|
| 1 | +name: release |
| 2 | + |
| 3 | +# Single release pipeline driven by a `v*.*.*` git tag. |
| 4 | +# Tier 1 (Rust, npm, NuGet, Dart, GitHub Release) auto-runs on every tag. |
| 5 | +# Tier 2 (Maven, Swift, Go, VS Code) is opt-in via workflow_dispatch — see below. |
| 6 | +# |
| 7 | +# Required repository secrets: |
| 8 | +# CARGO_REGISTRY_TOKEN crates.io API token (Tier 1) |
| 9 | +# NPM_TOKEN npmjs.com automation token (Tier 1) |
| 10 | +# NUGET_API_KEY nuget.org API key (Tier 1) |
| 11 | +# PYPI_API_TOKEN pypi.org API token (scope: project synx-format) (Tier 1) |
| 12 | +# PUB_DEV_PUBLISH_TOKEN pub.dev OIDC token (optional) (Tier 1) |
| 13 | +# |
| 14 | +# MAVEN_USERNAME Sonatype Central username (Tier 2) |
| 15 | +# MAVEN_PASSWORD Sonatype Central password / token |
| 16 | +# MAVEN_GPG_PRIVATE_KEY GPG key for artefact signing |
| 17 | +# MAVEN_GPG_PASSPHRASE GPG key passphrase |
| 18 | +# VSCE_PAT VS Code Marketplace PAT (Tier 2) |
| 19 | +# OVSX_PAT Open VSX Registry PAT (Tier 2) |
| 20 | +# |
| 21 | +# Tag format must match `vMAJOR.MINOR.PATCH` (e.g. `v3.6.3`). |
| 22 | + |
| 23 | +on: |
| 24 | + push: |
| 25 | + tags: |
| 26 | + - 'v[0-9]+.[0-9]+.[0-9]+' |
| 27 | + workflow_dispatch: |
| 28 | + inputs: |
| 29 | + tier2: |
| 30 | + description: 'Also run Tier 2 jobs (Maven, Swift, Go, VS Code)' |
| 31 | + required: false |
| 32 | + default: false |
| 33 | + type: boolean |
| 34 | + dry_run: |
| 35 | + description: 'Dry-run mode — build and validate, but do not publish' |
| 36 | + required: false |
| 37 | + default: false |
| 38 | + type: boolean |
| 39 | + |
| 40 | +permissions: |
| 41 | + contents: write # for GitHub Release creation |
| 42 | + id-token: write # for OIDC publishing (pub.dev, npm provenance) |
| 43 | + |
| 44 | +concurrency: |
| 45 | + group: release-${{ github.ref }} |
| 46 | + cancel-in-progress: false |
| 47 | + |
| 48 | +env: |
| 49 | + IS_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }} |
| 50 | + |
| 51 | +jobs: |
| 52 | + # ─── Tier 1 ────────────────────────────────────────────────────────── |
| 53 | + |
| 54 | + publish-rust: |
| 55 | + name: Publish crates → crates.io |
| 56 | + runs-on: ubuntu-latest |
| 57 | + steps: |
| 58 | + - uses: actions/checkout@v4 |
| 59 | + - uses: dtolnay/rust-toolchain@stable |
| 60 | + - name: cargo publish synx-core |
| 61 | + env: |
| 62 | + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
| 63 | + working-directory: crates/synx-core |
| 64 | + run: | |
| 65 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 66 | + cargo publish --dry-run --allow-dirty |
| 67 | + else |
| 68 | + cargo publish |
| 69 | + fi |
| 70 | + - name: Wait for crates.io index |
| 71 | + if: env.IS_DRY_RUN != 'true' |
| 72 | + run: sleep 45 |
| 73 | + - name: cargo publish synx-format |
| 74 | + env: |
| 75 | + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
| 76 | + working-directory: crates/synx-format |
| 77 | + run: | |
| 78 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 79 | + cargo publish --dry-run --allow-dirty |
| 80 | + else |
| 81 | + cargo publish |
| 82 | + fi |
| 83 | + - name: cargo publish synx-cli |
| 84 | + env: |
| 85 | + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
| 86 | + working-directory: crates/synx-cli |
| 87 | + run: | |
| 88 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 89 | + cargo publish --dry-run --allow-dirty |
| 90 | + else |
| 91 | + cargo publish |
| 92 | + fi |
| 93 | + - name: cargo publish synx-lsp |
| 94 | + env: |
| 95 | + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
| 96 | + working-directory: crates/synx-lsp |
| 97 | + run: | |
| 98 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 99 | + cargo publish --dry-run --allow-dirty |
| 100 | + else |
| 101 | + cargo publish |
| 102 | + fi |
| 103 | +
|
| 104 | + publish-npm: |
| 105 | + name: Publish synx-js → npm |
| 106 | + runs-on: ubuntu-latest |
| 107 | + steps: |
| 108 | + - uses: actions/checkout@v4 |
| 109 | + - uses: actions/setup-node@v4 |
| 110 | + with: |
| 111 | + node-version: '20' |
| 112 | + registry-url: 'https://registry.npmjs.org' |
| 113 | + - name: Install |
| 114 | + working-directory: packages/synx-js |
| 115 | + run: npm ci |
| 116 | + - name: Build |
| 117 | + working-directory: packages/synx-js |
| 118 | + run: npm run build --if-present |
| 119 | + - name: Publish |
| 120 | + working-directory: packages/synx-js |
| 121 | + env: |
| 122 | + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
| 123 | + run: | |
| 124 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 125 | + npm publish --dry-run --access public --provenance |
| 126 | + else |
| 127 | + npm publish --access public --provenance |
| 128 | + fi |
| 129 | +
|
| 130 | + publish-nuget: |
| 131 | + name: Publish Synx.Core → NuGet |
| 132 | + runs-on: ubuntu-latest |
| 133 | + steps: |
| 134 | + - uses: actions/checkout@v4 |
| 135 | + - uses: actions/setup-dotnet@v4 |
| 136 | + with: |
| 137 | + dotnet-version: '8.0.x' |
| 138 | + - name: Pack |
| 139 | + working-directory: parsers/dotnet/src/Synx.Core |
| 140 | + run: dotnet pack -c Release -o ../../artifacts |
| 141 | + - name: Push |
| 142 | + if: env.IS_DRY_RUN != 'true' |
| 143 | + working-directory: parsers/dotnet/artifacts |
| 144 | + run: | |
| 145 | + dotnet nuget push "*.nupkg" \ |
| 146 | + --api-key "${{ secrets.NUGET_API_KEY }}" \ |
| 147 | + --source https://api.nuget.org/v3/index.json \ |
| 148 | + --skip-duplicate |
| 149 | +
|
| 150 | + publish-pypi-wheels: |
| 151 | + name: Build PyPI wheel (${{ matrix.os }} / ${{ matrix.target }}) |
| 152 | + strategy: |
| 153 | + fail-fast: false |
| 154 | + matrix: |
| 155 | + include: |
| 156 | + - os: ubuntu-latest |
| 157 | + target: x86_64 |
| 158 | + - os: ubuntu-latest |
| 159 | + target: aarch64 |
| 160 | + - os: windows-latest |
| 161 | + target: x64 |
| 162 | + - os: macos-latest |
| 163 | + target: x86_64 |
| 164 | + - os: macos-latest |
| 165 | + target: aarch64 |
| 166 | + runs-on: ${{ matrix.os }} |
| 167 | + steps: |
| 168 | + - uses: actions/checkout@v4 |
| 169 | + - uses: actions/setup-python@v5 |
| 170 | + with: |
| 171 | + python-version: '3.12' |
| 172 | + - name: Build wheel |
| 173 | + uses: PyO3/maturin-action@v1 |
| 174 | + with: |
| 175 | + working-directory: bindings/python |
| 176 | + target: ${{ matrix.target }} |
| 177 | + args: --release --out dist --interpreter "3.9 3.10 3.11 3.12 3.13" |
| 178 | + sccache: true |
| 179 | + manylinux: auto |
| 180 | + - name: Upload wheel artifact |
| 181 | + uses: actions/upload-artifact@v4 |
| 182 | + with: |
| 183 | + name: pypi-wheels-${{ matrix.os }}-${{ matrix.target }} |
| 184 | + path: bindings/python/dist |
| 185 | + |
| 186 | + publish-pypi-sdist: |
| 187 | + name: Build PyPI sdist |
| 188 | + runs-on: ubuntu-latest |
| 189 | + steps: |
| 190 | + - uses: actions/checkout@v4 |
| 191 | + - uses: actions/setup-python@v5 |
| 192 | + with: |
| 193 | + python-version: '3.12' |
| 194 | + - name: Build sdist |
| 195 | + uses: PyO3/maturin-action@v1 |
| 196 | + with: |
| 197 | + working-directory: bindings/python |
| 198 | + command: sdist |
| 199 | + args: --out dist |
| 200 | + - name: Upload sdist artifact |
| 201 | + uses: actions/upload-artifact@v4 |
| 202 | + with: |
| 203 | + name: pypi-sdist |
| 204 | + path: bindings/python/dist |
| 205 | + |
| 206 | + publish-pypi: |
| 207 | + name: Push wheels + sdist → PyPI |
| 208 | + runs-on: ubuntu-latest |
| 209 | + needs: [publish-pypi-wheels, publish-pypi-sdist] |
| 210 | + steps: |
| 211 | + - uses: actions/download-artifact@v4 |
| 212 | + with: |
| 213 | + path: dist |
| 214 | + pattern: pypi-* |
| 215 | + merge-multiple: true |
| 216 | + - name: Publish to PyPI |
| 217 | + if: env.IS_DRY_RUN != 'true' |
| 218 | + uses: PyO3/maturin-action@v1 |
| 219 | + with: |
| 220 | + command: upload |
| 221 | + args: --skip-existing dist/* |
| 222 | + env: |
| 223 | + MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }} |
| 224 | + |
| 225 | + publish-pub: |
| 226 | + name: Publish synx → pub.dev |
| 227 | + runs-on: ubuntu-latest |
| 228 | + steps: |
| 229 | + - uses: actions/checkout@v4 |
| 230 | + - uses: dart-lang/setup-dart@v1 |
| 231 | + - name: Resolve dependencies |
| 232 | + working-directory: parsers/dart |
| 233 | + run: dart pub get |
| 234 | + - name: Analyze |
| 235 | + working-directory: parsers/dart |
| 236 | + run: dart analyze --fatal-infos |
| 237 | + - name: Test |
| 238 | + working-directory: parsers/dart |
| 239 | + run: dart test |
| 240 | + - name: Publish |
| 241 | + if: env.IS_DRY_RUN != 'true' |
| 242 | + working-directory: parsers/dart |
| 243 | + env: |
| 244 | + PUB_DEV_PUBLISH_ACCESS_TOKEN: ${{ secrets.PUB_DEV_PUBLISH_TOKEN }} |
| 245 | + run: | |
| 246 | + # pub.dev OIDC publishing is configured per package at |
| 247 | + # https://pub.dev/packages/<name>/admin → "Automated publishing". |
| 248 | + # Once enabled there, `dart pub publish --force` succeeds without a |
| 249 | + # token; the line below stays valid as a fallback for token mode. |
| 250 | + dart pub publish --force |
| 251 | +
|
| 252 | + github-release: |
| 253 | + name: Create GitHub Release |
| 254 | + runs-on: ubuntu-latest |
| 255 | + needs: [publish-rust, publish-npm, publish-nuget, publish-pypi] |
| 256 | + if: env.IS_DRY_RUN != 'true' |
| 257 | + steps: |
| 258 | + - uses: actions/checkout@v4 |
| 259 | + with: |
| 260 | + fetch-depth: 0 |
| 261 | + - name: Extract changelog section for this tag |
| 262 | + id: changelog |
| 263 | + run: | |
| 264 | + TAG="${GITHUB_REF_NAME#v}" |
| 265 | + # Pull the `## [X.Y.Z] — DATE` block out of CHANGELOG.md. |
| 266 | + awk "/^## \[$TAG\]/{flag=1;print;next} /^## \[/{flag=0} flag" CHANGELOG.md > release-notes.md |
| 267 | + if [ ! -s release-notes.md ]; then |
| 268 | + echo "No changelog entry for $TAG — using auto notes." > release-notes.md |
| 269 | + fi |
| 270 | + - name: Create release |
| 271 | + uses: softprops/action-gh-release@v2 |
| 272 | + with: |
| 273 | + name: SYNX ${{ github.ref_name }} |
| 274 | + body_path: release-notes.md |
| 275 | + draft: false |
| 276 | + prerelease: false |
| 277 | + |
| 278 | + # ─── Tier 2 (opt-in, manual) ───────────────────────────────────────── |
| 279 | + |
| 280 | + publish-maven: |
| 281 | + name: Publish Java → Maven Central |
| 282 | + runs-on: ubuntu-latest |
| 283 | + if: github.event_name == 'workflow_dispatch' && inputs.tier2 == true |
| 284 | + steps: |
| 285 | + - uses: actions/checkout@v4 |
| 286 | + - uses: actions/setup-java@v4 |
| 287 | + with: |
| 288 | + distribution: temurin |
| 289 | + java-version: '17' |
| 290 | + server-id: central |
| 291 | + server-username: MAVEN_USERNAME |
| 292 | + server-password: MAVEN_PASSWORD |
| 293 | + gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} |
| 294 | + gpg-passphrase: MAVEN_GPG_PASSPHRASE |
| 295 | + - name: Build + deploy |
| 296 | + working-directory: parsers/java |
| 297 | + env: |
| 298 | + MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }} |
| 299 | + MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }} |
| 300 | + MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} |
| 301 | + run: | |
| 302 | + if [ "${{ env.IS_DRY_RUN }}" = "true" ]; then |
| 303 | + mvn -B verify |
| 304 | + else |
| 305 | + mvn -B deploy -DskipTests=false -Psign |
| 306 | + fi |
| 307 | +
|
| 308 | + publish-swift: |
| 309 | + name: Tag Swift Package |
| 310 | + runs-on: macos-latest |
| 311 | + if: github.event_name == 'workflow_dispatch' && inputs.tier2 == true |
| 312 | + steps: |
| 313 | + - uses: actions/checkout@v4 |
| 314 | + - name: Build + test |
| 315 | + working-directory: parsers/swift |
| 316 | + run: swift build && swift test |
| 317 | + # SwiftPM has no central registry — consumers add the GitHub URL. |
| 318 | + # The `v*.*.*` tag that triggers this workflow is already the release. |
| 319 | + |
| 320 | + publish-go: |
| 321 | + name: Validate Go module |
| 322 | + runs-on: ubuntu-latest |
| 323 | + if: github.event_name == 'workflow_dispatch' && inputs.tier2 == true |
| 324 | + steps: |
| 325 | + - uses: actions/checkout@v4 |
| 326 | + - uses: actions/setup-go@v5 |
| 327 | + with: |
| 328 | + go-version: 'stable' |
| 329 | + - name: Test |
| 330 | + working-directory: parsers/go |
| 331 | + run: go test ./... |
| 332 | + # Go modules are tagged-on-GitHub; the `v*.*.*` tag IS the publish. |
| 333 | + # This job just verifies the tagged code builds and tests pass. |
| 334 | + |
| 335 | + publish-vscode: |
| 336 | + name: Publish VS Code extension |
| 337 | + runs-on: ubuntu-latest |
| 338 | + if: github.event_name == 'workflow_dispatch' && inputs.tier2 == true |
| 339 | + steps: |
| 340 | + - uses: actions/checkout@v4 |
| 341 | + - uses: actions/setup-node@v4 |
| 342 | + with: |
| 343 | + node-version: '20' |
| 344 | + - name: Install vsce + ovsx |
| 345 | + run: npm install -g @vscode/vsce ovsx |
| 346 | + - name: Package |
| 347 | + working-directory: integrations/vscode/synx-vscode |
| 348 | + run: | |
| 349 | + npm install |
| 350 | + vsce package |
| 351 | + - name: Publish to VS Code Marketplace |
| 352 | + if: env.IS_DRY_RUN != 'true' |
| 353 | + working-directory: integrations/vscode/synx-vscode |
| 354 | + env: |
| 355 | + VSCE_PAT: ${{ secrets.VSCE_PAT }} |
| 356 | + run: vsce publish |
| 357 | + - name: Publish to Open VSX |
| 358 | + if: env.IS_DRY_RUN != 'true' |
| 359 | + working-directory: integrations/vscode/synx-vscode |
| 360 | + env: |
| 361 | + OVSX_PAT: ${{ secrets.OVSX_PAT }} |
| 362 | + run: ovsx publish *.vsix --pat "$OVSX_PAT" |
0 commit comments