ci(windows): revert cosign-test decoy to where.exe now that install.p… #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag-driven: pushing a vX.Y.Z tag builds the cross matrix and publishes it. | |
| # Nothing here runs on an ordinary push, so a release is always a deliberate | |
| # act rather than a side effect of landing on main. | |
| on: | |
| push: | |
| tags: ["v*"] | |
| # Read by default; only the publishing job widens to contents: write, and | |
| # only far enough to create a release. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Native darwin/amd64 + darwin/arm64 build, kept as its own job because | |
| # it needs an actual macOS runner: zig (what the linux/windows matrix | |
| # below uses) cannot supply a macOS SDK, so darwin has never been part of | |
| # `make cross`'s own matrix (docs/INSTALL.md § Cross builds). A real Mac's | |
| # own clang/SDK builds both darwin arches natively, no cross-compilation | |
| # toolchain needed at all -- see Makefile's cross-darwin target. | |
| release-darwin: | |
| name: build darwin (macOS runner) | |
| runs-on: macos-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7 | |
| # Same reason the linux/windows job installs this: without it | |
| # cross-darwin still builds, just SQL-less (docs/INSTALL.md § SQL | |
| # support). Kept in sync with that job's own step on purpose -- | |
| # skipping it here would ship a darwin artifact silently missing the | |
| # grammar its linux/windows siblings carry. | |
| - run: npm install -g tree-sitter-cli | |
| - run: make cross-darwin | |
| # Only the runner's own native arch can be exec'd directly -- | |
| # macos-latest is Apple Silicon (arm64) as of this writing, so the | |
| # amd64 artifact is verified by `file` alone (a real Intel Mac or | |
| # Rosetta would be needed to run it, neither of which this step | |
| # assumes). `uname -m` rather than a hardcoded arch, so this keeps | |
| # working the day GitHub's own default flips. | |
| - name: smoke-test the native-arch artifact | |
| run: | | |
| case "$(uname -m)" in | |
| arm64) suffix=darwin-arm64 ;; | |
| x86_64) suffix=darwin-amd64 ;; | |
| *) echo "::error::unrecognized runner arch $(uname -m)"; exit 1 ;; | |
| esac | |
| native=$(find dist -name "*-$suffix" -type f) | |
| chmod +x "$native" | |
| "$native" --version | |
| "$native" languages | grep -q '^sql' || { | |
| echo "::error::darwin artifact has no sql grammar"; exit 1; | |
| } | |
| for bin in dist/rgit-*-darwin-*; do file "$bin"; done | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.6.2 | |
| with: | |
| name: darwin-binaries | |
| path: dist/rgit-*-darwin-* | |
| if-no-files-found: error | |
| release: | |
| name: build and publish | |
| needs: release-darwin | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write | |
| id-token: write # keyless cosign signing (Sigstore OIDC) | |
| steps: | |
| # fetch-depth: 0 because the Makefile stamps the binary from | |
| # `git describe --tags`, which reports a bare vX.Y.Z only when the tag | |
| # and its history are both present. A shallow checkout would ship | |
| # binaries versioned as a bare SHA. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7 | |
| # zig is the single cross-compilation toolchain `make cross` drives; | |
| # rgit links tree-sitter through cgo, so CGO_ENABLED=0 is not an | |
| # option and every target needs a real C compiler | |
| # (docs/INSTALL.md § Cross builds). | |
| - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 | |
| # The tree-sitter CLI is what lets the release carry SQL support: the | |
| # grammar module ships no usable parser.c, so `make cross` generates | |
| # one via cmd/rgit-install. Without this step every artifact would | |
| # still build, just SQL-less (docs/INSTALL.md § SQL support). | |
| - run: npm install -g tree-sitter-cli | |
| - run: make cross | |
| # Fail loudly rather than publishing a release whose binaries quietly | |
| # lack the grammar this workflow installed a toolchain for. | |
| - name: verify the linux/amd64 artifact carries SQL | |
| run: | | |
| bin=$(find dist -name '*-linux-amd64' -type f) | |
| chmod +x "$bin" | |
| "$bin" --version | |
| "$bin" languages | grep -q '^sql' || { | |
| echo "::error::release artifact has no sql grammar"; exit 1; | |
| } | |
| # linux/amd64 above is the runner's own native arch, execed directly. | |
| # linux/arm64 cannot be: it is dynamically linked against glibc | |
| # (rgit links tree-sitter through cgo, so this is not a static Go | |
| # binary), and bare QEMU user-mode emulation has no aarch64 sysroot | |
| # to resolve /lib/ld-linux-aarch64.so.1 against on an amd64 host -- | |
| # confirmed directly (`qemu-aarch64 ./rgit-...-linux-arm64` fails | |
| # with exactly that "could not open" error). Registering QEMU's | |
| # binfmt_misc handlers and running the binary *inside* a real | |
| # arm64 container image is what actually works: the image supplies | |
| # the matching glibc, and QEMU (via binfmt) transparently emulates | |
| # the container's own arm64 process for it -- the same mechanism | |
| # `docker buildx` uses for multi-arch image builds, just running a | |
| # bare binary instead of a build. Verified directly against this | |
| # exact artifact before writing this step, not assumed from how | |
| # QEMU emulation is commonly described. | |
| - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| with: | |
| platforms: arm64 | |
| - name: verify the linux/arm64 artifact carries SQL | |
| run: | | |
| bin=$(find dist -name '*-linux-arm64' -type f) | |
| docker run --rm --platform=linux/arm64 -v "$PWD/dist:/dist" debian:bookworm-slim \ | |
| /dist/"$(basename "$bin")" --version | |
| docker run --rm --platform=linux/arm64 -v "$PWD/dist:/dist" debian:bookworm-slim \ | |
| /dist/"$(basename "$bin")" languages | grep -q '^sql' || { | |
| echo "::error::release artifact has no sql grammar"; exit 1; | |
| } | |
| # Wine runs the windows/amd64 PE binary directly on the linux runner. | |
| # Not preinstalled on ubuntu-latest (actions/runner-images' own | |
| # software manifest), unlike shellcheck/sha256sum above -- installed | |
| # here rather than via a marketplace action, since it is a single | |
| # well-known apt package and this workflow already prefers plain | |
| # `run:` steps over an action wherever apt covers it in one line. | |
| # The apt package is "wine64" but the binary it installs is plain | |
| # "wine" -- confirmed directly (`dpkg -L wine64` lists /usr/bin/wine, | |
| # no wine64 binary at all on Ubuntu 24.04), a real trap the package | |
| # name alone does not warn you about. | |
| - name: install wine | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y wine64 | |
| # First run is noisy on stderr -- wine lazily creates ~/.wine and | |
| # spawns its own explorer/services helper processes, which complain | |
| # about a missing display and missing 32-bit support (wine32, | |
| # irrelevant to a console-only 64-bit exe like this one). That noise | |
| # never reaches stdout, so it does not affect the grep below; | |
| # confirmed directly rather than assumed, since a wall of "err:" | |
| # lines looks alarming enough to mistake for a real failure. | |
| - name: verify the windows/amd64 artifact carries SQL | |
| run: | | |
| bin=$(find dist -name '*-windows-amd64.exe' -type f) | |
| wine "$bin" --version | |
| wine "$bin" languages | grep -q '^sql' || { | |
| echo "::error::release artifact has no sql grammar"; exit 1; | |
| } | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0 | |
| with: | |
| name: darwin-binaries | |
| path: dist | |
| # make cross's own SHA256SUMS (above) only ever covers the three | |
| # files it just built -- regenerated here, over whatever dist/ holds | |
| # once the darwin job's artifacts have landed alongside them, so the | |
| # published checksums and signature cover every artifact this release | |
| # actually ships, darwin included. | |
| - name: regenerate SHA256SUMS over every artifact | |
| run: | | |
| cd dist | |
| chmod +x rgit-*-darwin-* | |
| sha256sum rgit-* > SHA256SUMS | |
| - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| # Keyless: signs with a short-lived OIDC-issued cert instead of a | |
| # managed private key, so there is no signing key to rotate or leak. | |
| # Signs SHA256SUMS, not each binary -- the checksums already commit to | |
| # every artifact's contents, one signature covers the whole release. | |
| - name: sign checksums | |
| run: cosign sign-blob --yes --bundle dist/SHA256SUMS.sigstore.json dist/SHA256SUMS | |
| - name: publish | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" dist/* \ | |
| --title "$GITHUB_REF_NAME" \ | |
| --generate-notes |