release.yaml

---
name: Release
on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
    paths:
      - crate_universe/tools/cross_installer/**
      - version.bzl
      - .github/workflows/release.yaml
      - .github/workflows/release_prep.sh
  push:
    branches:
      - main
    paths:
      - version.bzl

defaults:
  run:
    shell: bash

env:
  BAZEL_STARTUP_FLAGS: --bazelrc=${{ github.workspace }}/.github/github.bazelrc

jobs:
  validation:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Ensure release does not already exist
        if: startsWith(github.ref, 'refs/heads/main')
        run: |
          git fetch origin &> /dev/null
          version="$(grep 'VERSION =' ${{ github.workspace }}/version.bzl | sed 's/VERSION = "//' | sed 's/"//')"
          if [[ -n "$(git tag -l ${version})" ]]; then
            echo "A release '${version}' already exists." >&2
            exit 1
          else
            echo "Tag '${version}' will be created"
          fi
  builds:
    needs: validation
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Create a job for each target triple
        include:
          - os: macOS-14
            env:
              TARGET: "aarch64-apple-darwin"
          - os: ubuntu-22.04
            env:
              TARGET: "aarch64-unknown-linux-gnu"
          - os: ubuntu-22.04
            env:
              TARGET: "aarch64-unknown-linux-musl"
          - os: windows-2022
            env:
              TARGET: "aarch64-pc-windows-msvc"
          - os: ubuntu-22.04
            env:
              TARGET: "s390x-unknown-linux-gnu"
          - os: macos-15-intel
            env:
              TARGET: "x86_64-apple-darwin"
          - os: ubuntu-22.04
            env:
              TARGET: "x86_64-pc-windows-gnu"
          - os: windows-2022
            env:
              TARGET: "x86_64-pc-windows-msvc"
          - os: ubuntu-22.04
            env:
              TARGET: "x86_64-unknown-linux-gnu"
          - os: ubuntu-22.04
            env:
              TARGET: "x86_64-unknown-linux-musl"
    steps:
      - uses: actions/checkout@v4
      - name: Install rust toolchains for host
        run: |
          # Detect the current version of rust
          version="$(grep 'DEFAULT_RUST_VERSION =' ./rust/private/common.bzl | grep -o '[[:digit:].]\+')"
          rustup override set "${version}"
          rustup target add ${TARGET}
          rustup update stable --no-self-update --force-non-host
          rustup default stable
        env:
          TARGET: "${{ matrix.env.TARGET }}"
      - name: Setup macos build tooling
        run: |
          ls -la /Applications/
          sudo xcode-select -s /Applications/Xcode_16.1.app/Contents/Developer/
          xcodebuild -showsdks
          # Set SDK environment variables
          echo "SDKROOT=$(xcrun -sdk ${{ env.TARGET_SDK }} --show-sdk-path)" >> $GITHUB_ENV
          MACOSX_DEPLOYMENT_TARGET="$(xcrun -sdk ${{ env.TARGET_SDK }} --show-sdk-platform-version)"
          if [[ -n "${MACOSX_DEPLOYMENT_TARGET}" ]]; then
            echo "MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET}" >> $GITHUB_ENV
          fi
        env:
          TARGET_SDK: macosx15.1
        if: startswith(matrix.os, 'macos')
      - name: Setup Windows Bazelrc
        run: |
          echo "startup --output_user_root=C:/tmp" > ./user.bazelrc
          echo "startup --windows_enable_symlinks" > ./user.bazelrc
          echo "build --enable_runfiles" > ./user.bazelrc
        if: startswith(matrix.os, 'Windows')
      - name: Build cargo-bazel binaries
        run: |
          # Build binaries
          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            OUTPUT_PATH="$(cygpath "${{ github.workspace }}/crate_universe/target/artifacts" -m)"
          else
            OUTPUT_PATH="${{ github.workspace }}/crate_universe/target/artifacts"
          fi
            bazel ${BAZEL_STARTUP_FLAGS[@]} run //crate_universe/tools/cross_installer -- --target=${TARGET} --output="${OUTPUT_PATH}"
        env:
          TARGET: "${{ matrix.env.TARGET }}"
      - uses: actions/upload-artifact@v4
        with:
          # The artifact name MUST be the target triple — release_prep.sh
          # locates each binary at ${GITHUB_WORKSPACE}/<triple>/.
          name: "${{ matrix.env.TARGET }}"
          path: ${{ github.workspace }}/crate_universe/target/artifacts/${{ matrix.env.TARGET }}
          if-no-files-found: error

  # Create and push the version tag at the current main commit. The release
  # job's reusable workflow (release_ruleset.yaml) checks out at this tag, so
  # it must exist before that job runs.
  tag:
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && startsWith(github.ref, 'refs/heads/main'))
    needs: [validation, builds]
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.create_tag.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Create and push tag
        id: create_tag
        run: |
          set -euo pipefail
          version="$(grep 'VERSION =' ${{ github.workspace }}/version.bzl | sed 's/VERSION = "//' | sed 's/"//')"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          # Pin the tag to the resolved SHA so a concurrent merge to main
          # can't shift the release contents out from under us.
          git tag -a "${version}" -m "rules_rust ${version}" "${{ github.sha }}"
          git push origin "${version}"
          echo "tag=${version}" >> $GITHUB_OUTPUT

  # Build the source archive, attest its provenance under the BCR-trusted
  # release_ruleset builder ID, and publish the GitHub release. The actual
  # build runs in .github/workflows/release_prep.sh (hardcoded path in
  # release_ruleset.yaml).
  release:
    needs: tag
    permissions:
      contents: write
      id-token: write
      attestations: write
    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
    with:
      # Tests already ran on the PR that bumped version.bzl. Override the
      # `bazel test //...` default — rules_rust's full suite can't fit on a
      # single ubuntu-latest runner.
      bazel_test_command: "bazel info release"
      release_files: |
        rules_rust-*.tar.gz
        cargo-bazel-aarch64-apple-darwin
        cargo-bazel-aarch64-pc-windows-msvc.exe
        cargo-bazel-aarch64-unknown-linux-gnu
        cargo-bazel-aarch64-unknown-linux-musl
        cargo-bazel-s390x-unknown-linux-gnu
        cargo-bazel-x86_64-apple-darwin
        cargo-bazel-x86_64-pc-windows-gnu.exe
        cargo-bazel-x86_64-pc-windows-msvc.exe
        cargo-bazel-x86_64-unknown-linux-gnu
        cargo-bazel-x86_64-unknown-linux-musl
      prerelease: false
      tag_name: ${{ needs.tag.outputs.tag }}

  publish:
    needs: [tag, release]
    permissions:
      contents: write
      id-token: write
      attestations: write
    uses: ./.github/workflows/publish.yaml
    with:
      release_version: ${{ needs.tag.outputs.tag }}
    secrets:
      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}