest
23+
target: x86_64-unknown-linux-musl
24+
archive: tar.gz
25+
- os: ubuntu-latest
26+
target: aarch64-unknown-linux-musl
27+
archive: tar.gz
28+
- os: macos-latest
29+
target: x86_64-apple-darwin
30+
archive: tar.gz
31+
- os: macos-latest
32+
target: aarch64-apple-darwin
33+
archive: tar.gz
34+
- os: windows-latest
35+
target: x86_64-pc-windows-msvc
36+
archive: zip
37+
steps:
38+
- uses: actions/checkout@v4
39+
40+
- uses: dtolnay/rust-toolchain@stable
41+
with:
42+
targets: ${{ matrix.target }}
43+
44+
- name: install cross-compilation tools
45+
if: matrix.target == 'aarch64-unknown-linux-musl'
46+
run: |
47+
sudo apt-get update
48+
sudo apt-get install -y musl-tools gcc-aarch64-linux-gnu
49+
echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
50+
51+
- name: install musl tools
52+
if: matrix.target == 'x86_64-unknown-linux-musl'
53+
run: |
54+
sudo apt-get update
55+
sudo apt-get install -y musl-tools
56+
57+
- name: build
58+
run: cargo build --release --target ${{ matrix.target }} --bin ant
59+
60+
- name: determine version
61+
id: version
62+
shell: bash
63+
run: |
64+
version=$(grep '^version' ant-cli/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
65+
echo "version=${version}" >> $GITHUB_OUTPUT
66+
67+
- name: package (unix)
68+
if: matrix.archive == 'tar.gz'
69+
shell: bash
70+
run: |
71+
staging="ant-${{ steps.version.outputs.version }}-${{ matrix.target }}"
72+
mkdir "$staging"
73+
cp "target/${{ matrix.target }}/release/ant" "$staging/"
74+
cp "resources/bootstrap_peers.toml" "$staging/"
75+
tar czf "$staging.tar.gz" "$staging"
76+
echo "ASSET=$staging.tar.gz" >> $GITHUB_ENV
77+
78+
- name: package (windows)
79+
if: matrix.archive == 'zip'
80+
shell: bash
81+
run: |
82+
staging="ant-${{ steps.version.outputs.version }}-${{ matrix.target }}"
83+
mkdir "$staging"
84+
cp "target/${{ matrix.target }}/release/ant.exe" "$staging/"
85+
cp "resources/bootstrap_peers.toml" "$staging/"
86+
7z a "$staging.zip" "$staging"
87+
echo "ASSET=$staging.zip" >> $GITHUB_ENV
88+
89+
- uses: actions/upload-artifact@v4
90+
with:
91+
name: ant-${{ matrix.target }}
92+
path: ${{ env.ASSET }}
93+
94+
sign-windows:
95+
name: sign windows binary
96+
runs-on: windows-latest
97+
needs: [build]
98+
env:
99+
SM_HOST: ${{ secrets.SM_HOST }}
100+
SM_API_KEY: ${{ secrets.SM_API_KEY }}
101+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
102+
SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
103+
SM_LOG_LEVEL: trace
104+
SM_LOG_FILE: ${{ github.workspace }}\smctl-signing.log
105+
steps:
106+
- uses: actions/checkout@v4
107+
108+
- uses: actions/download-artifact@v4
109+
with:
110+
name: ant-x86_64-pc-windows-msvc
111+
path: artifacts/
112+
113+
- name: extract binary for signing
114+
shell: bash
115+
run: |
116+
cd artifacts
117+
7z x *.zip
118+
# Find and copy the exe to a known location
119+
find . -name "ant.exe" -exec cp {} ant.exe \;
120+
121+
- name: create client certificate file
122+
id: prepare_cert
123+
shell: pwsh
124+
run: |
125+
$raw = @'
126+
${{ secrets.SM_CLIENT_CERT_B64 }}
127+
'@
128+
129+
$clean = ($raw -replace '\s','')
130+
131+
if ([string]::IsNullOrWhiteSpace($clean)) {
132+
Write-Error "SM_CLIENT_CERT_B64 is empty after normalization."
133+
exit 1
134+
}
135+
136+
try {
137+
$certBytes = [Convert]::FromBase64String($clean)
138+
} catch {
139+
Write-Error "SM_CLIENT_CERT_B64 is not valid Base64."
140+
exit 1
141+
}
142+
143+
$certPath = Join-Path $env:RUNNER_TEMP "Certificate.p12"
144+
[System.IO.File]::WriteAllBytes($certPath, $certBytes)
145+
146+
"SM_CLIENT_CERT_FILE=$certPath" | Out-File -FilePath $env:GITHUB_ENV -Append
147+
"sm_client_cert_b64=$clean" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
148+
149+
- name: setup DigiCert SSM tools
150+
uses: digicert/ssm-code-signing@v1.2.1
151+
with:
152+
sm_host: ${{ secrets.SM_HOST }}
153+
sm_api_key: ${{ secrets.SM_API_KEY }}
154+
sm_client_cert_b64: ${{ steps.prepare_cert.outputs.sm_client_cert_b64 }}
155+
sm_client_cert_password: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
156+
157+
- name: verify smctl installation
158+
shell: pwsh
159+
run: |
160+
smctl -v
161+
smctl healthcheck
162+
163+
- name: sign ant.exe
164+
shell: pwsh
165+
run: |
166+
$file = "artifacts\ant.exe"
167+
$result = & smctl sign --keypair-alias "$env:SM_KEYPAIR_ALIAS" --input "$file" 2>&1
168+
if ($LASTEXITCODE -ne 0) {
169+
Write-Error "Signing failed: $result"
170+
exit 1
171+
}
172+
Write-Host "Successfully signed ant.exe"
173+
174+
- name: verify signature
175+
shell: pwsh
176+
run: |
177+
$sig = Get-AuthenticodeSignature "artifacts\ant.exe"
178+
Write-Host "Status: $($sig.Status)"
179+
Write-Host "Signer: $($sig.SignerCertificate.Subject)"
180+
if ($sig.Status -ne "Valid") {
181+
Write-Error "Signature validation failed"
182+
exit 1
183+
}
184+
185+
- name: repackage signed archive
186+
shell: bash
187+
run: |
188+
version=$(grep '^version' ant-cli/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
189+
staging="ant-${version}-x86_64-pc-windows-msvc"
190+
rm -rf "$staging"
191+
mkdir "$staging"
192+
cp artifacts/ant.exe "$staging/"
193+
cp resources/bootstrap_peers.toml "$staging/"
194+
7z a "$staging.zip" "$staging"
195+
196+
- uses: actions/upload-artifact@v4
197+
with:
198+
name: ant-x86_64-pc-windows-msvc-signed
199+
path: ant-*-x86_64-pc-windows-msvc.zip
200+
201+
- name: upload signing logs on failure
202+
if: failure()
203+
uses: actions/upload-artifact@v4
204+
with:
205+
name: signing-logs
206+
path: ${{ github.workspace }}\smctl-signing.log
207+
if-no-files-found: ignore
208+
209+
publish-crate:
210+
name: publish ant-core to crates.io
211+
runs-on: ubuntu-latest
212+
steps:
213+
- uses: actions/checkout@v4
214+
215+
- uses: dtolnay/rust-toolchain@stable
216+
217+
- name: publish ant-core
218+
working-directory: ant-core
219+
env:
220+
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
221+
run: cargo publish
222+
223+
release:
224+
name: create github release
225+
runs-on: ubuntu-latest
226+
needs: [build, sign-windows, publish-crate]
227+
steps:
228+
- uses: actions/checkout@v4
229+
230+
- name: determine version and prerelease
231+
id: meta
232+
shell: bash
233+
run: |
234+
tag="${GITHUB_REF#refs/tags/}"
235+
version="${tag#ant-cli-v}"
236+
echo "tag=${tag}" >> $GITHUB_OUTPUT
237+
echo "version=${version}" >> $GITHUB_OUTPUT
238+
if [[ "$version" == *"-rc."* ]]; then
239+
echo "prerelease=true" >> $GITHUB_OUTPUT
240+
else
241+
echo "prerelease=false" >> $GITHUB_OUTPUT
242+
fi
243+
244+
- uses: actions/download-artifact@v4
245+
with:
246+
name: ant-x86_64-unknown-linux-musl
247+
path: assets/
248+
- uses: actions/download-artifact@v4
249+
with:
250+
name: ant-aarch64-unknown-linux-musl
251+
path: assets/
252+
- uses: actions/download-artifact@v4
253+
with:
254+
name: ant-x86_64-apple-darwin
255+
path: assets/
256+
- uses: actions/download-artifact@v4
257+
with:
258+
name: ant-aarch64-apple-darwin
259+
path: assets/
260+
- uses: actions/download-artifact@v4
261+
with:
262+
name: ant-x86_64-pc-windows-msvc-signed
263+
path: assets/
264+
265+
- name: extract changelog entry
266+
id: changelog
267+
shell: bash
268+
run: |
269+
# Extract the latest changelog section (between first two ## headers)
270+
changelog=$(awk '/^## \[/{if(found) exit; found=1; next} found' CHANGELOG.md)
271+
# Write to file for the release body
272+
echo "$changelog" > /tmp/changelog_entry.md
273+
274+
- name: generate release body
275+
shell: bash
276+
run: |
277+
version="${{ steps.meta.outputs.version }}"
278+
cat > /tmp/release_body.md << 'HEADER'
279+
## Installation
280+
281+
### Linux / macOS (quick-start)
282+
283+
```bash
284+
curl -fsSL https://raw.githubusercontent.com/WithAutonomi/ant-client/main/install.sh | bash
285+
```
286+
287+
### Manual download
288+
289+
Download the archive for your platform from the assets below, extract it, and place the `ant` binary on your `PATH`. Copy `bootstrap_peers.toml` to the appropriate config directory:
290+
291+
| Platform | Config path |
292+
|----------|-------------|
293+
| Linux | `~/.config/ant/bootstrap_peers.toml` |
294+
| macOS | `~/Library/Application Support/ant/bootstrap_peers.toml` |
295+
| Windows | `%APPDATA%\ant\bootstrap_peers.toml` |
296+
297+
### Windows (winget)
298+
299+
```powershell
300+
winget install Autonomi.ant
301+
```
302+
303+
HEADER
304+
305+
echo "## Detailed Changes" >> /tmp/release_body.md
306+
echo "" >> /tmp/release_body.md
307+
cat /tmp/changelog_entry.md >> /tmp/release_body.md
308+
309+
- name: create github release
310+
env:
311+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
312+
shell: bash
313+
run: |
314+
prerelease_flag=""
315+
if [[ "${{ steps.meta.outputs.prerelease }}" == "true" ]]; then
316+
prerelease_flag="--prerelease"
317+
fi
318+
319+
gh release create "${{ steps.meta.outputs.tag }}" \
320+
--title "ant ${{ steps.meta.outputs.version }}" \
321+
--notes-file /tmp/release_body.md \
322+
$prerelease_flag \
323+
assets/*

‎.github/workflows/ant-core-release.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: ant-core release
2+
3+
on:
4+
push:
5+
tags:
6+
- "ant-core-v*"
7+
8+
env:
9+
CARGO_TERM_COLOR: always
10+
11+
jobs:
12+
publish:
13+
name: publish ant-core to crates.io
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- uses: dtolnay/rust-toolchain@stable
19+
20+
- name: publish ant-core
21+
working-directory: ant-core
22+
env:
23+
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
24+
run: cargo publish

0 commit comments

Comments
 (0)