diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 8bb30c8..43e78c3 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -1,5 +1,8 @@ name: soar-dl nightly - +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + on: push: branches: @@ -7,7 +10,9 @@ on: workflow_dispatch: permissions: + attestations: write contents: write + id-token: write jobs: remove-nightly-tag: @@ -28,14 +33,22 @@ jobs: fail-fast: false matrix: build: - - { - NAME: x86_64-linux, - TARGET: x86_64-unknown-linux-musl, - } - { NAME: aarch64-linux, TARGET: aarch64-unknown-linux-musl, } + - { + NAME: loongarch64-linux, + TARGET: loongarch64-unknown-linux-musl + } + - { + NAME: riscv64-linux, + TARGET: riscv64gc-unknown-linux-musl + } + - { + NAME: x86_64-linux, + TARGET: x86_64-unknown-linux-musl, + } steps: - name: Checkout uses: actions/checkout@v4 @@ -49,34 +62,57 @@ jobs: - name: Install dependencies shell: bash run: | - sudo apt-get update - sudo apt-get install -y --no-install-recommends \ - --allow-unauthenticated musl-tools b3sum + sudo apt update -y + sudo apt install b3sum findutils file -y - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable with: targets: ${{ matrix.build.TARGET }} - - name: Install cross-compilation tools - uses: taiki-e/setup-cross-toolchain-action@v1 - with: - target: ${{ matrix.build.TARGET }} + - name: Install Cross + shell: bash + run: | + cargo install cross --git "https://github.com/cross-rs/cross" --jobs="$(($(nproc)+1))" + hash -r &>/dev/null + command -v cross &>/dev/null || { echo "cross command not found" >&2; exit 1; } - name: Build - run: SOAR_NIGHTLY=1 cargo build -F binary --release --locked --target ${{ matrix.build.TARGET }} - - - name: Prepare nightly binary + env: + RUSTFLAGS: "-C target-feature=+crt-static \ + -C default-linker-libraries=yes \ + -C link-self-contained=yes \ + -C opt-level=3 \ + -C debuginfo=none \ + -C strip=symbols \ + -C link-arg=-Wl,-S \ + -C link-arg=-Wl,--build-id=none \ + -C link-arg=-Wl,--discard-all \ + -C link-arg=-Wl,--strip-all" + SOAR_NIGHTLY: "1" + run: cross +nightly build --features "binary" --release --locked --target "${{ matrix.build.TARGET }}" --jobs="$(($(nproc)+1))" --verbose + + - name: Prepare release assets + env: + ARTIFACT: "release/soar-dl-${{ matrix.build.NAME }}" + ARCHIVE: "soar-dl-${{ matrix.build.NAME }}.tar.gz" shell: bash run: | - mkdir -p nightly - cp "target/${{ matrix.build.TARGET }}/release/soar-dl" nightly/soar-dl-nightly-${{ matrix.build.NAME }} - b3sum nightly/soar-dl-nightly-${{ matrix.build.NAME }} > nightly/soar-dl-nightly-${{ matrix.build.NAME }}.b3sum + mkdir -p release + cp {LICENSE,README.md} release/ + cp "target/${{ matrix.build.TARGET }}/release/soar-dl" "${ARTIFACT}" + b3sum "${ARTIFACT}" > "${ARTIFACT}.b3sum" + cp "${ARTIFACT}" . + cp "${ARTIFACT}.b3sum" . + tar -czvf "${ARCHIVE}" release/ + b3sum "${ARCHIVE}" > "${ARCHIVE}.b3sum" + bash -c 'realpath "${ARTIFACT}" ; realpath "${ARCHIVE}"' | xargs -I "{}" bash -c \ + 'printf "\nFile: $(basename {})\n Type: $(file -b {})\n B3sum: $(b3sum {} | cut -d" " -f1)\n SHA256sum: $(sha256sum {} | cut -d" " -f1)\n Size: $(du -bh {} | cut -f1)\n"' - name: Upload nightly binary uses: softprops/action-gh-release@v2 with: - files: nightly/* + files: soar-dl-${{ matrix.build.NAME }}* tag_name: nightly name: ${{ steps.version.outputs.version }} body: "This is an automated nightly build of soar-dl." @@ -84,3 +120,11 @@ jobs: draft: false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Attest Build Provenance + uses: actions/attest-build-provenance@v2.4.0 + with: + subject-name: "soar-dl-nightly-${{ matrix.build.NAME }}" + subject-path: | + soar-dl-${{ matrix.build.NAME }}* + show-summary: true diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 255e00a..f74e2c6 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,12 +1,19 @@ name: soar-dl release - +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + on: push: tags: - "v*.*.*" + workflow_dispatch: + permissions: + attestations: write contents: write - + id-token: write + jobs: generate-changelog: name: Generate changelog @@ -33,14 +40,22 @@ jobs: fail-fast: false matrix: build: - - { - NAME: x86_64-linux, - TARGET: x86_64-unknown-linux-musl, - } - { NAME: aarch64-linux, TARGET: aarch64-unknown-linux-musl, } + - { + NAME: loongarch64-linux, + TARGET: loongarch64-unknown-linux-musl + } + - { + NAME: riscv64-linux, + TARGET: riscv64gc-unknown-linux-musl + } + - { + NAME: x86_64-linux, + TARGET: x86_64-unknown-linux-musl, + } steps: - name: Checkout uses: actions/checkout@v4 @@ -52,41 +67,52 @@ jobs: - name: Install dependencies shell: bash run: | - sudo apt-get update - sudo apt-get install -y --no-install-recommends \ - --allow-unauthenticated musl-tools b3sum + sudo apt update -y + sudo apt install b3sum findutils file -y - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable with: targets: ${{ matrix.build.TARGET }} - - name: Install cross-compilation tools - uses: taiki-e/setup-cross-toolchain-action@v1 - with: - target: ${{ matrix.build.TARGET }} + - name: Install Cross + shell: bash + run: | + cargo install cross --git "https://github.com/cross-rs/cross" --jobs="$(($(nproc)+1))" + hash -r &>/dev/null + command -v cross &>/dev/null || { echo "cross command not found" >&2; exit 1; } - name: Build - run: cargo build -F binary --release --locked --target ${{ matrix.build.TARGET }} + env: + RUSTFLAGS: "-C target-feature=+crt-static \ + -C default-linker-libraries=yes \ + -C link-self-contained=yes \ + -C opt-level=3 \ + -C debuginfo=none \ + -C strip=symbols \ + -C link-arg=-Wl,-S \ + -C link-arg=-Wl,--build-id=none \ + -C link-arg=-Wl,--discard-all \ + -C link-arg=-Wl,--strip-all" + run: cross +nightly build --features "binary" --release --locked --target "${{ matrix.build.TARGET }}" --jobs="$(($(nproc)+1))" --verbose - name: Prepare release assets + env: + ARTIFACT: "release/soar-dl-${{ matrix.build.NAME }}" + ARCHIVE: "soar-dl-${{ matrix.build.NAME }}.tar.gz" shell: bash run: | mkdir -p release - cp {LICENSE,README.md,CHANGELOG.md} release/ - cp "target/${{ matrix.build.TARGET }}/release/soar-dl" release/ - - - name: Create release artifacts - shell: bash - run: | - cp release/soar-dl soar-dl-${{ matrix.build.NAME }} - b3sum soar-dl-${{ matrix.build.NAME }} \ - > soar-dl-${{ matrix.build.NAME }}.b3sum - tar -czvf soar-dl-${{ matrix.build.NAME }}.tar.gz \ - release/ - b3sum soar-dl-${{ matrix.build.NAME }}.tar.gz \ - > soar-dl-${{ matrix.build.NAME }}.tar.gz.b3sum - + cp {LICENSE,README.md} release/ + cp "target/${{ matrix.build.TARGET }}/release/soar-dl" "${ARTIFACT}" + b3sum "${ARTIFACT}" > "${ARTIFACT}.b3sum" + cp "${ARTIFACT}" . + cp "${ARTIFACT}.b3sum" . + tar -czvf "${ARCHIVE}" release/ + b3sum "${ARCHIVE}" > "${ARCHIVE}.b3sum" + bash -c 'realpath "${ARTIFACT}" ; realpath "${ARCHIVE}"' | xargs -I "{}" bash -c \ + 'printf "\nFile: $(basename {})\n Type: $(file -b {})\n B3sum: $(b3sum {} | cut -d" " -f1)\n SHA256sum: $(sha256sum {} | cut -d" " -f1)\n Size: $(du -bh {} | cut -f1)\n"' + - name: Publish to GitHub if: ${{ !contains(github.ref, '-') }} uses: svenstaro/upload-release-action@v2 @@ -110,3 +136,11 @@ jobs: tag: ${{ github.ref }} release_name: "Pre-release v${{ env.RELEASE_VERSION }}" prerelease: true + + - name: Attest Build Provenance + uses: actions/attest-build-provenance@v2.4.0 + with: + subject-name: "soar-dl-v${{ env.RELEASE_VERSION }}-${{ matrix.build.NAME }}" + subject-path: | + soar-dl-${{ matrix.build.NAME }}* + show-summary: true