|
| 1 | +name: release.shred-proxy |
| 2 | + |
| 3 | +# Builds the standalone `shred-proxy` binary as a static linux/amd64 (musl) executable and |
| 4 | +# publishes it to GitHub Releases. The install one-liner (scripts served at |
| 5 | +# https://get.doublezero.xyz/shred-proxy) downloads this asset. |
| 6 | +# |
| 7 | +# Triggered by a namespaced tag `shred-proxy-vX.Y.Z` (so it never collides with the bridge's |
| 8 | +# Docker release tags), or manually via workflow_dispatch for a smoke build. |
| 9 | +on: |
| 10 | + push: |
| 11 | + tags: |
| 12 | + - "shred-proxy-v*" |
| 13 | + workflow_dispatch: |
| 14 | + inputs: |
| 15 | + tag: |
| 16 | + description: "Release tag to publish to (e.g. shred-proxy-v0.1.0); blank = build-only" |
| 17 | + required: false |
| 18 | + default: "" |
| 19 | + |
| 20 | +permissions: |
| 21 | + contents: read |
| 22 | + |
| 23 | +env: |
| 24 | + TARGET: x86_64-unknown-linux-musl |
| 25 | + ASSET: shred-proxy-x86_64-unknown-linux-musl |
| 26 | + |
| 27 | +jobs: |
| 28 | + build: |
| 29 | + runs-on: ubuntu-latest |
| 30 | + # `contents: write` is needed to create/upload the GitHub Release. The publish step itself is |
| 31 | + # gated on a non-empty tag, so a plain workflow_dispatch smoke build grants the scope but never |
| 32 | + # writes anything. |
| 33 | + permissions: |
| 34 | + contents: write |
| 35 | + steps: |
| 36 | + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
| 37 | + |
| 38 | + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master |
| 39 | + with: |
| 40 | + toolchain: stable |
| 41 | + targets: x86_64-unknown-linux-musl |
| 42 | + |
| 43 | + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 |
| 44 | + |
| 45 | + # musl-tools provides the `musl-gcc` linker driver used for the static target. |
| 46 | + - name: Install musl tools |
| 47 | + run: sudo apt-get update && sudo apt-get install -y --no-install-recommends musl-tools |
| 48 | + |
| 49 | + # Gate the release on the test suite: never publish a binary the tests haven't passed for. |
| 50 | + # Run on the host target (not musl) so the tests execute natively. |
| 51 | + - name: Test |
| 52 | + run: cargo test --locked -p shred-proxy |
| 53 | + |
| 54 | + - name: Build (static, release) |
| 55 | + run: cargo build --release --locked -p shred-proxy --target "${TARGET}" |
| 56 | + |
| 57 | + - name: Stage artifact + checksum |
| 58 | + id: stage |
| 59 | + run: | |
| 60 | + set -euo pipefail |
| 61 | + mkdir -p dist |
| 62 | + cp "target/${TARGET}/release/shred-proxy" "dist/${ASSET}" |
| 63 | + # Assert (not just print) that it really is static — a dynamic build would fail on hosts |
| 64 | + # without the same libc, so a non-static artifact must fail the release, not ship silently. |
| 65 | + file "dist/${ASSET}" |
| 66 | + if ! file "dist/${ASSET}" | grep -q 'statically linked'; then |
| 67 | + echo "error: ${ASSET} is not statically linked — refusing to publish" >&2 |
| 68 | + exit 1 |
| 69 | + fi |
| 70 | + ( cd dist && sha256sum "${ASSET}" > SHA256SUMS ) |
| 71 | + cat dist/SHA256SUMS |
| 72 | +
|
| 73 | + - name: Upload workflow artifact |
| 74 | + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 |
| 75 | + with: |
| 76 | + name: shred-proxy-${{ env.TARGET }} |
| 77 | + path: dist/* |
| 78 | + |
| 79 | + # Resolve the release tag: the pushed tag on a tag push, or the dispatch input otherwise. |
| 80 | + - name: Resolve tag |
| 81 | + id: tag |
| 82 | + # The dispatch input is untrusted; pass it via env rather than interpolating `${{ }}` into |
| 83 | + # the shell (avoids command injection), matching the repo's other workflows. |
| 84 | + env: |
| 85 | + EVENT_NAME: ${{ github.event_name }} |
| 86 | + INPUT_TAG: ${{ github.event.inputs.tag }} |
| 87 | + run: | |
| 88 | + set -euo pipefail |
| 89 | + if [ "${EVENT_NAME}" = "push" ]; then |
| 90 | + tag="${GITHUB_REF_NAME}" |
| 91 | + else |
| 92 | + tag="${INPUT_TAG}" |
| 93 | + fi |
| 94 | + # Validate the tag before it can drive a publish: the workflow_dispatch input is arbitrary, |
| 95 | + # and `gh release create` would otherwise mint a non-namespaced tag pointing at this build's |
| 96 | + # commit. A blank tag is allowed (build-only smoke run); a non-blank one must be namespaced. |
| 97 | + if [ -n "${tag}" ] && ! printf '%s' "${tag}" | grep -Eq '^shred-proxy-v[0-9]'; then |
| 98 | + echo "error: release tag '${tag}' must match 'shred-proxy-v<major>...'; refusing to publish" >&2 |
| 99 | + exit 1 |
| 100 | + fi |
| 101 | + echo "tag=${tag}" >> "$GITHUB_OUTPUT" |
| 102 | +
|
| 103 | + - name: Publish to GitHub Releases |
| 104 | + if: steps.tag.outputs.tag != '' |
| 105 | + env: |
| 106 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 107 | + TAG: ${{ steps.tag.outputs.tag }} |
| 108 | + BUILD_SHA: ${{ github.sha }} |
| 109 | + run: | |
| 110 | + set -euo pipefail |
| 111 | + # Create the release if it doesn't exist yet, then (re)upload the assets. `--target` pins a |
| 112 | + # newly-minted tag (workflow_dispatch, where the tag doesn't exist yet) to the exact commit |
| 113 | + # that was built, not default-branch HEAD; on a tag push the tag already resolves to its |
| 114 | + # commit so --target is a no-op. |
| 115 | + if ! gh release view "${TAG}" >/dev/null 2>&1; then |
| 116 | + gh release create "${TAG}" \ |
| 117 | + --target "${BUILD_SHA}" \ |
| 118 | + --title "${TAG}" \ |
| 119 | + --notes "Standalone shred-proxy binary (static linux/amd64). Install: curl -fsSL https://get.doublezero.xyz/shred-proxy | bash" |
| 120 | + fi |
| 121 | + gh release upload "${TAG}" "dist/${ASSET}" "dist/SHA256SUMS" --clobber |
0 commit comments