Release Client Binaries #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Client Binaries | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version without v prefix (e.g. 1.20.5)' | |
| required: true | |
| type: string | |
| release_tag: | |
| description: 'GitHub release tag (e.g. v1.20.5)' | |
| required: true | |
| type: string | |
| target_repo: | |
| description: 'GitHub repo to attach binaries to' | |
| required: false | |
| default: terraphim-ai | |
| type: string | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build-binaries: | |
| name: Build client binaries for ${{ matrix.target }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # GitHub-hosted Linux: terraphim-ai self-hosted runners are repo-scoped. | |
| - os: ubuntu-22.04 | |
| target: x86_64-unknown-linux-gnu | |
| use_cross: false | |
| - os: ubuntu-22.04 | |
| target: x86_64-unknown-linux-musl | |
| use_cross: true | |
| - os: ubuntu-22.04 | |
| target: aarch64-unknown-linux-musl | |
| use_cross: true | |
| - os: macos-latest | |
| target: x86_64-apple-darwin | |
| use_cross: false | |
| - os: macos-latest | |
| target: aarch64-apple-darwin | |
| use_cross: false | |
| - os: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| use_cross: false | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| CARGO_REGISTRIES_TERRAPHIM_TOKEN: ${{ secrets.CARGO_REGISTRIES_TERRAPHIM_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Install zig | |
| if: contains(matrix.target, 'apple-darwin') || contains(matrix.target, 'windows') | |
| shell: bash | |
| run: | | |
| if command -v zig &>/dev/null; then exit 0; fi | |
| if command -v brew &>/dev/null; then brew install zig; fi | |
| if command -v choco &>/dev/null; then choco install zig -y; fi | |
| - name: Install cross | |
| if: matrix.use_cross | |
| run: | | |
| if command -v cross &>/dev/null; then | |
| cross --version | |
| exit 0 | |
| fi | |
| rustup run stable cargo install cross --locked --git https://github.com/cross-rs/cross | |
| - uses: Swatinem/rust-cache@v2 | |
| if: matrix.target != 'x86_64-unknown-linux-gnu' | |
| with: | |
| key: clients-${{ matrix.target }} | |
| - name: Build client binaries | |
| run: | | |
| if [ "${{ matrix.use_cross }}" = "true" ]; then | |
| BUILD="rustup run stable cross" | |
| else | |
| BUILD="rustup run stable cargo" | |
| fi | |
| $BUILD build --release --target ${{ matrix.target }} -p terraphim_agent --bin terraphim-agent | |
| $BUILD build --release --target ${{ matrix.target }} -p terraphim_cli --bin terraphim-cli | |
| $BUILD build --release --target ${{ matrix.target }} -p terraphim_grep --bin terraphim-grep --features "code-search openrouter" | |
| - name: Package artifacts (Unix) | |
| if: matrix.os != 'windows-latest' | |
| env: | |
| VERSION: ${{ inputs.version }} | |
| run: | | |
| mkdir -p artifacts | |
| tar -czf "artifacts/terraphim-agent-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-agent | |
| tar -czf "artifacts/terraphim-cli-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-cli | |
| tar -czf "artifacts/terraphim-grep-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-grep | |
| cp target/${{ matrix.target }}/release/terraphim-agent artifacts/terraphim-agent-${{ matrix.target }} | |
| cp target/${{ matrix.target }}/release/terraphim-cli artifacts/terraphim-cli-${{ matrix.target }} | |
| cp target/${{ matrix.target }}/release/terraphim-grep artifacts/terraphim-grep-${{ matrix.target }} | |
| chmod +x artifacts/* | |
| - name: Package artifacts (Windows) | |
| if: matrix.os == 'windows-latest' | |
| shell: bash | |
| env: | |
| VERSION: ${{ inputs.version }} | |
| run: | | |
| mkdir -p artifacts | |
| cd "target/${{ matrix.target }}/release" | |
| 7z a -tzip "../../../artifacts/terraphim-agent-${VERSION}-${{ matrix.target }}.zip" terraphim-agent.exe | |
| 7z a -tzip "../../../artifacts/terraphim-cli-${VERSION}-${{ matrix.target }}.zip" terraphim-cli.exe | |
| 7z a -tzip "../../../artifacts/terraphim-grep-${VERSION}-${{ matrix.target }}.zip" terraphim-grep.exe | |
| cd - | |
| cp target/${{ matrix.target }}/release/terraphim-agent.exe artifacts/terraphim-agent-${{ matrix.target }}.exe | |
| cp target/${{ matrix.target }}/release/terraphim-cli.exe artifacts/terraphim-cli-${{ matrix.target }}.exe | |
| cp target/${{ matrix.target }}/release/terraphim-grep.exe artifacts/terraphim-grep-${{ matrix.target }}.exe | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: client-binaries-${{ matrix.target }} | |
| path: artifacts/* | |
| create-universal-macos: | |
| name: Create macOS universal client binaries | |
| needs: build-binaries | |
| if: always() && needs.build-binaries.result != 'cancelled' | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: client-binaries-x86_64-apple-darwin | |
| path: x86_64 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: client-binaries-aarch64-apple-darwin | |
| path: aarch64 | |
| - run: | | |
| mkdir -p universal | |
| lipo -create x86_64/terraphim-agent-x86_64-apple-darwin aarch64/terraphim-agent-aarch64-apple-darwin -output universal/terraphim-agent-universal-apple-darwin | |
| lipo -create x86_64/terraphim-grep-x86_64-apple-darwin aarch64/terraphim-grep-aarch64-apple-darwin -output universal/terraphim-grep-universal-apple-darwin | |
| chmod +x universal/* | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: client-binaries-universal-apple-darwin | |
| path: universal/* | |
| sign-and-notarize-macos: | |
| name: Sign and notarize macOS client binaries | |
| needs: create-universal-macos | |
| if: always() && needs.create-universal-macos.result == 'success' | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: client-binaries-universal-apple-darwin | |
| path: universal | |
| - uses: 1password/install-cli-action@v2 | |
| - name: Load signing credentials | |
| env: | |
| OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| echo "APPLE_ID=$(op read 'op://TerraphimPlatform/apple.developer.credentials/username' --no-newline)" >> $GITHUB_ENV | |
| echo "APPLE_TEAM_ID=$(op read 'op://TerraphimPlatform/apple.developer.credentials/APPLE_TEAM_ID' --no-newline)" >> $GITHUB_ENV | |
| echo "APPLE_APP_PASSWORD=$(op read 'op://TerraphimPlatform/apple.developer.credentials/APPLE_APP_SPECIFIC_PASSWORD' --no-newline)" >> $GITHUB_ENV | |
| echo "CERT_BASE64=$(op read 'op://TerraphimPlatform/apple.developer.certificate/base64' --no-newline)" >> $GITHUB_ENV | |
| echo "CERT_PASSWORD=$(op read 'op://TerraphimPlatform/apple.developer.certificate/password' --no-newline)" >> $GITHUB_ENV | |
| - name: Sign and notarize agent and grep | |
| env: | |
| RUNNER_TEMP: ${{ runner.temp }} | |
| run: | | |
| chmod +x scripts/sign-macos-binary.sh | |
| ./scripts/sign-macos-binary.sh universal/terraphim-agent-universal-apple-darwin "$APPLE_ID" "$APPLE_TEAM_ID" "$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD" | |
| ./scripts/sign-macos-binary.sh universal/terraphim-grep-universal-apple-darwin "$APPLE_ID" "$APPLE_TEAM_ID" "$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: client-binaries-signed-universal-apple-darwin | |
| path: universal/* | |
| upload-to-target-release: | |
| name: Attach client binaries to terraphim-ai release | |
| needs: [build-binaries, sign-and-notarize-macos] | |
| if: always() && needs.build-binaries.result == 'success' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| pattern: client-binaries* | |
| path: release-assets | |
| merge-multiple: true | |
| - name: Upload to target GitHub release | |
| env: | |
| GH_TOKEN: ${{ secrets.TERRAPHIM_AI_RELEASE_TOKEN || secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="${{ inputs.release_tag }}" | |
| REPO="terraphim/${{ inputs.target_repo }}" | |
| find release-assets -type f | sort | |
| gh release upload "$TAG" release-assets/* --repo "$REPO" --clobber |