mirror of
https://github.com/storytold/vectorcraft.git
synced 2026-11-08 16:30:41 +00:00
Luis
21249399c6
About > Contributors still showed an old snapshot, because nothing regenerated contributors/contributors.json before a release. Opt in to the shared refresh from craft-common-actions: a read-only credits job regenerates the snapshot for the release commit, and the shared release workflow installs it before every source build. The snapshot is not committed back.
98 lines
4.1 KiB
YAML
98 lines
4.1 KiB
YAML
# Release pipeline: every push to `release` builds signed installers for every platform and
|
|
# creates or updates the draft GitHub Release "VectorCraft v<version>". See docs/releasing.md.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [release]
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version override for a test run, e.g. 0.2.0-rc.1 (empty: Cargo.toml)"
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
# Regenerates contributors/contributors.json for the release commit; every build bundles it.
|
|
credits:
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
|
|
git-sources:
|
|
name: Git dependencies come from storytold
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Git dependencies come from storytold
|
|
run: |
|
|
set -euo pipefail
|
|
test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
|
|
# Source replacement, patches and path overrides in cargo config never show up
|
|
# in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
|
|
# Cargo still reads the legacy .cargo/config.
|
|
python3 - <<'PY'
|
|
import os, sys, tomllib
|
|
for path in (".cargo/config", ".cargo/config.toml"):
|
|
if not os.path.exists(path):
|
|
continue
|
|
config = tomllib.load(open(path, "rb"))
|
|
replaced = [name for name, source in config.get("source", {}).items()
|
|
if isinstance(source, dict) and "replace-with" in source]
|
|
if replaced or "patch" in config or "paths" in config:
|
|
print(f"{path} replaces, patches or overrides a source")
|
|
sys.exit(1)
|
|
PY
|
|
# Fails when Cargo.lock is out of date with the manifests.
|
|
cargo metadata --locked --format-version 1 > /dev/null
|
|
python3 - <<'PY'
|
|
import sys, tomllib
|
|
lock = tomllib.load(open("Cargo.lock", "rb"))
|
|
bad = sorted({p["source"] for p in lock.get("package", [])
|
|
if p.get("source", "").startswith("git+")
|
|
and not p["source"].startswith("git+https://github.com/storytold/")})
|
|
if bad:
|
|
print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
|
|
sys.exit(1)
|
|
PY
|
|
|
|
release:
|
|
needs: [git-sources, credits]
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
# Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
|
|
uses: storytold/craft-common-actions/.github/workflows/release.yml@main
|
|
with:
|
|
app-name: vectorcraft
|
|
app-title: VectorCraft
|
|
craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
|
|
web-craft-fonts: true
|
|
version: ${{ inputs.version }}
|
|
contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
|
|
secrets:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
|
|
WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
|
|
AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
|
|
LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
|
|
AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|