b26739d151
Reverts PR #44's approach of swapping GITHUB_TOKEN for a PAT on action-gh-release. That approach worked in principle but failed in practice during the v0.10.2 cut: HOMEBREW_TAP_GITHUB_TOKEN is a fine-grained PAT scoped only to razvandimescu/homebrew-tap, so when action-gh-release tried to create a release on razvandimescu/numa it got 403 Resource not accessible. v0.10.2 had to be recovered manually via `gh release create` from a user PAT. Root cause of the original bug (from #44): GitHub Actions deliberately does not propagate workflow events triggered by GITHUB_TOKEN, so a release created by GITHUB_TOKEN silently failed to fire homebrew-bump's `release: published` trigger. Fix: sidestep the event-propagation rule entirely by invoking homebrew-bump.yml directly as a reusable workflow via `workflow_call`. - release.yml: drop the `token:` override on action-gh-release (reverts to GITHUB_TOKEN default, which v0.10.0 and v0.10.1 used successfully) and add a new `bump-homebrew` job that `needs: release` and `uses:` homebrew-bump.yml with `secrets: inherit`. - homebrew-bump.yml: add `workflow_call` trigger with a `version` input, remove the `release: published` trigger (no longer needed), keep `workflow_dispatch` for manual recovery, and collapse the version determination step to a single `inputs.version` read. Each token now does exactly what its scope permits: - GITHUB_TOKEN creates the release on numa (contents: write, default) - HOMEBREW_TAP_GITHUB_TOKEN pushes to homebrew-tap (unchanged) The tap update becomes a child job in the release run, so failures are visible in one place instead of "why didn't the release event fire?" mysteries. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
118 lines
3.3 KiB
YAML
118 lines
3.3 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- target: x86_64-apple-darwin
|
|
os: macos-latest
|
|
name: numa-macos-x86_64
|
|
- target: aarch64-apple-darwin
|
|
os: macos-latest
|
|
name: numa-macos-aarch64
|
|
- target: x86_64-unknown-linux-musl
|
|
os: ubuntu-latest
|
|
name: numa-linux-x86_64
|
|
- target: aarch64-unknown-linux-musl
|
|
os: ubuntu-latest
|
|
name: numa-linux-aarch64
|
|
- target: x86_64-pc-windows-msvc
|
|
os: windows-latest
|
|
name: numa-windows-x86_64
|
|
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install musl tools (x86_64)
|
|
if: matrix.target == 'x86_64-unknown-linux-musl'
|
|
run: sudo apt-get update && sudo apt-get install -y musl-tools
|
|
|
|
- name: Install cross (aarch64)
|
|
if: matrix.target == 'aarch64-unknown-linux-musl'
|
|
run: cargo install cross
|
|
|
|
- name: Build (native)
|
|
if: matrix.target != 'aarch64-unknown-linux-musl'
|
|
run: cargo build --release --target ${{ matrix.target }}
|
|
|
|
- name: Build (cross)
|
|
if: matrix.target == 'aarch64-unknown-linux-musl'
|
|
run: cross build --release --target ${{ matrix.target }}
|
|
|
|
- name: Package (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: |
|
|
cd target/${{ matrix.target }}/release
|
|
tar czf ../../../${{ matrix.name }}.tar.gz numa
|
|
cd ../../..
|
|
sha256sum ${{ matrix.name }}.tar.gz > ${{ matrix.name }}.tar.gz.sha256 || shasum -a 256 ${{ matrix.name }}.tar.gz > ${{ matrix.name }}.tar.gz.sha256
|
|
|
|
- name: Package (Windows)
|
|
if: runner.os == 'Windows'
|
|
shell: pwsh
|
|
run: |
|
|
Compress-Archive -Path "target/${{ matrix.target }}/release/numa.exe" -DestinationPath "${{ matrix.name }}.zip"
|
|
(Get-FileHash "${{ matrix.name }}.zip" -Algorithm SHA256).Hash.ToLower() + " ${{ matrix.name }}.zip" | Out-File "${{ matrix.name }}.zip.sha256" -Encoding ascii
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ${{ matrix.name }}
|
|
path: |
|
|
${{ matrix.name }}.tar.gz
|
|
${{ matrix.name }}.tar.gz.sha256
|
|
${{ matrix.name }}.zip
|
|
${{ matrix.name }}.zip.sha256
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Publish to crates.io
|
|
run: cargo publish
|
|
env:
|
|
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
|
|
|
|
release:
|
|
needs: [build, publish]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
merge-multiple: true
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
generate_release_notes: true
|
|
files: |
|
|
*.tar.gz
|
|
*.zip
|
|
*.sha256
|
|
|
|
bump-homebrew:
|
|
needs: release
|
|
uses: ./.github/workflows/homebrew-bump.yml
|
|
with:
|
|
version: ${{ github.ref_name }}
|
|
secrets: inherit
|