Andy Dixon
400d11ea4f
- Release Builds: the build/test matrix ran ~1,400 third-party build scripts and tests with a contents:write token persisted in .git/config. It now runs with contents:read and persist-credentials: false; a separate publish job (no project or dependency code) downloads the artefacts, writes SHA256SUMS and attaches both to the release. The release now waits for every platform instead of publishing partially. - CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned (0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock; fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one) are reported instead of hiding under libFuzzer's 20-minute default. - updates/index.php: array-valued query parameters no longer raise TypeErrors/warnings; nosniff header.
88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
name: Release Builds
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
|
|
# Building and testing runs every dependency's build scripts and tests, so those jobs only get a
|
|
# read token. Publishing is a separate job that never runs project or dependency code.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
name: Build ${{ matrix.platform }}
|
|
runs-on: ${{ matrix.runner }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { platform: darwin/amd64, runner: macos-13 }
|
|
- { platform: darwin/arm64, runner: macos-14 }
|
|
- { platform: linux/amd64, runner: ubuntu-22.04 }
|
|
- { platform: linux/arm64, runner: ubuntu-22.04-arm }
|
|
- { platform: windows/amd64, runner: windows-latest }
|
|
- { platform: windows/arm64, runner: windows-11-arm }
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: rust
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Rust toolchain (pinned by rust-toolchain.toml)
|
|
run: rustup show active-toolchain || rustup toolchain install
|
|
|
|
- name: Linux build dependencies
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip
|
|
|
|
- name: Test
|
|
run: cargo test --locked --workspace
|
|
|
|
- name: Build and package
|
|
env:
|
|
NEXUS_RELEASE_TARGETS: ${{ matrix.platform }}
|
|
NEXUS_RELEASE_ROOT: ${{ github.workspace }}/build/releases
|
|
run: ./release.sh
|
|
|
|
- name: Upload artefacts
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: nexus-terminal-${{ matrix.runner }}
|
|
path: |
|
|
build/releases/*/NexusTerminal-*.zip
|
|
build/releases/manifest-*.json
|
|
build/releases/version-*.txt
|
|
|
|
publish:
|
|
name: Attach to GitHub Release
|
|
needs: build
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
path: artefacts
|
|
- name: Checksums
|
|
run: |
|
|
find artefacts -name 'NexusTerminal-*.zip' | while read -r f; do
|
|
(cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
|
|
done > SHA256SUMS
|
|
cat SHA256SUMS
|
|
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
|
|
with:
|
|
files: |
|
|
artefacts/*/*/NexusTerminal-*.zip
|
|
artefacts/*/NexusTerminal-*.zip
|
|
SHA256SUMS
|