mirror of
https://github.com/bherbruck/solidcraft.git
synced 2026-11-08 13:01:52 +00:00
bherbruck
a308b4c9a4
release.yml: cargo test/check/publish run with --locked; a dry-run publish without CARGO_REGISTRY_TOKEN runs before the real publish; full-history checkout and a check that the tagged commit is an ancestor of origin/main. ci.yml: new publish-dry-run job (no secrets). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V8ohWGLCzFPoZriCeSSero
46 lines
1.9 KiB
YAML
46 lines
1.9 KiB
YAML
name: Release solidcore
|
|
|
|
# Publishes the solidcore crate to crates.io when a tag "solidcore-v<version>" is pushed,
|
|
# e.g. `git tag solidcore-v0.0.1 && git push origin solidcore-v0.0.1`.
|
|
# Needs the repository secret CARGO_REGISTRY_TOKEN (crates.io token, scope publish-update).
|
|
on:
|
|
push:
|
|
tags: ["solidcore-v*"]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
environment: crates-io
|
|
steps:
|
|
# Pinned by SHA and no third-party actions: this job holds CARGO_REGISTRY_TOKEN.
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0 # full history, for the on-main check below
|
|
- name: Tagged commit is on main
|
|
run: |
|
|
git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
|
|
if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
|
|
echo "::error::$GITHUB_REF_NAME ($GITHUB_SHA) is not an ancestor of origin/main"
|
|
exit 1
|
|
fi
|
|
- name: Tag matches crate version
|
|
run: |
|
|
want="${GITHUB_REF_NAME#solidcore-v}"
|
|
have="$(cargo metadata --no-deps --format-version 1 \
|
|
| python3 -c 'import json,sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"]=="solidcore"))')"
|
|
echo "tag $want, crates/solidcore/Cargo.toml $have"
|
|
test "$want" = "$have"
|
|
- run: cargo test -p solidcore --locked
|
|
- run: rustup target add wasm32-unknown-unknown && cargo check -p solidcore --locked --target wasm32-unknown-unknown
|
|
# Package and verify without the token first; only the real publish sees it.
|
|
- name: Publish (dry run)
|
|
run: cargo publish -p solidcore --locked --dry-run
|
|
- name: Publish
|
|
run: cargo publish -p solidcore --locked
|
|
env:
|
|
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
|