mirror of
https://github.com/astral-sh/uv
synced 2026-01-21 21:40:11 -05:00
903dd292b3
This file is too big for an LLM context window and several contributors have complained about it being too scary to touch. This also gets us collapsible sections in the UI. I renamed some jobs for clarity in the meantime. And added a meta-job for required checks passing so we can avoid churn in our "Settings" when we change job names. Note this was entirely refactored by Claude. --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
302 lines
12 KiB
YAML
302 lines
12 KiB
YAML
# This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist
|
|
#
|
|
# Copyright 2022-2024, axodotdev
|
|
# SPDX-License-Identifier: MIT or Apache-2.0
|
|
#
|
|
# CI that:
|
|
#
|
|
# * checks for a Git Tag that looks like a release
|
|
# * builds artifacts with dist (archives, installers, hashes)
|
|
# * uploads those artifacts to temporary workflow zip
|
|
# * on success, uploads the artifacts to a GitHub Release
|
|
#
|
|
# Note that the GitHub Release will be created with a generated
|
|
# title/body based on your changelogs.
|
|
|
|
name: Release
|
|
permissions:
|
|
"contents": "write"
|
|
|
|
# This task will run whenever you workflow_dispatch with a tag that looks like a version
|
|
# like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
|
|
# Various formats will be parsed into a VERSION and an optional PACKAGE_NAME, where
|
|
# PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION
|
|
# must be a Cargo-style SemVer Version (must have at least major.minor.patch).
|
|
#
|
|
# If PACKAGE_NAME is specified, then the announcement will be for that
|
|
# package (erroring out if it doesn't have the given version or isn't dist-able).
|
|
#
|
|
# If PACKAGE_NAME isn't specified, then the announcement will be for all
|
|
# (dist-able) packages in the workspace with that version (this mode is
|
|
# intended for workspaces with only one dist-able package, or with all dist-able
|
|
# packages versioned/released in lockstep).
|
|
#
|
|
# If you push multiple tags at once, separate instances of this workflow will
|
|
# spin up, creating an independent announcement for each one. However, GitHub
|
|
# will hard limit this to 3 tags per commit, as it will assume more tags is a
|
|
# mistake.
|
|
#
|
|
# If there's a prerelease-style suffix to the version, then the release(s)
|
|
# will be marked as a prerelease.
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Release Tag
|
|
required: true
|
|
default: dry-run
|
|
type: string
|
|
|
|
jobs:
|
|
# Run 'dist plan' (or host) to determine what tasks we need to do
|
|
plan:
|
|
runs-on: "depot-ubuntu-latest-4"
|
|
outputs:
|
|
val: ${{ steps.plan.outputs.manifest }}
|
|
tag: ${{ (inputs.tag != 'dry-run' && inputs.tag) || '' }}
|
|
tag-flag: ${{ inputs.tag && inputs.tag != 'dry-run' && format('--tag={0}', inputs.tag) || '' }}
|
|
publishing: ${{ inputs.tag && inputs.tag != 'dry-run' }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
|
with:
|
|
persist-credentials: false
|
|
submodules: recursive
|
|
- name: Install dist
|
|
# we specify bash to get pipefail; it guards against the `curl` command
|
|
# failing. otherwise `sh` won't catch that `curl` returned non-0
|
|
shell: bash
|
|
run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.sh | sh"
|
|
- name: Cache dist
|
|
uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
|
|
with:
|
|
name: cargo-dist-cache
|
|
path: ~/.cargo/bin/dist
|
|
# sure would be cool if github gave us proper conditionals...
|
|
# so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
|
|
# functionality based on whether this is a pull_request, and whether it's from a fork.
|
|
# (PRs run on the *source* but secrets are usually on the *target* -- that's *good*
|
|
# but also really annoying to build CI around when it needs secrets to work right.)
|
|
- id: plan
|
|
run: |
|
|
dist ${{ (inputs.tag && inputs.tag != 'dry-run' && format('host --steps=create --tag={0}', inputs.tag)) || 'plan' }} --output-format=json > plan-dist-manifest.json
|
|
echo "dist ran successfully"
|
|
cat plan-dist-manifest.json
|
|
echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
|
|
- name: "Upload dist-manifest.json"
|
|
uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
|
|
with:
|
|
name: artifacts-plan-dist-manifest
|
|
path: plan-dist-manifest.json
|
|
|
|
custom-build-binaries:
|
|
needs:
|
|
- plan
|
|
if: ${{ needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload' || inputs.tag == 'dry-run' }}
|
|
uses: ./.github/workflows/build-release-binaries.yml
|
|
with:
|
|
plan: ${{ needs.plan.outputs.val }}
|
|
secrets: inherit
|
|
|
|
custom-build-docker:
|
|
needs:
|
|
- plan
|
|
if: ${{ needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload' || inputs.tag == 'dry-run' }}
|
|
uses: ./.github/workflows/build-docker.yml
|
|
with:
|
|
plan: ${{ needs.plan.outputs.val }}
|
|
secrets: inherit
|
|
permissions:
|
|
"attestations": "write"
|
|
"contents": "read"
|
|
"id-token": "write"
|
|
"packages": "write"
|
|
|
|
# Build and package all the platform-agnostic(ish) things
|
|
build-global-artifacts:
|
|
needs:
|
|
- plan
|
|
- custom-build-binaries
|
|
- custom-build-docker
|
|
runs-on: "depot-ubuntu-latest-4"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
|
with:
|
|
persist-credentials: false
|
|
submodules: recursive
|
|
- name: Install cached dist
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
name: cargo-dist-cache
|
|
path: ~/.cargo/bin/
|
|
- run: chmod +x ~/.cargo/bin/dist
|
|
# Get all the local artifacts for the global tasks to use (for e.g. checksums)
|
|
- name: Fetch local artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: artifacts-*
|
|
path: target/distrib/
|
|
merge-multiple: true
|
|
- id: cargo-dist
|
|
shell: bash
|
|
run: |
|
|
dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
|
|
echo "dist ran successfully"
|
|
|
|
# Parse out what we just built and upload it to scratch storage
|
|
echo "paths<<EOF" >> "$GITHUB_OUTPUT"
|
|
jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
|
|
echo "EOF" >> "$GITHUB_OUTPUT"
|
|
|
|
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
|
|
- name: "Upload artifacts"
|
|
uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
|
|
with:
|
|
name: artifacts-build-global
|
|
path: |
|
|
${{ steps.cargo-dist.outputs.paths }}
|
|
${{ env.BUILD_MANIFEST_NAME }}
|
|
# Determines if we should publish/announce
|
|
host:
|
|
needs:
|
|
- plan
|
|
- custom-build-binaries
|
|
- custom-build-docker
|
|
- build-global-artifacts
|
|
# Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
|
|
if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-binaries.result == 'skipped' || needs.custom-build-binaries.result == 'success') && (needs.custom-build-docker.result == 'skipped' || needs.custom-build-docker.result == 'success') }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
runs-on: "depot-ubuntu-latest-4"
|
|
outputs:
|
|
val: ${{ steps.host.outputs.manifest }}
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
|
with:
|
|
persist-credentials: false
|
|
submodules: recursive
|
|
- name: Install cached dist
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
name: cargo-dist-cache
|
|
path: ~/.cargo/bin/
|
|
- run: chmod +x ~/.cargo/bin/dist
|
|
# Fetch artifacts from scratch-storage
|
|
- name: Fetch artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: artifacts-*
|
|
path: target/distrib/
|
|
merge-multiple: true
|
|
# This is a harmless no-op for GitHub Releases, hosting for that happens in "announce"
|
|
- id: host
|
|
shell: bash
|
|
run: |
|
|
dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
|
|
echo "artifacts uploaded and released successfully"
|
|
cat dist-manifest.json
|
|
echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
|
|
- name: "Upload dist-manifest.json"
|
|
uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
|
|
with:
|
|
# Overwrite the previous copy
|
|
name: artifacts-dist-manifest
|
|
path: dist-manifest.json
|
|
|
|
custom-publish-pypi:
|
|
needs:
|
|
- plan
|
|
- host
|
|
if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
|
|
uses: ./.github/workflows/publish-pypi.yml
|
|
with:
|
|
plan: ${{ needs.plan.outputs.val }}
|
|
secrets: inherit
|
|
# publish jobs get escalated permissions
|
|
permissions:
|
|
"id-token": "write"
|
|
"packages": "write"
|
|
|
|
custom-publish-crates:
|
|
needs:
|
|
- plan
|
|
- host
|
|
- custom-publish-pypi # DIRTY: see #16989
|
|
if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
|
|
uses: ./.github/workflows/publish-crates.yml
|
|
with:
|
|
plan: ${{ needs.plan.outputs.val }}
|
|
secrets: inherit
|
|
# publish jobs get escalated permissions
|
|
permissions:
|
|
"contents": "read"
|
|
|
|
# Create a GitHub Release while uploading all files to it
|
|
announce:
|
|
needs:
|
|
- plan
|
|
- host
|
|
- custom-publish-pypi
|
|
- custom-publish-crates
|
|
# use "always() && ..." to allow us to wait for all publish jobs while
|
|
# still allowing individual publish jobs to skip themselves (for prereleases).
|
|
# "host" however must run to completion, no skipping allowed!
|
|
if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-pypi.result == 'skipped' || needs.custom-publish-pypi.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
|
|
runs-on: "depot-ubuntu-latest-4"
|
|
permissions:
|
|
"attestations": "write"
|
|
"contents": "write"
|
|
"id-token": "write"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
|
with:
|
|
persist-credentials: false
|
|
submodules: recursive
|
|
# Create a GitHub Release while uploading all files to it
|
|
- name: "Download GitHub Artifacts"
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: artifacts-*
|
|
path: artifacts
|
|
merge-multiple: true
|
|
- name: Cleanup
|
|
run: |
|
|
# Remove the granular manifests
|
|
rm -f artifacts/*-dist-manifest.json
|
|
- name: Attest
|
|
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
|
|
with:
|
|
subject-path: |
|
|
artifacts/*.json
|
|
artifacts/*.sh
|
|
artifacts/*.ps1
|
|
artifacts/*.zip
|
|
artifacts/*.tar.gz
|
|
- name: Create GitHub Release
|
|
env:
|
|
PRERELEASE_FLAG: "${{ fromJson(needs.host.outputs.val).announcement_is_prerelease && '--prerelease' || '' }}"
|
|
ANNOUNCEMENT_TITLE: "${{ fromJson(needs.host.outputs.val).announcement_title }}"
|
|
ANNOUNCEMENT_BODY: "${{ fromJson(needs.host.outputs.val).announcement_github_body }}"
|
|
RELEASE_COMMIT: "${{ github.sha }}"
|
|
run: |
|
|
# Write and read notes from a file to avoid quoting breaking things
|
|
echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
|
|
|
|
gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
|
|
|
|
custom-publish-docs:
|
|
needs:
|
|
- plan
|
|
- announce
|
|
uses: ./.github/workflows/publish-docs.yml
|
|
with:
|
|
plan: ${{ needs.plan.outputs.val }}
|
|
secrets: inherit
|