Skip to content

Commit baa2eb4

Browse files
lyang2821lyang2821
committed
update
1 parent df298b6 commit baa2eb4

8 files changed

Lines changed: 727 additions & 70 deletions

File tree

‎.github/workflows/release-cli.yml‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
name: Release Lapdev CLI
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "Lapdev CLI version (e.g. 0.1.0). Must match Cargo.toml."
8+
required: true
9+
push:
10+
tags:
11+
- "lapdev-cli-v*"
12+
13+
jobs:
14+
prepare:
15+
runs-on: ubuntu-latest
16+
outputs:
17+
version: ${{ steps.vars.outputs.version }}
18+
tag_name: ${{ steps.vars.outputs.tag_name }}
19+
steps:
20+
- uses: actions/checkout@v4
21+
22+
- id: vars
23+
run: |
24+
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
25+
VERSION="${{ github.event.inputs.version }}"
26+
else
27+
VERSION="${GITHUB_REF_NAME#lapdev-cli-v}"
28+
fi
29+
30+
VERSION="${VERSION#v}"
31+
if [[ -z "$VERSION" ]]; then
32+
echo "Unable to determine version" >&2
33+
exit 1
34+
fi
35+
36+
TAG_NAME="lapdev-cli-v${VERSION}"
37+
38+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
39+
echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
40+
41+
- name: Verify Cargo version matches release version
42+
run: |
43+
FILE_VERSION=$(python - <<'PY'
44+
import pathlib, tomllib
45+
data = tomllib.loads(pathlib.Path("Cargo.toml").read_text())
46+
print(data["workspace"]["package"]["version"])
47+
PY
48+
)
49+
if [[ "$FILE_VERSION" != "${{ steps.vars.outputs.version }}" ]]; then
50+
echo "Cargo workspace version ${FILE_VERSION} does not match requested version ${{ steps.vars.outputs.version }}" >&2
51+
exit 1
52+
fi
53+
54+
build:
55+
needs: prepare
56+
strategy:
57+
fail-fast: false
58+
matrix:
59+
include:
60+
- os: ubuntu-22.04
61+
target: x86_64-unknown-linux-gnu
62+
archive: tar.gz
63+
- os: ubuntu-22.04
64+
target: aarch64-unknown-linux-gnu
65+
archive: tar.gz
66+
- os: macos-13
67+
target: x86_64-apple-darwin
68+
archive: tar.gz
69+
- os: macos-14
70+
target: aarch64-apple-darwin
71+
archive: tar.gz
72+
- os: windows-latest
73+
target: x86_64-pc-windows-msvc
74+
archive: zip
75+
- os: windows-latest
76+
target: aarch64-pc-windows-msvc
77+
archive: zip
78+
runs-on: ${{ matrix.os }}
79+
permissions:
80+
contents: read
81+
id-token: write
82+
env:
83+
TARGET: ${{ matrix.target }}
84+
ARCHIVE_NAME: lapdev-cli-${{ matrix.target }}.${{ matrix.archive }}
85+
ARTIFACT_NAME: lapdev-cli-${{ matrix.target }}
86+
steps:
87+
- uses: actions/checkout@v4
88+
with:
89+
fetch-depth: 1
90+
91+
- uses: dtolnay/rust-toolchain@stable
92+
with:
93+
targets: ${{ matrix.target }}
94+
components: "clippy,rustfmt"
95+
96+
- name: Install Linux cross toolchain
97+
if: runner.os == 'Linux' && contains(matrix.target, 'aarch64-unknown-linux-gnu')
98+
run: |
99+
sudo apt-get update
100+
sudo apt-get install --yes gcc-aarch64-linux-gnu
101+
102+
- name: Cargo fetch
103+
run: cargo fetch --locked
104+
if: runner.os != 'Windows'
105+
106+
- name: Cargo fetch (Windows)
107+
if: runner.os == 'Windows'
108+
shell: pwsh
109+
run: cargo fetch --locked
110+
111+
- name: Build (Unix)
112+
if: runner.os != 'Windows'
113+
run: cargo build -p lapdev-cli --release --locked --target "${TARGET}"
114+
115+
- name: Build (Windows)
116+
if: runner.os == 'Windows'
117+
shell: pwsh
118+
run: cargo build -p lapdev-cli --release --locked --target $env:TARGET
119+
120+
- name: Import Apple code signing cert
121+
if: runner.os == 'macOS'
122+
uses: apple-actions/import-codesign-certs@v3
123+
with:
124+
p12-file-base64: ${{ secrets.APPLE_CODESIGN_CERT_BASE64 }}
125+
p12-password: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
126+
127+
- name: Codesign binary (macOS)
128+
if: runner.os == 'macOS'
129+
env:
130+
APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
131+
run: |
132+
codesign --force --timestamp --options runtime --sign "${APPLE_CODESIGN_IDENTITY}" "target/${TARGET}/release/lapdev-cli"
133+
134+
- name: Notarize macOS binary
135+
if: runner.os == 'macOS'
136+
env:
137+
APPLE_ID: ${{ secrets.APPLE_NOTARIZE_APPLE_ID }}
138+
APPLE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_APP_SPECIFIC_PASSWORD }}
139+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
140+
run: |
141+
mkdir -p notarize
142+
cp "target/${TARGET}/release/lapdev-cli" notarize/lapdev
143+
ditto -c -k --keepParent notarize/lapdev notarize.zip
144+
xcrun notarytool submit notarize.zip --apple-id "${APPLE_ID}" --team-id "${APPLE_TEAM_ID}" --password "${APPLE_PASSWORD}" --wait
145+
xcrun stapler staple "target/${TARGET}/release/lapdev-cli"
146+
rm -rf notarize notarize.zip
147+
148+
- name: Sign Windows binary
149+
if: runner.os == 'Windows'
150+
shell: pwsh
151+
env:
152+
WINDOWS_SIGNING_CERT: ${{ secrets.WINDOWS_SIGNING_CERT_BASE64 }}
153+
WINDOWS_SIGNING_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERT_PASSWORD }}
154+
run: |
155+
if (-not $env:WINDOWS_SIGNING_CERT) {
156+
throw "WINDOWS_SIGNING_CERT_BASE64 secret is required"
157+
}
158+
if (-not $env:WINDOWS_SIGNING_CERT_PASSWORD) {
159+
throw "WINDOWS_SIGNING_CERT_PASSWORD secret is required"
160+
}
161+
$pfxPath = Join-Path $env:RUNNER_TEMP "codesign.pfx"
162+
[IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_SIGNING_CERT))
163+
$signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Filter signtool.exe -Recurse | Sort-Object FullName -Descending | Select-Object -First 1
164+
if (-not $signtool) {
165+
throw "signtool.exe not found"
166+
}
167+
& $signtool.FullName sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /f $pfxPath /p $env:WINDOWS_SIGNING_CERT_PASSWORD "target\${env:TARGET}\release\lapdev-cli.exe"
168+
Remove-Item $pfxPath -Force
169+
170+
- name: Prepare artifact (Unix)
171+
if: runner.os != 'Windows'
172+
run: |
173+
BIN="target/${TARGET}/release/lapdev-cli"
174+
install -Dm755 "${BIN}" pack/lapdev
175+
tar -C pack -czf "${ARCHIVE_NAME}" lapdev
176+
177+
- name: Prepare artifact (Windows)
178+
if: runner.os == 'Windows'
179+
shell: pwsh
180+
run: |
181+
$bin = "target\${env:TARGET}\release\lapdev-cli.exe"
182+
New-Item -ItemType Directory -Path pack -Force | Out-Null
183+
Copy-Item $bin "pack\lapdev.exe" -Force
184+
Compress-Archive -Path "pack\lapdev.exe" -DestinationPath $env:ARCHIVE_NAME -Force
185+
186+
- uses: sigstore/cosign-installer@v3.7.0
187+
188+
- name: Sign artifact (Unix)
189+
if: runner.os != 'Windows'
190+
env:
191+
COSIGN_EXPERIMENTAL: "1"
192+
run: |
193+
cosign sign-blob --yes --output-signature "${ARCHIVE_NAME}.sig" --output-certificate "${ARCHIVE_NAME}.pem" "${ARCHIVE_NAME}"
194+
195+
- name: Sign artifact (Windows)
196+
if: runner.os == 'Windows'
197+
shell: pwsh
198+
env:
199+
COSIGN_EXPERIMENTAL: "1"
200+
run: |
201+
cosign sign-blob --yes --output-signature "$env:ARCHIVE_NAME.sig" --output-certificate "$env:ARCHIVE_NAME.pem" "$env:ARCHIVE_NAME"
202+
203+
- uses: actions/upload-artifact@v4
204+
with:
205+
name: ${{ env.ARTIFACT_NAME }}
206+
path: |
207+
${{ env.ARCHIVE_NAME }}
208+
${{ env.ARCHIVE_NAME }}.sig
209+
${{ env.ARCHIVE_NAME }}.pem
210+
211+
publish:
212+
needs: [prepare, build]
213+
runs-on: ubuntu-latest
214+
permissions:
215+
contents: write
216+
steps:
217+
- uses: actions/checkout@v4
218+
219+
- uses: actions/download-artifact@v4
220+
with:
221+
path: release
222+
223+
- name: List artifacts
224+
run: ls -R release
225+
226+
- name: Create GitHub release
227+
env:
228+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
229+
TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
230+
VERSION: ${{ needs.prepare.outputs.version }}
231+
run: |
232+
FILES=()
233+
while IFS= read -r -d '' file; do
234+
FILES+=("$file")
235+
done < <(find release -type f -print0)
236+
237+
if [[ ${#FILES[@]} -eq 0 ]]; then
238+
echo "No artifacts found to upload" >&2
239+
exit 1
240+
fi
241+
242+
FILES+=("pkg/installers/lapdev-cli.sh" "pkg/installers/lapdev-cli.ps1")
243+
244+
gh release create "${TAG_NAME}" "${FILES[@]}" \
245+
--title "Lapdev CLI v${VERSION}" \
246+
--notes "Prebuilt Lapdev CLI binaries for version v${VERSION}."

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ jobs:
7676
./target/debian/lapdev-ws_${{ github.event.inputs.lapdev_version }}-1_amd64.deb
7777
./pkg/common/install.sh
7878
./pkg/common/install-ws.sh
79+
./pkg/installers/lapdev-cli.sh
80+
./pkg/installers/lapdev-cli.ps1
7981
retention-days: 1
8082

8183
publish:
@@ -100,4 +102,6 @@ jobs:
100102
if: github.event_name != 'pull_request'
101103
run: |
102104
gh release create $TAG_NAME --title "$TAG_NAME" --target $GITHUB_SHA \
103-
lapdev-linux/*/*/*
105+
lapdev-linux/*/*/* \
106+
pkg/installers/lapdev-cli.sh \
107+
pkg/installers/lapdev-cli.ps1

0 commit comments

Comments
 (0)