Skip to content

Commit ad826a6

Browse files
byshingbyshing
authored
Merge pull request #2 from BitMEX/feature/distribute
Distribution: CI, release pipeline, macOS signing & notarization
2 parents 65a480d + 8178aeb commit ad826a6

4 files changed

Lines changed: 366 additions & 16 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v6
13+
- run: sudo apt-get install -y libdbus-1-dev
14+
- uses: actions/cache@v4
15+
with:
16+
path: |
17+
~/.cargo/registry
18+
~/.cargo/git
19+
target
20+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
21+
restore-keys: ${{ runner.os }}-cargo-
22+
- run: cargo test

‎.github/workflows/release.yml‎

Lines changed: 330 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,330 @@
1+
# This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist
2+
#
3+
# Copyright 2022-2024, axodotdev
4+
# SPDX-License-Identifier: MIT or Apache-2.0
5+
#
6+
# CI that:
7+
#
8+
# * checks for a Git Tag that looks like a release
9+
# * builds artifacts with dist (archives, installers, hashes)
10+
# * uploads those artifacts to temporary workflow zip
11+
# * on success, uploads the artifacts to a GitHub Release
12+
#
13+
# Note that the GitHub Release will be created with a generated
14+
# title/body based on your changelogs.
15+
16+
name: Release
17+
permissions:
18+
"contents": "write"
19+
20+
# This task will run whenever you push a git tag that looks like a version
21+
# like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
22+
# Various formats will be parsed into a VERSION and an optional PACKAGE_NAME, where
23+
# PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION
24+
# must be a Cargo-style SemVer Version (must have at least major.minor.patch).
25+
#
26+
# If PACKAGE_NAME is specified, then the announcement will be for that
27+
# package (erroring out if it doesn't have the given version or isn't dist-able).
28+
#
29+
# If PACKAGE_NAME isn't specified, then the announcement will be for all
30+
# (dist-able) packages in the workspace with that version (this mode is
31+
# intended for workspaces with only one dist-able package, or with all dist-able
32+
# packages versioned/released in lockstep).
33+
#
34+
# If you push multiple tags at once, separate instances of this workflow will
35+
# spin up, creating an independent announcement for each one. However, GitHub
36+
# will hard limit this to 3 tags per commit, as it will assume more tags is a
37+
# mistake.
38+
#
39+
# If there's a prerelease-style suffix to the version, then the release(s)
40+
# will be marked as a prerelease.
41+
on:
42+
pull_request:
43+
push:
44+
tags:
45+
- '**[0-9]+.[0-9]+.[0-9]+*'
46+
47+
jobs:
48+
# Run 'dist plan' (or host) to determine what tasks we need to do
49+
plan:
50+
runs-on: "ubuntu-22.04"
51+
outputs:
52+
val: ${{ steps.plan.outputs.manifest }}
53+
tag: ${{ !github.event.pull_request && github.ref_name || '' }}
54+
tag-flag: ${{ !github.event.pull_request && format('--tag={0}', github.ref_name) || '' }}
55+
publishing: ${{ !github.event.pull_request }}
56+
env:
57+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
steps:
59+
- uses: actions/checkout@v6
60+
with:
61+
persist-credentials: false
62+
submodules: recursive
63+
- name: Install dist
64+
# we specify bash to get pipefail; it guards against the `curl` command
65+
# failing. otherwise `sh` won't catch that `curl` returned non-0
66+
shell: bash
67+
run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh"
68+
- name: Cache dist
69+
uses: actions/upload-artifact@v6
70+
with:
71+
name: cargo-dist-cache
72+
path: ~/.cargo/bin/dist
73+
# sure would be cool if github gave us proper conditionals...
74+
# so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
75+
# functionality based on whether this is a pull_request, and whether it's from a fork.
76+
# (PRs run on the *source* but secrets are usually on the *target* -- that's *good*
77+
# but also really annoying to build CI around when it needs secrets to work right.)
78+
- id: plan
79+
run: |
80+
dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
81+
echo "dist ran successfully"
82+
cat plan-dist-manifest.json
83+
echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
84+
- name: "Upload dist-manifest.json"
85+
uses: actions/upload-artifact@v6
86+
with:
87+
name: artifacts-plan-dist-manifest
88+
path: plan-dist-manifest.json
89+
90+
# Build and packages all the platform-specific things
91+
build-local-artifacts:
92+
name: build-local-artifacts (${{ join(matrix.targets, ', ') }})
93+
# Let the initial task tell us to not run (currently very blunt)
94+
needs:
95+
- plan
96+
if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
97+
strategy:
98+
fail-fast: false
99+
# Target platforms/runners are computed by dist in create-release.
100+
# Each member of the matrix has the following arguments:
101+
#
102+
# - runner: the github runner
103+
# - dist-args: cli flags to pass to dist
104+
# - install-dist: expression to run to install dist on the runner
105+
#
106+
# Typically there will be:
107+
# - 1 "global" task that builds universal installers
108+
# - N "local" tasks that build each platform's binaries and platform-specific installers
109+
matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
110+
runs-on: ${{ matrix.runner }}
111+
container: ${{ matrix.container && matrix.container.image || null }}
112+
env:
113+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
114+
BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
115+
CODESIGN_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
116+
CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
117+
CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
118+
CODESIGN_OPTIONS: runtime
119+
APPLE_NOTARIZE_ID: ${{ secrets.APPLE_NOTARIZE_ID }}
120+
APPLE_NOTARIZE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_PASSWORD }}
121+
APPLE_NOTARIZE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
122+
permissions:
123+
"attestations": "write"
124+
"contents": "read"
125+
"id-token": "write"
126+
steps:
127+
- name: enable windows longpaths
128+
run: |
129+
git config --global core.longpaths true
130+
- uses: actions/checkout@v6
131+
with:
132+
persist-credentials: false
133+
submodules: recursive
134+
- name: Install Rust non-interactively if not already installed
135+
if: ${{ matrix.container }}
136+
run: |
137+
if ! command -v cargo > /dev/null 2>&1; then
138+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
139+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
140+
fi
141+
- uses: swatinem/rust-cache@v2
142+
with:
143+
key: ${{ join(matrix.targets, '-') }}
144+
cache-provider: ${{ matrix.cache_provider }}
145+
- name: Install dist
146+
run: ${{ matrix.install_dist.run }}
147+
# Get the dist-manifest
148+
- name: Fetch local artifacts
149+
uses: actions/download-artifact@v7
150+
with:
151+
pattern: artifacts-*
152+
path: target/distrib/
153+
merge-multiple: true
154+
- name: Install dependencies
155+
run: |
156+
${{ matrix.packages_install }}
157+
- name: Build artifacts
158+
run: |
159+
# Actually do builds and make zips and whatnot
160+
dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
161+
echo "dist ran successfully"
162+
- name: Notarize macOS binary
163+
if: ${{ contains(join(matrix.targets, ','), 'apple-darwin') && needs.plan.outputs.publishing == 'true' }}
164+
shell: bash
165+
run: |
166+
target="${{ join(matrix.targets, '') }}"
167+
tarball="target/distrib/bitmex-cli-${target}.tar.gz"
168+
tmpdir=$(mktemp -d)
169+
tar xzf "$tarball" -C "$tmpdir"
170+
binary="$tmpdir/bitmex-cli-${target}/bitmex"
171+
ditto -c -k --keepParent "$binary" "$tmpdir/notarize.zip"
172+
xcrun notarytool submit "$tmpdir/notarize.zip" \
173+
--apple-id "$APPLE_NOTARIZE_ID" \
174+
--password "$APPLE_NOTARIZE_PASSWORD" \
175+
--team-id "$APPLE_NOTARIZE_TEAM_ID" \
176+
--wait
177+
- name: Attest
178+
uses: actions/attest-build-provenance@v3
179+
with:
180+
subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
181+
- id: cargo-dist
182+
name: Post-build
183+
# We force bash here just because github makes it really hard to get values up
184+
# to "real" actions without writing to env-vars, and writing to env-vars has
185+
# inconsistent syntax between shell and powershell.
186+
shell: bash
187+
run: |
188+
# Parse out what we just built and upload it to scratch storage
189+
echo "paths<<EOF" >> "$GITHUB_OUTPUT"
190+
dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
191+
echo "EOF" >> "$GITHUB_OUTPUT"
192+
193+
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
194+
- name: "Upload artifacts"
195+
uses: actions/upload-artifact@v6
196+
with:
197+
name: artifacts-build-local-${{ join(matrix.targets, '_') }}
198+
path: |
199+
${{ steps.cargo-dist.outputs.paths }}
200+
${{ env.BUILD_MANIFEST_NAME }}
201+
202+
# Build and package all the platform-agnostic(ish) things
203+
build-global-artifacts:
204+
needs:
205+
- plan
206+
- build-local-artifacts
207+
runs-on: "ubuntu-22.04"
208+
env:
209+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
210+
BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
211+
steps:
212+
- uses: actions/checkout@v6
213+
with:
214+
persist-credentials: false
215+
submodules: recursive
216+
- name: Install cached dist
217+
uses: actions/download-artifact@v7
218+
with:
219+
name: cargo-dist-cache
220+
path: ~/.cargo/bin/
221+
- run: chmod +x ~/.cargo/bin/dist
222+
# Get all the local artifacts for the global tasks to use (for e.g. checksums)
223+
- name: Fetch local artifacts
224+
uses: actions/download-artifact@v7
225+
with:
226+
pattern: artifacts-*
227+
path: target/distrib/
228+
merge-multiple: true
229+
- id: cargo-dist
230+
shell: bash
231+
run: |
232+
dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
233+
echo "dist ran successfully"
234+
235+
# Parse out what we just built and upload it to scratch storage
236+
echo "paths<<EOF" >> "$GITHUB_OUTPUT"
237+
jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
238+
echo "EOF" >> "$GITHUB_OUTPUT"
239+
240+
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
241+
- name: "Upload artifacts"
242+
uses: actions/upload-artifact@v6
243+
with:
244+
name: artifacts-build-global
245+
path: |
246+
${{ steps.cargo-dist.outputs.paths }}
247+
${{ env.BUILD_MANIFEST_NAME }}
248+
# Determines if we should publish/announce
249+
host:
250+
needs:
251+
- plan
252+
- build-local-artifacts
253+
- build-global-artifacts
254+
# Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
255+
if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
256+
env:
257+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
258+
runs-on: "ubuntu-22.04"
259+
outputs:
260+
val: ${{ steps.host.outputs.manifest }}
261+
steps:
262+
- uses: actions/checkout@v6
263+
with:
264+
persist-credentials: false
265+
submodules: recursive
266+
- name: Install cached dist
267+
uses: actions/download-artifact@v7
268+
with:
269+
name: cargo-dist-cache
270+
path: ~/.cargo/bin/
271+
- run: chmod +x ~/.cargo/bin/dist
272+
# Fetch artifacts from scratch-storage
273+
- name: Fetch artifacts
274+
uses: actions/download-artifact@v7
275+
with:
276+
pattern: artifacts-*
277+
path: target/distrib/
278+
merge-multiple: true
279+
- id: host
280+
shell: bash
281+
run: |
282+
dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
283+
echo "artifacts uploaded and released successfully"
284+
cat dist-manifest.json
285+
echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
286+
- name: "Upload dist-manifest.json"
287+
uses: actions/upload-artifact@v6
288+
with:
289+
# Overwrite the previous copy
290+
name: artifacts-dist-manifest
291+
path: dist-manifest.json
292+
# Create a GitHub Release while uploading all files to it
293+
- name: "Download GitHub Artifacts"
294+
uses: actions/download-artifact@v7
295+
with:
296+
pattern: artifacts-*
297+
path: artifacts
298+
merge-multiple: true
299+
- name: Cleanup
300+
run: |
301+
# Remove the granular manifests
302+
rm -f artifacts/*-dist-manifest.json
303+
- name: Create GitHub Release
304+
env:
305+
PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}"
306+
ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}"
307+
ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}"
308+
RELEASE_COMMIT: "${{ github.sha }}"
309+
run: |
310+
# Write and read notes from a file to avoid quoting breaking things
311+
echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
312+
313+
gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
314+
315+
announce:
316+
needs:
317+
- plan
318+
- host
319+
# use "always() && ..." to allow us to wait for all publish jobs while
320+
# still allowing individual publish jobs to skip themselves (for prereleases).
321+
# "host" however must run to completion, no skipping allowed!
322+
if: ${{ always() && needs.host.result == 'success' }}
323+
runs-on: "ubuntu-22.04"
324+
env:
325+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
326+
steps:
327+
- uses: actions/checkout@v6
328+
with:
329+
persist-credentials: false
330+
submodules: recursive

‎dist-workspace.toml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,17 @@ pr-run-mode = "plan"
1717
unix-archive = ".tar.gz"
1818
# Whether to enable GitHub Attestations
1919
github-attestations = true
20-
# Skip checking whether the specified configuration files are up to date
21-
allow-dirty = ["ci"]
2220
# Path that installers should place binaries in
2321
install-path = "CARGO_HOME"
2422
# Whether to install an updater program
2523
install-updater = false
24+
# macOS code signing (uses APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_TEAM_ID secrets)
25+
macos-sign = true
26+
# CI file has custom secret name mappings, opt out of dist's staleness check
27+
allow-dirty = ["ci"]
28+
29+
[dist.dependencies.apt]
30+
libdbus-1-dev = "*"
31+
32+
[dist.github-custom-runners]
33+
aarch64-apple-darwin = "macos-15"

0 commit comments

Comments
 (0)