nillsec/.github/workflows/release.yml at main · 403-html/nillsec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  # -----------------------------------------------------------------------
  # Run the full test suite before building release artifacts.
  # -----------------------------------------------------------------------
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Run tests
        run: go test ./... -v -count=1

  # -----------------------------------------------------------------------
  # Cross-compile for every target platform and collect the binaries.
  # -----------------------------------------------------------------------
  build:
    name: Build (${{ matrix.goos }}/${{ matrix.goarch }})
    needs: test
    runs-on: ubuntu-latest

    strategy:
      matrix:
        include:
          # Linux
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64     # Raspberry Pi 4 / 5
          - goos: linux
            goarch: arm
            goarm: "7"        # Raspberry Pi 2 / 3
          # macOS
          - goos: darwin
            goarch: amd64     # Intel Mac
          - goos: darwin
            goarch: arm64     # Apple Silicon (M1/M2/M3)
          # Windows
          - goos: windows
            goarch: amd64
          - goos: windows
            goarch: arm64

    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Set binary name
        id: name
        shell: bash
        run: |
          EXT=""
          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
          GOARM_SUFFIX=""
          if [ -n "${{ matrix.goarm }}" ]; then GOARM_SUFFIX="v${{ matrix.goarm }}"; fi
          echo "binary=nillsec-${{ matrix.goos }}-${{ matrix.goarch }}${GOARM_SUFFIX}${EXT}" >> "$GITHUB_OUTPUT"

      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarm }}
          CGO_ENABLED: "0"
        run: |
          go build \
            -trimpath \
            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
            -o "${{ steps.name.outputs.binary }}" \
            .

      - name: Package artifact
        id: package
        shell: bash
        run: |
          if [ "${{ matrix.goos }}" = "windows" ]; then
            echo "archive=${{ steps.name.outputs.binary }}" >> "$GITHUB_OUTPUT"
          else
            chmod +x "${{ steps.name.outputs.binary }}"
            tar -czf "${{ steps.name.outputs.binary }}.tar.gz" "${{ steps.name.outputs.binary }}"
            echo "archive=${{ steps.name.outputs.binary }}.tar.gz" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.package.outputs.archive }}
          path: ${{ steps.package.outputs.archive }}
          if-no-files-found: error
          retention-days: 1

  # -----------------------------------------------------------------------
  # Download all binaries, compute SHA-256 checksums, and upload all
  # assets to the already-created GitHub Release.
  # -----------------------------------------------------------------------
  release:
    name: Publish Release
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Download all build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Generate SHA-256 checksums
        working-directory: dist
        run: |
          sha256sum nillsec-* | tee checksums.txt

      - name: Upload assets to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.ref_name }}" \
            dist/nillsec-* dist/checksums.txt \
            --clobber