Release 0.2.0

.github/workflows/release.yml

@@ -11,13 +11,21 @@ jobs:
       match: ${{ steps.check.outputs.match }}
       version: ${{ steps.check.outputs.version }}
     steps:
+      - uses: actions/checkout@v4
+
       - name: Check commit message
         id: check
+        env:
+          COMMIT_MSG: ${{ github.event.head_commit.message }}
         run: |
-          COMMIT_MSG="${{ github.event.head_commit.message }}"
           if echo "$COMMIT_MSG" | grep -Eq 'Release [vV]?[0-9]+\.[0-9]+\.[0-9]+'; then
             # Strips "Release " and an optional "v" or "V" to isolate just the numbers
             VERSION=$(echo "$COMMIT_MSG" | grep -Eo 'Release [vV]?[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed -E 's/Release [vV]?//')
+            PACKAGE_VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)
+            if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
+              echo "Release version $VERSION does not match Cargo.toml version $PACKAGE_VERSION" >&2
+              exit 1
+            fi
             echo "match=true" >> $GITHUB_OUTPUT
             echo "version=$VERSION" >> $GITHUB_OUTPUT
           else
@@ -125,10 +133,20 @@ jobs:
         with:
           targets: x86_64-unknown-linux-gnu
 
-      - name: Install build dependencies
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: package-${{ matrix.type }}-gnu
+
+      - name: Install cargo-deb
+        if: matrix.type == 'deb'
         uses: taiki-e/install-action@v2
         with:
-          tool: cargo-deb,cargo-generate-rpm
+          tool: cargo-deb
+
+      - name: Install cargo-generate-rpm
+        if: matrix.type == 'rpm'
+        run: cargo install cargo-generate-rpm
 
       - name: Download compiled binary
         uses: actions/download-artifact@v3
@@ -152,6 +170,7 @@ jobs:
           fi
 
       - name: Import GPG key
+        if: matrix.type == 'rpm'
         uses: crazy-max/ghaction-import-gpg@v6
         id: import-gpg
         with:
@@ -159,14 +178,31 @@ jobs:
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Sign packages
+        if: matrix.type == 'rpm'
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: |
-            if [ "${{ matrix.type }}" = "rpm" ]; then
+          sudo apt-get update
-              sudo apt-get update
+          sudo apt-get install -y rpm
-              sudo apt-get install -y rpm
+
-              echo "%_signature gpg" > ~/.rpmmacros
+          PASSPHRASE_FILE=$(mktemp)
-              echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
+          PUBLIC_KEY_FILE=$(mktemp)
-              rpm --addsign dist/*.rpm
+          trap 'rm -f "$PASSPHRASE_FILE" "$PUBLIC_KEY_FILE"' EXIT
-            fi
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSPHRASE_FILE"
+          chmod 600 "$PASSPHRASE_FILE"
+
+          echo "%_signature gpg" > ~/.rpmmacros
+          echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
+          echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros
+          echo "%_gpg_passphrase_file $PASSPHRASE_FILE" >> ~/.rpmmacros
+          echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros
+
+          rpm --addsign dist/*.rpm
+          gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$PUBLIC_KEY_FILE"
+          sudo rpm --import "$PUBLIC_KEY_FILE"
+          SIGNATURE_CHECK=$(rpm --checksig --verbose dist/*.rpm)
+          echo "$SIGNATURE_CHECK"
+          echo "$SIGNATURE_CHECK" | grep -Eq '[Ss]ignature.*: OK'
 
       - name: Upload Package Artifact
         uses: actions/upload-artifact@v3
@@ -188,10 +224,20 @@ jobs:
         with:
           targets: x86_64-unknown-linux-musl
 
-      - name: Install build dependencies
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: package-${{ matrix.type }}-musl
+
+      - name: Install cargo-deb
+        if: matrix.type == 'deb'
         uses: taiki-e/install-action@v2
         with:
-          tool: cargo-deb,cargo-generate-rpm
+          tool: cargo-deb
+
+      - name: Install cargo-generate-rpm
+        if: matrix.type == 'rpm'
+        run: cargo install cargo-generate-rpm
 
       - name: Download compiled binary
         uses: actions/download-artifact@v3
@@ -215,6 +261,7 @@ jobs:
           fi
 
       - name: Import GPG key
+        if: matrix.type == 'rpm'
         uses: crazy-max/ghaction-import-gpg@v6
         id: import-gpg
         with:
@@ -222,14 +269,31 @@ jobs:
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Sign packages
+        if: matrix.type == 'rpm'
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: |
-          if [ "${{ matrix.type }}" = "rpm" ]; then
+          sudo apt-get update
-            sudo apt-get update
+          sudo apt-get install -y rpm
-            sudo apt-get install -y rpm
+
-            echo "%_signature gpg" > ~/.rpmmacros
+          PASSPHRASE_FILE=$(mktemp)
-            echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
+          PUBLIC_KEY_FILE=$(mktemp)
-            rpm --addsign dist/*.rpm
+          trap 'rm -f "$PASSPHRASE_FILE" "$PUBLIC_KEY_FILE"' EXIT
-          fi
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSPHRASE_FILE"
+          chmod 600 "$PASSPHRASE_FILE"
+
+          echo "%_signature gpg" > ~/.rpmmacros
+          echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
+          echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros
+          echo "%_gpg_passphrase_file $PASSPHRASE_FILE" >> ~/.rpmmacros
+          echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros
+
+          rpm --addsign dist/*.rpm
+          gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$PUBLIC_KEY_FILE"
+          sudo rpm --import "$PUBLIC_KEY_FILE"
+          SIGNATURE_CHECK=$(rpm --checksig --verbose dist/*.rpm)
+          echo "$SIGNATURE_CHECK"
+          echo "$SIGNATURE_CHECK" | grep -Eq '[Ss]ignature.*: OK'
 
       - name: Upload Package Artifact
         uses: actions/upload-artifact@v3
@@ -316,4 +380,4 @@ jobs:
               echo "Upload failed with HTTP $HTTP_CODE"
               exit 1
             fi
-          done
+          done