chore(main): release 1.16.7 (#66) #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Release Please | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**/*.md' | |
| - 'assets/**' | |
| - 'demo/**' | |
| - 'spec/**' | |
| - '.gitignore' | |
| - '.luacheckrc' | |
| - 'lefthook.yml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release-please: | |
| name: Release Please | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| steps: | |
| - name: Release Please | |
| if: ${{ !env.ACT }} | |
| uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3 | |
| id: release | |
| with: | |
| token: ${{ secrets.PAT }} | |
| build-release: | |
| name: Build Release Artifacts | |
| needs: release-please | |
| if: ${{ needs.release-please.outputs.release_created == 'true' || needs.release-please.outputs.release_created == true }} | |
| strategy: | |
| matrix: | |
| include: | |
| - os: ubuntu-24.04 | |
| name: linux-x86_64 | |
| target: linux | |
| - os: ubuntu-24.04-arm | |
| name: linux-aarch64 | |
| target: linux | |
| - os: macos-latest | |
| name: macos-arm64 | |
| target: macos | |
| - os: macos-latest | |
| name: macos-x86_64 | |
| target: macos | |
| - os: windows-2022 | |
| name: windows-x86_64 | |
| target: windows | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| defaults: | |
| run: | |
| shell: ${{ matrix.target == 'windows' && 'msys2 {0}' || 'bash' }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup MSYS2 (Windows) | |
| if: matrix.target == 'windows' | |
| uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 | |
| with: | |
| msystem: UCRT64 | |
| update: true | |
| install: >- | |
| git | |
| make | |
| unzip | |
| mingw-w64-ucrt-x86_64-gcc | |
| mingw-w64-ucrt-x86_64-cmake | |
| mingw-w64-ucrt-x86_64-lua | |
| mingw-w64-ucrt-x86_64-lua-luarocks | |
| - name: Add UCRT64 to PATH (Windows) | |
| if: matrix.target == 'windows' | |
| shell: bash | |
| run: echo "C:\msys64\ucrt64\bin" >> $GITHUB_PATH | |
| - name: Install System Dependencies (Linux) | |
| if: matrix.target == 'linux' | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq build-essential cmake luarocks lua5.4 liblua5.4-dev | |
| - name: Install System Dependencies (macOS) | |
| if: matrix.target == 'macos' | |
| run: | | |
| brew install cmake luarocks lua@5.4 | |
| - name: Install Lux | |
| uses: lumen-oss/gh-actions-lux@bd58f7b97fe2147910580a33b677efadf746e179 # v1.0.1 | |
| with: | |
| version: 0.28.2 | |
| - name: Copy Lux to MSYS2 (Windows) | |
| if: matrix.target == 'windows' | |
| run: cp "/c/Program Files/lux/lx.exe" /usr/bin/lx.exe | |
| - name: Install just (Unix) | |
| if: matrix.target != 'windows' | |
| uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2.0.0 | |
| - name: Install just (Windows) | |
| if: matrix.target == 'windows' | |
| run: | | |
| mkdir -p /tmp/just | |
| curl -L https://github.com/casey/just/releases/download/1.48.1/just-1.48.1-x86_64-pc-windows-msvc.zip -o /tmp/just/just.zip | |
| unzip /tmp/just/just.zip -d /tmp/just | |
| mv /tmp/just/just.exe /usr/bin/ | |
| rm -rf /tmp/just | |
| - name: Add Lux build dependencies bin to PATH (Windows) | |
| if: matrix.target == 'windows' | |
| run: echo "${{ github.workspace }}/.lux/5.4/build_dependencies/5.4/bin" >> "$GITHUB_PATH" | |
| - name: Build Executable | |
| env: | |
| LUA_VERSION: "5.4" | |
| run: | | |
| if [ "${{ matrix.target }}" = "linux" ]; then | |
| export LUA_PREFIX="/usr" | |
| MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) | |
| export LUA_LIB="/usr/lib/${MULTIARCH}/liblua5.4.a" | |
| just build | |
| elif [ "${{ matrix.target }}" = "macos" ] && [ "${{ matrix.name }}" = "macos-x86_64" ]; then | |
| export MACOSX_DEPLOYMENT_TARGET="11.0" | |
| # Build Lua 5.4 from source for x86_64 | |
| # (Homebrew lua@5.4 on ARM64 only provides arm64 libraries) | |
| LUA_SRC_DIR="${{ runner.temp }}/lua-5.4.7" | |
| curl -sL https://www.lua.org/ftp/lua-5.4.7.tar.gz | tar xz -C "${{ runner.temp }}" | |
| cd "$LUA_SRC_DIR" | |
| make macosx CC="clang -arch x86_64" AR="ar rc" MYCFLAGS="-arch x86_64" MYLDFLAGS="-arch x86_64" | |
| make local | |
| cd "${{ github.workspace }}" | |
| export LUA_PREFIX="$LUA_SRC_DIR/install" | |
| export LUA_LIB="$LUA_SRC_DIR/install/lib/liblua.a" | |
| export LUA_INCLUDE="$LUA_SRC_DIR/install/include" | |
| export CMAKE_OSX_ARCHITECTURES="x86_64" | |
| export CC="clang -arch x86_64" | |
| just build | |
| elif [ "${{ matrix.target }}" = "macos" ]; then | |
| export LUA_PREFIX="$(brew --prefix lua@5.4)" | |
| export LUA_LIB="$LUA_PREFIX/lib/liblua.a" | |
| export MACOSX_DEPLOYMENT_TARGET="11.0" | |
| just build | |
| else | |
| export CC="gcc" | |
| export LUA_PREFIX="/ucrt64" | |
| export LUA_LIB="/ucrt64/lib/liblua.a" | |
| export LUA_INCLUDE="/ucrt64/include" | |
| just --shell bash build | |
| fi | |
| - name: Package Artifacts | |
| run: | | |
| mkdir -p staging | |
| if [ "${{ matrix.target }}" = "windows" ]; then | |
| cp roda.exe staging/ 2>/dev/null || cp roda staging/roda.exe | |
| cp LICENSE README.md staging/ 2>/dev/null || true | |
| cd staging | |
| zip -r ../roda-${{ matrix.name }}.zip * | |
| cd .. | |
| sha256sum roda-${{ matrix.name }}.zip > roda-${{ matrix.name }}.zip.sha256 | |
| else | |
| cp roda staging/ | |
| cp LICENSE README.md staging/ 2>/dev/null || true | |
| cd staging | |
| tar -czvf ../roda-${{ matrix.name }}.tar.gz * | |
| cd .. | |
| if command -v sha256sum >/dev/null 2>&1; then | |
| sha256sum roda-${{ matrix.name }}.tar.gz > roda-${{ matrix.name }}.tar.gz.sha256 | |
| else | |
| shasum -a 256 roda-${{ matrix.name }}.tar.gz > roda-${{ matrix.name }}.tar.gz.sha256 | |
| fi | |
| fi | |
| - name: Verify Binary Architecture | |
| if: matrix.target == 'macos' | |
| run: | | |
| EXPECTED_ARCH="${{ matrix.name == 'macos-arm64' && 'arm64' || 'x86_64' }}" | |
| ACTUAL_ARCH=$(lipo -archs roda) | |
| echo "Expected: $EXPECTED_ARCH, Got: $ACTUAL_ARCH" | |
| if [ "$ACTUAL_ARCH" != "$EXPECTED_ARCH" ]; then | |
| echo "::error::Binary architecture mismatch! Expected $EXPECTED_ARCH, got $ACTUAL_ARCH" | |
| exit 1 | |
| fi | |
| file roda | |
| - name: Generate Rockspec | |
| if: matrix.name == 'linux-x86_64' | |
| run: | | |
| lx generate-rockspec | |
| - name: Validate Rockspec | |
| if: matrix.name == 'linux-x86_64' | |
| run: | | |
| luarocks lint *.rockspec | |
| # SECURITY: Generate SBOM for the current build context | |
| - name: Generate SBOM | |
| if: matrix.name == 'linux-x86_64' | |
| uses: anchore/sbom-action@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0 | |
| with: | |
| path: . | |
| format: cyclonedx-json | |
| output-file: sbom-${{ matrix.name }}.json | |
| # SECURITY: Generate unforgeable attestations binding the artifacts and SBOM to this OIDC run | |
| - name: Attest Build Provenance | |
| if: matrix.name == 'linux-x86_64' | |
| uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3 | |
| with: | |
| subject-path: | | |
| roda-*.* | |
| *.rockspec | |
| sbom-${{ matrix.name }}.json | |
| - name: Upload Release Artifacts (with rockspec) | |
| if: ${{ !env.ACT && matrix.name == 'linux-x86_64' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload ${{ needs.release-please.outputs.tag_name }} \ | |
| roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 *.rockspec sbom-${{ matrix.name }}.json --clobber | |
| - name: Upload Release Artifacts (Linux aarch64) | |
| if: ${{ !env.ACT && matrix.name == 'linux-aarch64' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload ${{ needs.release-please.outputs.tag_name }} \ | |
| roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 --clobber | |
| - name: Upload Release Artifacts (Windows) | |
| if: ${{ !env.ACT && matrix.target == 'windows' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload ${{ needs.release-please.outputs.tag_name }} \ | |
| roda-${{ matrix.name }}.zip roda-${{ matrix.name }}.zip.sha256 --clobber | |
| - name: Upload Release Artifacts (macOS) | |
| if: ${{ !env.ACT && matrix.target == 'macos' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload ${{ needs.release-please.outputs.tag_name }} \ | |
| roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 --clobber | |
| update-release-notes: | |
| name: Add Attestation Verification Instructions | |
| needs: [release-please, build-release] | |
| if: ${{ needs.release-please.outputs.release_created == 'true' || needs.release-please.outputs.release_created == true }} | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Append attestation verification instructions | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="${{ needs.release-please.outputs.tag_name }}" | |
| ATTESTATION_BLOCK=' | |
| --- | |
| ## Verifying GitHub Artifact Attestations | |
| The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): | |
| ```bash | |
| gh attestation verify <file-path of downloaded artifact> --repo tkolleh/roda.lua | |
| ``` | |
| You can also download the attestation from [GitHub](https://github.com/tkolleh/roda.lua/attestations) and verify against that directly: | |
| ```bash | |
| gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> | |
| ```' | |
| gh release edit "$TAG" --notes "$(gh release view "$TAG" --json body --jq '.body')${ATTESTATION_BLOCK}" |