postil-cli/.github/workflows/release.yml at main · postil-dev/postil-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: Release

on:
  push:
    tags: ["v*"]

jobs:
  validate-tag:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - name: Install admission verifier dependencies
        working-directory: bench
        run: bun install --frozen-lockfile
      - name: Verify embedded model admission
        working-directory: bench
        run: bun run verify-admission --allow-provisional
      - name: Match release tag to package version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          package_version="$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "postil-cli") | .version')"
          test "$RELEASE_TAG" = "v$package_version" || {
            echo "Release tag $RELEASE_TAG does not match Cargo package version v$package_version" >&2
            exit 1
          }

  build:
    needs: validate-tag
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            # musl needs the musl-gcc wrapper/linker from musl-tools (Alpine static build).
            musl: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            # musl support for ARM64 targets Alpine and other musl-libc systems on ARM.
            musl: true
          - target: x86_64-apple-darwin
            # macos-13 (the last plain Intel image) was retired in Dec 2025;
            # macos-15-intel is the designated replacement.
            os: macos-15-intel
          - target: aarch64-apple-darwin
            os: macos-latest
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      # Keyless signing: Sigstore issues a short-lived cert against the
      # workflow's OIDC identity. No private key to store or rotate.
      id-token: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          targets: ${{ matrix.target }}
      - name: Install musl toolchain
        if: matrix.musl
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - run: cargo test --quiet
      # SHA-pinned: this action handles the OIDC token.
      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
      - run: cargo build --quiet --release --target ${{ matrix.target }}
      - name: Package, checksum, and sign
        env:
          COSIGN_YES: "true"
        run: |
          cd target/${{ matrix.target }}/release
          art="postil-${{ matrix.target }}.tar.gz"
          tar czf "$art" postil
          # SHA-256 checksum (corruption / transit integrity).
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "$art" > "$art.sha256"
          else
            shasum -a 256 "$art" > "$art.sha256"
          fi
          # Keyless Sigstore signature + certificate (provenance / authenticity).
          # Verify later with:
          #   cosign verify-blob "$art" --signature "$art.sig" --certificate "$art.pem" \
          #     --certificate-identity "https://github.com/postil-dev/postil-cli/.github/workflows/release.yml@refs/tags/$RELEASE" \
          #     --certificate-github-workflow-sha "$CLI_REF" \
          #     --certificate-oidc-issuer https://token.actions.githubusercontent.com
          cosign sign-blob --yes \
            --output-signature "$art.sig" \
            --output-certificate "$art.pem" \
            "$art"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: release-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/release/postil-${{ matrix.target }}.tar.gz
            target/${{ matrix.target }}/release/postil-${{ matrix.target }}.tar.gz.sha256
            target/${{ matrix.target }}/release/postil-${{ matrix.target }}.tar.gz.sig
            target/${{ matrix.target }}/release/postil-${{ matrix.target }}.tar.gz.pem
          if-no-files-found: error
          retention-days: 1

  # Single fan-in publisher: six matrix legs racing to create the same
  # release is a known 422 flake in action-gh-release.
  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: release-*
          merge-multiple: true
          path: dist
      # SHA-pinned: this action publishes the release assets.
      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          files: dist/*
          fail_on_unmatched_files: true