Merge pull request #4 from coder0107git/upstream

Merge upstream

Author: coder0107git

.github/actions/build-release/action.yml

@@ -17,6 +17,21 @@ inputs:
     description: "Expected Binary Architecture"
     required: false
     default: ""
+  azure-tenant-id:
+    description: "Azure Tenant ID for Windows Code Signing"
+    required: false
+  azure-subscription-id:
+    description: "Azure Subscription ID for Windows Code Signing"
+    required: false
+  azure-client-id:
+    description: "Azure Client ID for Windows Code Signing"
+    required: false
+  azure-trusted-signing-account-name:
+    description: "Azure Trusted Signing Account Name for Windows Code Signing"
+    required: false
+  azure-certificate-profile-name:
+    description: "Azure Certificate Profile Name for Windows Code Signing"
+    required: false
 
 outputs:
   archive:
@@ -75,14 +90,46 @@ runs:
           BINARY_PATH="${BINARY_PATH}.exe"
         fi
 
-        if ! file -b "$BINARY_PATH" | grep -q "${{ inputs.expected-binary-architecture }}"; then
+        if ! file -b "$BINARY_PATH" | grep -iq "${{ inputs.expected-binary-architecture }}"; then
           echo "error: Architecture mismatch"
           echo "Expected architecture: '${{ inputs.expected-binary-architecture }}'"
           echo "Found binary type: '$(file -b "$BINARY_PATH")'"
           exit 1
         fi
         echo "ok: Architecture match"
 
+    # We use Azure Trusted Signing to sign the Windows binaries.
+    # This is done to ensure that the binaries are trusted and can be
+    # verified by users and systems that require signed code.
+    #
+    # Why is this helpful?
+    # * It provides a way to verify the authenticity and integrity of the
+    #   binaries distributed by Gleam.
+    # * It helps prevent tampering with the binaries, ensuring that users
+    #   can trust the code they are running.
+    #
+    # For more information, see:
+    # * https://github.com/Azure/trusted-signing-action
+    # * https://azure.microsoft.com/en-us/products/trusted-signing
+    - name: Log in to Azure
+      if: ${{ contains(inputs.target, '-windows-') && inputs.azure-tenant-id && inputs.azure-subscription-id && inputs.azure-client-id && inputs.azure-trusted-signing-account-name && inputs.azure-certificate-profile-name }}
+      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+      with:
+        client-id: ${{ inputs.azure-client-id }}
+        tenant-id: ${{ inputs.azure-tenant-id }}
+        subscription-id: ${{ inputs.azure-subscription-id }}
+    - name: Windows Code Signing
+      if: ${{ contains(inputs.target, '-windows-') && inputs.azure-tenant-id && inputs.azure-subscription-id && inputs.azure-client-id && inputs.azure-trusted-signing-account-name && inputs.azure-certificate-profile-name }}
+      uses: azure/trusted-signing-action@0d74250c661747df006298d0fb49944c10f16e03 # v0.5.1
+      with:
+        endpoint: https://eus.codesigning.azure.net/
+        trusted-signing-account-name: ${{ inputs.azure-trusted-signing-account-name }}
+        certificate-profile-name: ${{ inputs.azure-certificate-profile-name }}
+        files: ${{ github.workspace }}\target\${{ inputs.target }}\release\gleam.exe
+        file-digest: SHA256
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
+
     - name: Build archive
       id: build
       shell: bash
@@ -117,7 +164,7 @@ runs:
       shell: bash
       run: |
         case "$TARGET" in
-          x86_64-pc-windows-msvc)
+          *windows*)
             7z x "$ARCHIVE"
             ./gleam.exe --version
             ;;

.github/workflows/ci.yaml

@@ -1,6 +1,9 @@
 name: ci
 on:
   pull_request:
+    paths-ignore:
+      - "CHANGELOG.md"
+      - "docs/**"
   push:
     branches:
       - main
@@ -59,7 +62,7 @@ jobs:
             cargo-tool: cross
             run-integration-tests: false # Cannot run aarch64 binaries on x86_64
           # macos>=14 runs exclusively on aarch64 and will thus fail to execute properly for x64
-          - os: macos-13 # intel
+          - os: macos-15-intel # intel
             target: x86_64-apple-darwin
             binary: x86_64
             cargo-tool: cargo
@@ -70,17 +73,17 @@ jobs:
             binary: arm64
             cargo-tool: cargo
             run-integration-tests: true
-          - os: windows-latest
+          - os: windows-2022
             target: x86_64-pc-windows-msvc
             binary: x86-64
             cargo-tool: cargo
             run-integration-tests: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install musl-tools incl. musl-gcc
-        uses: awalsh128/cache-apt-pkgs-action@v1.5.0
+        uses: awalsh128/cache-apt-pkgs-action@v1
         with:
           # musl-tools provide `musl-gcc` which is required for `ring` which is required for `rustls` et al.
           packages: musl-tools
@@ -93,24 +96,17 @@ jobs:
           toolchain: ${{ matrix.toolchain }}
           target: ${{ matrix.target }}
 
-      - name: Install Erlang (non-macos)
+      - name: Install Erlang
         uses: erlef/setup-beam@v1
         with:
-          otp-version: "26.1"
-          elixir-version: "1.16.1"
+          otp-version: "28.0.1"
+          elixir-version: "1.18"
           rebar3-version: "3"
-        if: ${{ runner.os != 'macOS' }} # setup-beam does not support macOS
-
-      - name: Install Erlang (macos)
-        run: |
-          brew install erlang rebar3 elixir
-          mix local.hex --force
-        if: ${{ runner.os == 'macOS' }} # setup-beam does not support macOS
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "20"
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2
@@ -128,7 +124,7 @@ jobs:
           key: v1-${{ matrix.target }}
 
       - name: Install Gleam
-        uses: clechasseur/rs-cargo@v3
+        uses: clechasseur/rs-cargo@v4
         with:
           command: install
           args: "--path gleam-bin --target ${{ matrix.target }} --debug --locked --force"
@@ -153,7 +149,7 @@ jobs:
         if: ${{ matrix.run-integration-tests }}
 
       - name: Run tests
-        uses: clechasseur/rs-cargo@v3
+        uses: clechasseur/rs-cargo@v4
         with:
           command: test
           # We only want to run the `test-output` when running integration tests.
@@ -275,7 +271,7 @@ jobs:
 
           # Test adding of deps
           gleam add exception    # No specifier
-          gleam add gleam_http@3 # Version specifier
+          gleam add gleam_http@4 # Version specifier
           gleam test
 
           # Test documentation generation
@@ -315,17 +311,17 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
           target: wasm32-unknown-unknown
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "20"
 
       - name: Install wasm-pack
         run: |
@@ -340,7 +336,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -356,7 +352,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Ensure no merge commits
         uses: NexusPHP/no-merge-commits@v2.2.1
@@ -385,7 +381,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -404,7 +400,7 @@ jobs:
       - run: cargo build
 
       - name: Upload artifact (Ubuntu)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: gleam
           path: target/debug/gleam
@@ -416,7 +412,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Deno
         uses: denoland/setup-deno@v2
@@ -434,7 +430,7 @@ jobs:
           rebar3-version: "3"
 
       - name: Download Gleam binary from previous job
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: gleam
           path: ./test
@@ -498,3 +494,11 @@ jobs:
       - name: test/unicode_path
         run: make
         working-directory: ./test/unicode_path ⭐
+
+      - name: test/assert
+        run: make test-all
+        working-directory: ./test/assert
+
+      - name: Test publishing with default main
+        run: ./test.sh
+        working-directory: ./test/publishing_default_main

.github/workflows/release-containers.yaml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           sparse-checkout: |
             .github/actions

.github/workflows/release-nightly.yaml

@@ -27,7 +27,7 @@ jobs:
     # TODO: Re-add
     # if: ${{ github.repository == 'gleam-lang/gleam' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: print latest_commit
         run: echo ${{ github.sha }}
 
@@ -56,6 +56,7 @@ jobs:
   build-release:
     name: build-release
     runs-on: ${{ matrix.os }}
+    environment: release
     outputs:
       release-id: ${{ steps.release.outputs.id }}
     strategy:
@@ -66,6 +67,7 @@ jobs:
           - x86_64-apple-darwin
           - aarch64-apple-darwin
           - x86_64-pc-windows-msvc
+          - aarch64-pc-windows-msvc
         toolchain: [ stable ]
         include:
           - os: ubuntu-latest
@@ -85,16 +87,20 @@ jobs:
             target: aarch64-apple-darwin
             expected-binary-architecture: arm64
             cargo-tool: cargo
-          - os: windows-latest
+          - os: windows-2022
             target: x86_64-pc-windows-msvc
             expected-binary-architecture: x86-64
             cargo-tool: cargo
+          - os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            expected-binary-architecture: arm64
+            cargo-tool: cargo
           - os: ubuntu-latest
             target: wasm32-unknown-unknown
             cargo-tool: wasm-pack
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Update versions
         shell: bash
@@ -109,12 +115,17 @@ jobs:
           target: ${{ matrix.target }}
           cargo-tool: ${{ matrix.cargo-tool }}
           expected-binary-architecture: ${{ matrix.expected-binary-architecture }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-trusted-signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          azure-certificate-profile-name: ${{ vars.AZURE_CERTIFICATE_PROFILE_NAME }}
 
       - name: Upload release archive
         id: release
         # https://github.com/softprops/action-gh-release/issues/445
         # uses: softprops/action-gh-release@v2
-        uses: softprops/action-gh-release@ab50eebb6488051c6788d97fa95232267c6a4e23
+        uses: softprops/action-gh-release@f2352b97da0095b4dbbd885a81023e3deabf4fef
         with:
           draft: false
           prerelease: true
@@ -148,7 +159,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           sparse-checkout: |
             .github/actions

.github/workflows/release.yaml

@@ -15,6 +15,7 @@ jobs:
   build-release:
     name: build-release
     runs-on: ${{ matrix.os }}
+    environment: release
     permissions:
       id-token: write
       attestations: write
@@ -43,7 +44,7 @@ jobs:
             cargo-tool: wasm-pack
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: "Build Archive"
         id: build
@@ -54,6 +55,11 @@ jobs:
           target: ${{ matrix.target }}
           cargo-tool: ${{ matrix.cargo-tool }}
           expected-binary-architecture: ${{ matrix.expected-binary-architecture }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-trusted-signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          azure-certificate-profile-name: ${{ vars.AZURE_CERTIFICATE_PROFILE_NAME }}
 
   create-release:
     name: create-release
@@ -62,12 +68,14 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    environment: release
+
     permissions:
       contents: write
 
     steps:
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           pattern: release-*
           merge-multiple: true