wehub-resource-sync
256 lines
9.7 KiB
YAML
256 lines
9.7 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
concurrency: ${{ github.workflow }}-${{ github.ref }}
|
|
|
|
jobs:
|
|
check-release:
|
|
name: Check for new version
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
should_release: ${{ steps.check.outputs.should_release }}
|
|
needs_github_release: ${{ steps.check.outputs.needs_github_release }}
|
|
version: ${{ steps.check.outputs.version }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
- name: Compare package.json version to npm and check GitHub release
|
|
id: check
|
|
run: |
|
|
LOCAL_VERSION=$(node -p "require('./packages/native-sdk/package.json').version")
|
|
echo "Local version: $LOCAL_VERSION"
|
|
|
|
NPM_VERSION=$(npm view @native-sdk/cli version 2>/dev/null || echo "0.0.0")
|
|
echo "npm version: $NPM_VERSION"
|
|
|
|
if [ "$LOCAL_VERSION" != "$NPM_VERSION" ]; then
|
|
echo "Version changed: $NPM_VERSION -> $LOCAL_VERSION"
|
|
echo "should_release=true" >> "$GITHUB_OUTPUT"
|
|
echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "Version unchanged on npm, skipping publish"
|
|
echo "should_release=false" >> "$GITHUB_OUTPUT"
|
|
|
|
TAG="v$LOCAL_VERSION"
|
|
EXISTING_ASSETS=$(gh release view "$TAG" --json assets --jq '.assets[].name' 2>/dev/null || true)
|
|
missing=0
|
|
for asset in \
|
|
CHECKSUMS.txt \
|
|
native-sdk-darwin-arm64 \
|
|
native-sdk-darwin-x64 \
|
|
native-sdk-linux-arm64 \
|
|
native-sdk-linux-x64 \
|
|
native-sdk-linux-musl-arm64 \
|
|
native-sdk-linux-musl-x64 \
|
|
native-sdk-win32-arm64.exe \
|
|
native-sdk-win32-x64.exe
|
|
do
|
|
if ! printf '%s\n' "$EXISTING_ASSETS" | grep -Fx "$asset" >/dev/null; then
|
|
echo "Missing release asset: $asset"
|
|
missing=1
|
|
fi
|
|
done
|
|
|
|
if [ "$missing" -eq 0 ]; then
|
|
echo "GitHub release $TAG exists with native assets"
|
|
echo "needs_github_release=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "GitHub release $TAG is missing native assets, will create/update it"
|
|
echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
fi
|
|
|
|
echo "version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
github-release:
|
|
name: Create GitHub Release
|
|
needs: check-release
|
|
if: needs.check-release.outputs.needs_github_release == 'true'
|
|
runs-on: macos-14
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Zig
|
|
uses: mlugg/setup-zig@v2
|
|
with:
|
|
version: 0.16.0
|
|
|
|
- name: Extract changelog entry
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
awk '/<!-- release:start -->/{found=1; next} /<!-- release:end -->/{exit} found{print}' CHANGELOG.md > /tmp/release-notes.md
|
|
|
|
LINES=$(wc -l < /tmp/release-notes.md | tr -d ' ')
|
|
if [ "$LINES" -lt 2 ]; then
|
|
echo "Error: No release notes found between <!-- release:start --> and <!-- release:end --> markers in CHANGELOG.md"
|
|
exit 1
|
|
fi
|
|
echo "Extracted release notes for $VERSION ($LINES lines)"
|
|
|
|
- name: Build native release assets (all platforms)
|
|
run: |
|
|
# Cross-compiles the CLI for all eight platforms and writes the
|
|
# flat release assets + CHECKSUMS.txt into zig-out/release/.
|
|
bash packages/native-sdk/scripts/build-binaries.sh
|
|
|
|
- name: Create GitHub Release
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
TAG="v$VERSION"
|
|
|
|
if gh release view "$TAG" &>/dev/null; then
|
|
echo "Release $TAG already exists, updating assets"
|
|
else
|
|
echo "Creating release $TAG..."
|
|
gh release create "$TAG" \
|
|
--title "$TAG" \
|
|
--notes-file /tmp/release-notes.md
|
|
fi
|
|
|
|
gh release upload "$TAG" \
|
|
zig-out/release/native-sdk-* \
|
|
zig-out/release/CHECKSUMS.txt \
|
|
--clobber
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
publish:
|
|
name: Publish CLI to npm
|
|
needs: [check-release, github-release]
|
|
if: >-
|
|
always()
|
|
&& needs.check-release.outputs.should_release == 'true'
|
|
&& (needs.github-release.result == 'success' || needs.github-release.result == 'skipped')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: Release
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
# Publishing uses npm trusted publishing (OIDC): the job's id-token
|
|
# permission lets npm mint short-lived credentials, so no npm token
|
|
# secret exists anywhere in this repo. All nine packages —
|
|
# @native-sdk/cli plus the eight @native-sdk/cli-* platform packages
|
|
# under packages/native-sdk/npm/ — must each be configured on
|
|
# npmjs.com with a GitHub Actions trusted publisher pointing at
|
|
# repository vercel-labs/native, workflow release.yml,
|
|
# environment Release. If a package is missing that configuration,
|
|
# npm publish fails loudly with an OIDC authentication error before
|
|
# anything is uploaded for that package. Trusted publishing requires
|
|
# npm >= 11.5.1, satisfied by the npm bundled with Node 24.
|
|
# @native-sdk/core (packages/core) joins that publish set the moment
|
|
# its "private" flag drops (see the publish step below) — its
|
|
# npmjs.com trusted-publisher configuration must exist BEFORE that
|
|
# flip lands.
|
|
|
|
- name: Check version sync
|
|
run: npm --prefix packages/native-sdk run version:check
|
|
|
|
- name: Check package scripts
|
|
run: npm --prefix packages/native-sdk run scripts:check
|
|
|
|
- name: Download release binaries
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
mkdir -p /tmp/native-sdk-release
|
|
gh release download "v$VERSION" \
|
|
--pattern 'native-sdk-*' \
|
|
--pattern 'CHECKSUMS.txt' \
|
|
--dir /tmp/native-sdk-release
|
|
(cd /tmp/native-sdk-release && sha256sum -c CHECKSUMS.txt)
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Stage binaries into the platform packages
|
|
run: |
|
|
# Release-asset name -> npm platform package (same table as
|
|
# packages/native-sdk/scripts/build-binaries.sh).
|
|
stage() {
|
|
asset="$1"; key="$2"; ext="$3"
|
|
mkdir -p "packages/native-sdk/npm/$key/bin"
|
|
cp "/tmp/native-sdk-release/$asset" "packages/native-sdk/npm/$key/bin/native$ext"
|
|
chmod 755 "packages/native-sdk/npm/$key/bin/native$ext"
|
|
}
|
|
stage native-sdk-darwin-arm64 darwin-arm64 ""
|
|
stage native-sdk-darwin-x64 darwin-x64 ""
|
|
stage native-sdk-linux-arm64 linux-arm64-gnu ""
|
|
stage native-sdk-linux-x64 linux-x64-gnu ""
|
|
stage native-sdk-linux-musl-arm64 linux-arm64-musl ""
|
|
stage native-sdk-linux-musl-x64 linux-x64-musl ""
|
|
stage native-sdk-win32-arm64.exe win32-arm64 ".exe"
|
|
stage native-sdk-win32-x64.exe win32-x64 ".exe"
|
|
|
|
- name: Publish to npm
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
|
|
# Platform packages first, so the main package's
|
|
# optionalDependencies pins are resolvable the moment it lands.
|
|
# Re-runs skip anything already on the registry at this version.
|
|
publish_dir() {
|
|
dir="$1"
|
|
name=$(node -p "require('./$dir/package.json').name")
|
|
if npm view "$name@$VERSION" version >/dev/null 2>&1; then
|
|
echo "$name@$VERSION already published, skipping"
|
|
return 0
|
|
fi
|
|
(cd "$dir" && npm publish --provenance --access public)
|
|
}
|
|
|
|
for dir in packages/native-sdk/npm/*/; do
|
|
publish_dir "${dir%/}"
|
|
done
|
|
|
|
# @native-sdk/core (packages/core) rides the same version and
|
|
# release gate as the CLI (sync-version.js stamps it; the
|
|
# version check above refuses a half-bumped tree).
|
|
#
|
|
# ============================ LOUD FLIP REQUIREMENT ==========
|
|
# packages/core/package.json keeps "private": true until the
|
|
# 0.5.0 cut BY DESIGN, and that field IS the publish switch:
|
|
# while private, the guard below skips the package (npm would
|
|
# refuse to publish it anyway); the 0.5.0 change that drops
|
|
# "private" makes this same step start publishing it with no
|
|
# workflow edit. Before dropping the flag, configure the
|
|
# @native-sdk/core trusted publisher on npmjs.com (see the note
|
|
# above) or the first public release fails here.
|
|
# =============================================================
|
|
if [ "$(node -p "require('./packages/core/package.json').private === true")" = "true" ]; then
|
|
echo "@native-sdk/core is private (pre-0.5.0): skipping publish by design"
|
|
else
|
|
publish_dir packages/core
|
|
fi
|
|
|
|
publish_dir packages/native-sdk
|