FerrVault/.github/workflows/cli-release.yml at main · FerrLabs/FerrVault · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: cli-release

on:
  push:
    tags:
      - 'cli-v[0-9]+.[0-9]+.[0-9]+'
      - 'cli-v[0-9]+.[0-9]+.[0-9]+-*'

permissions:
  contents: write
  id-token: write
  attestations: write

env:
  CARGO_TERM_COLOR: always

jobs:
  create-release:
    name: Create GitHub release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1
        with:
          prefix: cli
          title: ferrvault CLI $version
          token: ${{ secrets.GITHUB_TOKEN }}

  upload:
    name: Build and upload (${{ matrix.short }})
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            short: linux-amd64
            tool: cargo
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            short: linux-arm64
            tool: cross
          - target: x86_64-apple-darwin
            os: macos-latest
            short: darwin-amd64
            tool: cargo
          - target: aarch64-apple-darwin
            os: macos-latest
            short: darwin-arm64
            tool: cargo
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            short: windows-amd64
            tool: cargo
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Install Linux deps for keyring (native builds only — cross uses Cross.toml)
        if: runner.os == 'Linux' && matrix.tool == 'cargo'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
              build-essential pkg-config libdbus-1-dev
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: '1.99'
          targets: ${{ matrix.target }}
      - uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: ferrvault
          target: ${{ matrix.target }}
          tool: ${{ matrix.tool }}
          archive: ferrvault-${{ matrix.short }}
          checksum: sha256
          tar: unix
          zip: windows
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Attest binary provenance (SLSA)
        if: runner.os == 'Linux' || runner.os == 'macOS'
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: target/${{ matrix.target }}/release/ferrvault