From f56a8f9947df62306e351c272f20799c9d647add Mon Sep 17 00:00:00 2001 From: Elias Wendland <193786789+eliaswen@users.noreply.github.com> Date: Fri, 17 Jul 2026 11:32:20 +0200 Subject: [PATCH] Release 0.2.0 --- .github/workflows/release.yml | 104 +++++++++++++++++++++++++++------- 1 file changed, 84 insertions(+), 20 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 04feaed..463c1f8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,13 +11,21 @@ jobs: match: ${{ steps.check.outputs.match }} version: ${{ steps.check.outputs.version }} steps: + - uses: actions/checkout@v4 + - name: Check commit message id: check + env: + COMMIT_MSG: ${{ github.event.head_commit.message }} run: | - COMMIT_MSG="${{ github.event.head_commit.message }}" if echo "$COMMIT_MSG" | grep -Eq 'Release [vV]?[0-9]+\.[0-9]+\.[0-9]+'; then # Strips "Release " and an optional "v" or "V" to isolate just the numbers VERSION=$(echo "$COMMIT_MSG" | grep -Eo 'Release [vV]?[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed -E 's/Release [vV]?//') + PACKAGE_VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1) + if [ "$VERSION" != "$PACKAGE_VERSION" ]; then + echo "Release version $VERSION does not match Cargo.toml version $PACKAGE_VERSION" >&2 + exit 1 + fi echo "match=true" >> $GITHUB_OUTPUT echo "version=$VERSION" >> $GITHUB_OUTPUT else @@ -125,10 +133,20 @@ jobs: with: targets: x86_64-unknown-linux-gnu - - name: Install build dependencies + - name: Cache cargo + uses: Swatinem/rust-cache@v2 + with: + key: package-${{ matrix.type }}-gnu + + - name: Install cargo-deb + if: matrix.type == 'deb' uses: taiki-e/install-action@v2 with: - tool: cargo-deb,cargo-generate-rpm + tool: cargo-deb + + - name: Install cargo-generate-rpm + if: matrix.type == 'rpm' + run: cargo install cargo-generate-rpm - name: Download compiled binary uses: actions/download-artifact@v3 @@ -152,6 +170,7 @@ jobs: fi - name: Import GPG key + if: matrix.type == 'rpm' uses: crazy-max/ghaction-import-gpg@v6 id: import-gpg with: @@ -159,14 +178,31 @@ jobs: passphrase: ${{ secrets.GPG_PASSPHRASE }} - name: Sign packages + if: matrix.type == 'rpm' + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | - if [ "${{ matrix.type }}" = "rpm" ]; then - sudo apt-get update - sudo apt-get install -y rpm - echo "%_signature gpg" > ~/.rpmmacros - echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros - rpm --addsign dist/*.rpm - fi + sudo apt-get update + sudo apt-get install -y rpm + + PASSPHRASE_FILE=$(mktemp) + PUBLIC_KEY_FILE=$(mktemp) + trap 'rm -f "$PASSPHRASE_FILE" "$PUBLIC_KEY_FILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSPHRASE_FILE" + chmod 600 "$PASSPHRASE_FILE" + + echo "%_signature gpg" > ~/.rpmmacros + echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros + echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros + echo "%_gpg_passphrase_file $PASSPHRASE_FILE" >> ~/.rpmmacros + echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros + + rpm --addsign dist/*.rpm + gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$PUBLIC_KEY_FILE" + sudo rpm --import "$PUBLIC_KEY_FILE" + SIGNATURE_CHECK=$(rpm --checksig --verbose dist/*.rpm) + echo "$SIGNATURE_CHECK" + echo "$SIGNATURE_CHECK" | grep -Eq '[Ss]ignature.*: OK' - name: Upload Package Artifact uses: actions/upload-artifact@v3 @@ -188,10 +224,20 @@ jobs: with: targets: x86_64-unknown-linux-musl - - name: Install build dependencies + - name: Cache cargo + uses: Swatinem/rust-cache@v2 + with: + key: package-${{ matrix.type }}-musl + + - name: Install cargo-deb + if: matrix.type == 'deb' uses: taiki-e/install-action@v2 with: - tool: cargo-deb,cargo-generate-rpm + tool: cargo-deb + + - name: Install cargo-generate-rpm + if: matrix.type == 'rpm' + run: cargo install cargo-generate-rpm - name: Download compiled binary uses: actions/download-artifact@v3 @@ -215,6 +261,7 @@ jobs: fi - name: Import GPG key + if: matrix.type == 'rpm' uses: crazy-max/ghaction-import-gpg@v6 id: import-gpg with: @@ -222,14 +269,31 @@ jobs: passphrase: ${{ secrets.GPG_PASSPHRASE }} - name: Sign packages + if: matrix.type == 'rpm' + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | - if [ "${{ matrix.type }}" = "rpm" ]; then - sudo apt-get update - sudo apt-get install -y rpm - echo "%_signature gpg" > ~/.rpmmacros - echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros - rpm --addsign dist/*.rpm - fi + sudo apt-get update + sudo apt-get install -y rpm + + PASSPHRASE_FILE=$(mktemp) + PUBLIC_KEY_FILE=$(mktemp) + trap 'rm -f "$PASSPHRASE_FILE" "$PUBLIC_KEY_FILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSPHRASE_FILE" + chmod 600 "$PASSPHRASE_FILE" + + echo "%_signature gpg" > ~/.rpmmacros + echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros + echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros + echo "%_gpg_passphrase_file $PASSPHRASE_FILE" >> ~/.rpmmacros + echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros + + rpm --addsign dist/*.rpm + gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$PUBLIC_KEY_FILE" + sudo rpm --import "$PUBLIC_KEY_FILE" + SIGNATURE_CHECK=$(rpm --checksig --verbose dist/*.rpm) + echo "$SIGNATURE_CHECK" + echo "$SIGNATURE_CHECK" | grep -Eq '[Ss]ignature.*: OK' - name: Upload Package Artifact uses: actions/upload-artifact@v3 @@ -316,4 +380,4 @@ jobs: echo "Upload failed with HTTP $HTTP_CODE" exit 1 fi - done \ No newline at end of file + done