chore(deps): bump rustls from 0.23.40 to 0.23.41 #62
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| pull_request: | |
| paths-ignore: | |
| - 'docs/**' | |
| - '**.md' | |
| - '**.py' | |
| - 'js/**' | |
| - 'python/**' | |
| - 'csharp/**' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| # PR validation: build + test the Rust workspace. Intentionally lightweight — | |
| # full platform matrix and packaging only runs on tag push / workflow_dispatch. | |
| pr-check: | |
| name: pr check | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: cargo test | |
| run: cargo test --workspace --lib --tests --exclude gbp-stack-wasm | |
| - name: cargo build | |
| run: cargo build --workspace --exclude gbp-stack-wasm | |
| - name: check wasm target | |
| run: cargo check -p gbp-stack-wasm --target wasm32-unknown-unknown | |
| - name: install wasm-pack | |
| run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| - name: test wasm | |
| run: wasm-pack test --node crates/gbp/wasm | |
| # 1. Build the native cdylib for every supported runtime identifier. | |
| build-native: | |
| name: native ${{ matrix.rid }} | |
| if: github.event_name != 'pull_request' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - rid: win-x64 | |
| os: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| artifact: gbp_stack.dll | |
| - rid: win-arm64 | |
| os: windows-latest | |
| target: aarch64-pc-windows-msvc | |
| artifact: gbp_stack.dll | |
| - rid: linux-x64 | |
| os: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| artifact: libgbp_stack.so | |
| - rid: linux-arm64 | |
| os: ubuntu-latest | |
| target: aarch64-unknown-linux-gnu | |
| artifact: libgbp_stack.so | |
| cross: true | |
| - rid: osx-x64 | |
| os: macos-latest | |
| target: x86_64-apple-darwin | |
| artifact: libgbp_stack.dylib | |
| - rid: osx-arm64 | |
| os: macos-latest | |
| target: aarch64-apple-darwin | |
| artifact: libgbp_stack.dylib | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: install rust | |
| uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: install cross (linux-arm64) | |
| if: matrix.cross | |
| run: cargo install cross --locked | |
| - name: build cdylib | |
| if: '!matrix.cross' | |
| run: cargo build -p gbp-stack-ffi --release --target ${{ matrix.target }} | |
| - name: build cdylib (cross) | |
| if: matrix.cross | |
| run: cross build -p gbp-stack-ffi --release --target ${{ matrix.target }} | |
| - name: stage artifact | |
| shell: bash | |
| run: | | |
| mkdir -p out | |
| cp "target/${{ matrix.target }}/release/${{ matrix.artifact }}" "out/${{ matrix.artifact }}" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: native-${{ matrix.rid }} | |
| path: out/${{ matrix.artifact }} | |
| if-no-files-found: error | |
| # 2a. Assemble the NuGet package with every native runtime bundled. | |
| pack-nuget: | |
| name: nuget pack | |
| needs: build-native | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| - name: download native artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: native-artifacts | |
| pattern: native-* | |
| - name: stage runtimes/<rid>/native/ | |
| shell: pwsh | |
| run: | | |
| $base = "csharp/GBPStack/runtimes" | |
| New-Item -ItemType Directory -Force -Path $base | Out-Null | |
| Get-ChildItem native-artifacts -Directory | ForEach-Object { | |
| $rid = $_.Name -replace '^native-', '' | |
| $dst = Join-Path $base "$rid/native" | |
| New-Item -ItemType Directory -Force -Path $dst | Out-Null | |
| Copy-Item "$($_.FullName)/*" $dst -Force | |
| } | |
| Get-ChildItem -Recurse $base | |
| - name: pack | |
| env: | |
| SkipStageHostRuntime: "true" | |
| run: dotnet pack csharp/GBPStack/GBPStack.csproj -c Release -o nupkg | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: nupkg | |
| path: nupkg/* | |
| # 2b. Publish the .nupkg to nuget.org. nuget.org does not yet support | |
| # OIDC trusted publishing, so this still needs an API key. The dedicated | |
| # ``nuget`` environment lets you scope the secret + add protection rules. | |
| publish-nuget: | |
| name: nuget publish | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: pack-nuget | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: nuget | |
| url: https://www.nuget.org/packages/GBPStack | |
| steps: | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: nupkg | |
| path: nupkg | |
| - name: push to nuget.org | |
| env: | |
| NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} | |
| shell: bash | |
| run: | | |
| if [ -z "$NUGET_API_KEY" ]; then echo "NUGET_API_KEY not set; skipping"; exit 0; fi | |
| for f in nupkg/*.nupkg; do | |
| dotnet nuget push "$f" \ | |
| --api-key "$NUGET_API_KEY" \ | |
| --source https://api.nuget.org/v3/index.json \ | |
| --skip-duplicate | |
| done | |
| # 3. Build a per-platform Python wheel that bundles the matching native | |
| # library, plus an sdist. | |
| build-wheels: | |
| name: wheel ${{ matrix.rid }} | |
| needs: build-native | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - rid: win-x64 | |
| os: windows-latest | |
| plat: win_amd64 | |
| - rid: win-arm64 | |
| os: windows-latest | |
| plat: win_arm64 | |
| - rid: linux-x64 | |
| os: ubuntu-latest | |
| plat: manylinux2014_x86_64 | |
| - rid: linux-arm64 | |
| os: ubuntu-latest | |
| plat: manylinux2014_aarch64 | |
| - rid: osx-x64 | |
| os: macos-latest | |
| plat: macosx_11_0_x86_64 | |
| - rid: osx-arm64 | |
| os: macos-latest | |
| plat: macosx_11_0_arm64 | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: download native artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: native-${{ matrix.rid }} | |
| path: python/gbp_stack/_native/${{ matrix.rid }} | |
| - name: install build tools | |
| run: python -m pip install --upgrade pip build wheel | |
| - name: build wheel | |
| working-directory: python | |
| env: | |
| GBP_STACK_TARGET_PLATFORM: ${{ matrix.plat }} | |
| run: python build_wheel.py | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: wheel-${{ matrix.rid }} | |
| path: python/dist/*.whl | |
| build-sdist: | |
| name: sdist | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - run: python -m pip install --upgrade pip build | |
| - run: python -m build --sdist | |
| working-directory: python | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: sdist | |
| path: python/dist/*.tar.gz | |
| publish-pypi: | |
| name: publish to pypi | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [build-wheels, build-sdist] | |
| runs-on: ubuntu-latest | |
| # Auth via PyPI Trusted Publisher (OIDC). Configure the publisher at | |
| # https://pypi.org/manage/account/publishing/ with: | |
| # project = gbp-stack, owner = F000NKKK, | |
| # repo = Group-Protocol-Stack, workflow = release.yml, | |
| # environment = pypi | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/gbp-stack | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| path: dist-merged | |
| pattern: wheel-* | |
| merge-multiple: true | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: sdist | |
| path: dist-merged | |
| - name: publish via Trusted Publisher | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| packages-dir: dist-merged | |
| skip-existing: true | |
| # crates.io publishing via OIDC Trusted Publishing. | |
| # Configure the publisher at https://crates.io/me — Trusted Publishing tab — with: | |
| # owner = F000NKKK, repository = Group-Protocol-Stack, | |
| # workflow = release.yml, environment = crates-io. | |
| # Register one publisher per crate (gbp-core, gbp-protocol, gbp-mls, | |
| # gbp-transport, gbp-node, gtp-protocol, gap-protocol, gsp-protocol, | |
| # gbp-sframe, gbp-proto, gbp-flat, gbp-stack, gbp-stack-ffi, gbp-cli) before the first publish. | |
| publish-crates: | |
| name: publish to crates.io | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: crates-io | |
| url: https://crates.io/crates/gbp-stack | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| - name: get crates.io token (OIDC) | |
| id: auth | |
| uses: rust-lang/crates-io-auth-action@v1 | |
| - name: publish in dependency order | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| run: | | |
| set -e | |
| publish() { | |
| local p="$1" | |
| echo "::group::publish $p" | |
| local out | |
| if out=$(cargo publish -p "$p" 2>&1); then | |
| echo "$out" | |
| echo "::endgroup::" | |
| sleep 30 | |
| return 0 | |
| fi | |
| echo "$out" | |
| echo "::endgroup::" | |
| if echo "$out" | grep -q "already exists on crates.io"; then | |
| echo "skip: $p (already published)" | |
| return 0 | |
| fi | |
| return 1 | |
| } | |
| for p in gbp-core gbp-protocol gbp-mls gbp-transport gbp-node \ | |
| gbp-proto gbp-flat \ | |
| gtp-protocol gap-protocol gsp-protocol gbp-sframe \ | |
| gbp-stack gbp-stack-ffi gbp-stack-wasm gbp-cli; do | |
| publish "$p" | |
| done | |
| # Build and publish the npm package. Authentication uses a classic | |
| # NPM_TOKEN secret stored in the `npm` environment. Trusted Publishing | |
| # (OIDC) was tried first but kept returning 404 from the registry; revisit | |
| # once the npm side is debuggable. | |
| pack-npm: | |
| name: npm | |
| needs: build-native | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: npm | |
| url: https://www.npmjs.com/package/@voluntas-progressus/gbp-stack | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| registry-url: "https://registry.npmjs.org" | |
| # The runner's pre-installed npm is sporadically corrupted (missing | |
| # transitive modules like `promise-retry`), which makes | |
| # `npm install -g npm@latest` fail. Use corepack — it ships with Node | |
| # and reliably activates an arbitrary npm version. | |
| - name: ensure npm >= 11.5.1 (OIDC trusted publishing) | |
| run: | | |
| corepack enable | |
| corepack prepare npm@latest --activate | |
| npm --version | |
| - name: download native artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: native-artifacts | |
| pattern: native-* | |
| - name: stage native/<rid>/ | |
| run: | | |
| mkdir -p js/native | |
| for d in native-artifacts/native-*; do | |
| rid=$(basename "$d" | sed 's/^native-//') | |
| mkdir -p "js/native/$rid" | |
| cp "$d"/* "js/native/$rid/" | |
| done | |
| ls -la js/native | |
| - name: install + build + pack | |
| working-directory: js | |
| run: | | |
| npm ci || npm install | |
| npm run build | |
| npm pack | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: npm-tarball | |
| path: js/*.tgz | |
| - name: publish to npm | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| working-directory: js | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_API_KEY }} | |
| run: | | |
| if [ -z "$NODE_AUTH_TOKEN" ]; then echo "NODE_AUTH_TOKEN not set; skipping"; exit 0; fi | |
| npm publish --access public | |
| # Build and publish the WASM npm package @voluntas-progressus/gbp-stack-wasm. | |
| # Full wasm-pack compilation only runs on tag push and workflow_dispatch; | |
| # PRs use the lightweight `cargo check --target wasm32-unknown-unknown` in pr-check. | |
| pack-wasm: | |
| name: wasm npm | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: npm | |
| url: https://www.npmjs.com/package/@voluntas-progressus/gbp-stack-wasm | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-wasm-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-wasm- | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: install wasm-pack | |
| run: | | |
| curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| wasm-pack --version | |
| - name: test wasm package | |
| run: wasm-pack test --node crates/gbp/wasm | |
| - name: build wasm package | |
| run: | | |
| wasm-pack build crates/gbp/wasm \ | |
| --scope voluntas-progressus \ | |
| --release \ | |
| --target bundler \ | |
| --out-dir pkg \ | |
| --out-name gbp_stack_wasm | |
| - name: copy readme into pkg | |
| run: cp crates/gbp/wasm/README.md crates/gbp/wasm/pkg/README.md | |
| - name: show package contents | |
| run: ls -la crates/gbp/wasm/pkg/ | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: wasm-pkg | |
| path: crates/gbp/wasm/pkg/ | |
| - name: publish to npm | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| working-directory: crates/gbp/wasm/pkg | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_API_KEY }} | |
| run: | | |
| if [ -z "$NODE_AUTH_TOKEN" ]; then echo "NPM_API_KEY not set; skipping"; exit 0; fi | |
| echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc | |
| npm publish --access public | |
| # Aggregate every artefact and create a GitHub Release. | |
| github-release: | |
| name: github release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [publish-nuget, build-wheels, build-sdist, publish-pypi, publish-crates, pack-npm, pack-wasm] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| path: artifacts | |
| - name: stage release files | |
| run: | | |
| mkdir -p release | |
| # NuGet packages | |
| if [ -d artifacts/nupkg ]; then cp -r artifacts/nupkg/* release/ || true; fi | |
| # Python wheels + sdist | |
| find artifacts -maxdepth 2 -type d -name 'wheel-*' -exec sh -c 'cp -r "$1"/*.whl release/' _ {} \; | |
| if [ -d artifacts/sdist ]; then cp artifacts/sdist/*.tar.gz release/ || true; fi | |
| # npm tarballs (Node.js FFI + WASM) | |
| if [ -d artifacts/npm-tarball ]; then cp artifacts/npm-tarball/*.tgz release/ || true; fi | |
| if [ -d artifacts/wasm-pkg ]; then | |
| (cd artifacts/wasm-pkg && zip -r "../../release/gbp-stack-wasm.zip" .) || true | |
| fi | |
| # Native binaries (zipped per RID for convenience) | |
| for d in artifacts/native-*; do | |
| rid=$(basename "$d" | sed 's/^native-//') | |
| (cd "$d" && zip -r "../../release/gbp-stack-$rid.zip" .) | |
| done | |
| ls -la release | |
| - name: detect prerelease | |
| id: pre | |
| shell: bash | |
| run: | | |
| # SemVer pre-release: tag carries a `-` suffix | |
| # (e.g. v1.0.0-rc1, v1.0.0-beta.2). Plain MAJOR.MINOR.PATCH = stable. | |
| tag="${GITHUB_REF#refs/tags/}" | |
| if [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+- ]]; then | |
| echo "prerelease=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "prerelease=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: softprops/action-gh-release@v3 | |
| with: | |
| files: release/* | |
| generate_release_notes: true | |
| fail_on_unmatched_files: false | |
| prerelease: ${{ steps.pre.outputs.prerelease == 'true' }} |