| 1 | name: CD |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: |
| 6 | - main |
| 7 | paths: |
| 8 | - ".config/fly.toml" |
| 9 | - "Cargo.toml" |
| 10 | - "Cargo.lock" |
| 11 | release: |
| 12 | types: [released, prereleased] |
| 13 | workflow_dispatch: |
| 14 | inputs: |
| 15 | target: |
| 16 | description: "What to run" |
| 17 | type: choice |
| 18 | default: deploy |
| 19 | options: |
| 20 | - deploy |
| 21 | - publish |
| 22 | - both |
| 23 | |
| 24 | permissions: |
| 25 | contents: read |
| 26 | |
| 27 | jobs: |
| 28 | check-tag: |
| 29 | name: Check release tag |
| 30 | if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && (inputs.target == 'publish' || inputs.target == 'both')) |
| 31 | runs-on: ubuntu-latest |
| 32 | outputs: |
| 33 | should-publish: ${{ github.event_name == 'workflow_dispatch' || steps.check.outputs.match == 'true' }} |
| 34 | steps: |
| 35 | - name: Match semver tag |
| 36 | id: check |
| 37 | if: github.event_name == 'release' |
| 38 | run: | |
| 39 | TAG="${{ github.event.release.tag_name }}" |
| 40 | if [[ "$TAG" =~ ^git-ents-v[0-9]+\.[0-9]+\.[0-9]+(-.*)?$ ]]; then |
| 41 | echo "match=true" >> "$GITHUB_OUTPUT" |
| 42 | else |
| 43 | echo "match=false" >> "$GITHUB_OUTPUT" |
| 44 | fi |
| 45 | |
| 46 | release: |
| 47 | name: Release |
| 48 | needs: check-tag |
| 49 | if: needs.check-tag.outputs.should-publish == 'true' |
| 50 | runs-on: ubuntu-latest |
| 51 | permissions: |
| 52 | |
| 53 | id-token: write |
| 54 | |
| 55 | contents: write |
| 56 | |
| 57 | attestations: write |
| 58 | steps: |
| 59 | - uses: actions/checkout@v4 |
| 60 | - uses: actions-rust-lang/setup-rust-toolchain@v1 |
| 61 | with: |
| 62 | cache: true |
| 63 | toolchain: stable |
| 64 | - name: Package crates |
| 65 | run: cargo package --workspace |
| 66 | - name: Generate artifact attestation |
| 67 | uses: actions/attest-build-provenance@v2 |
| 68 | with: |
| 69 | subject-path: "target/package/*.crate" |
| 70 | - name: Publish to crates.io |
| 71 | env: |
| 72 | CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
| 73 | IS_PRERELEASE: ${{ github.event.release.prerelease }} |
| 74 | run: | |
| 75 | if [ "$IS_PRERELEASE" = "true" ]; then |
| 76 | cargo publish --workspace --dry-run |
| 77 | else |
| 78 | cargo publish --workspace --token "$CARGO_REGISTRY_TOKEN" |
| 79 | fi |
| 80 | |
| 81 | deploy-server: |
| 82 | name: Deploy server |
| 83 | if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && (inputs.target == 'deploy' || inputs.target == 'both')) |
| 84 | runs-on: ubuntu-latest |
| 85 | concurrency: |
| 86 | group: deploy-server |
| 87 | cancel-in-progress: true |
| 88 | steps: |
| 89 | - name: Stub - no server crate yet |
| 90 | run: echo "Deploy is a stub until crates/git-ents-server exists." |