chore: prepare v1.0.1 release (#7) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| jobs: | |
| release: | |
| name: Create Release | |
| runs-on: ubuntu-latest | |
| # Write access needed to create the GitHub Release. | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag: v6.0.2 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| # --------------------------------------------------------------- | |
| # Quality gate — every check must pass before publishing. | |
| # --------------------------------------------------------------- | |
| - name: Verify version matches tag | |
| env: | |
| TAG_NAME: ${{ github.ref_name }} | |
| run: | | |
| tag_version="${TAG_NAME#v}" | |
| script_version="$(./smoosh --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" | |
| if [[ "${tag_version}" != "${script_version}" ]]; then | |
| printf 'Tag version (%s) does not match script version (%s)\n' \ | |
| "${tag_version}" "${script_version}" >&2 | |
| exit 1 | |
| fi | |
| - name: Install ShellCheck | |
| run: sudo apt-get install -y shellcheck | |
| - name: Run ShellCheck | |
| run: shellcheck --severity=warning smoosh install.sh | |
| - name: Install shfmt | |
| # go install verifies integrity via the Go module sum database (sum.golang.org). | |
| # mvdan/sh does not publish separate checksum files for its binary releases. | |
| run: | | |
| go install mvdan.cc/sh/v3/cmd/shfmt@v3.13.0 | |
| echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Check shfmt | |
| run: shfmt -d -i 2 smoosh | |
| - name: Install bats | |
| run: | | |
| git clone --depth 1 --branch v1.13.0 https://github.com/bats-core/bats-core.git "$RUNNER_TEMP/bats" | |
| "$RUNNER_TEMP/bats/install.sh" "$RUNNER_TEMP/bats-install" | |
| echo "$RUNNER_TEMP/bats-install/bin" >> "$GITHUB_PATH" | |
| - name: Run tests | |
| env: | |
| TERM: xterm-256color | |
| run: bats test/*.bats | |
| # --------------------------------------------------------------- | |
| # Build release artefacts. | |
| # --------------------------------------------------------------- | |
| - name: Compute SHA256 | |
| run: | | |
| sha256sum smoosh | awk '{print $1}' > smoosh.sha256 | |
| echo "SHA256: $(cat smoosh.sha256)" | |
| # Extract version number from the tag (strip leading 'v'). | |
| # TAG_NAME is passed as an env var rather than directly interpolated into | |
| # the shell command to prevent injection via crafted tag names. | |
| - name: Extract version and changelog | |
| id: meta | |
| env: | |
| TAG_NAME: ${{ github.ref_name }} | |
| run: | | |
| version="${TAG_NAME#v}" | |
| echo "version=${version}" >> "$GITHUB_OUTPUT" | |
| # Pull the matching section from CHANGELOG.md. | |
| body="$(awk "/^\#\# \[${version}\]/{found=1; next} found && /^\#\# /{exit} found{print}" CHANGELOG.md)" | |
| if [[ -z "${body}" ]]; then | |
| body="See CHANGELOG.md for details." | |
| fi | |
| delim="$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 16)" | |
| { | |
| echo "body<<${delim}" | |
| printf '%s\n' "${body}" | |
| echo "${delim}" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG_NAME: ${{ github.ref_name }} | |
| RELEASE_BODY: ${{ steps.meta.outputs.body }} | |
| RELEASE_VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| gh release create "${TAG_NAME}" \ | |
| --title "smoosh v${RELEASE_VERSION}" \ | |
| --notes "${RELEASE_BODY}" \ | |
| smoosh smoosh.sha256 install.sh | |
| update-tap: | |
| name: Update Homebrew Tap | |
| runs-on: ubuntu-latest | |
| needs: release | |
| environment: homebrew | |
| # No repo permissions needed — the PAT authenticates to the tap repo. | |
| permissions: {} | |
| steps: | |
| - uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c # tag: v3.6 | |
| with: | |
| formula-name: smoosh | |
| homebrew-tap: K1-R1/homebrew-tap | |
| env: | |
| COMMITTER_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} |