Repository navigation
chore: update flake.lock (#241) #697
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| pull_request: {} | |
| push: | |
| branches: | |
| - master | |
| tags: [ 'v*.*.*' ] | |
| name: CI | |
| # OIDC trusted publishing for npm requires `id-token: write` at the workflow | |
| # level here (parent) AND at the workflow level of release.yml (child). Per | |
| # https://docs.npmjs.com/trusted-publishers : "The id-token: write permission | |
| # must also be given to both parent and child workflows." | |
| # | |
| # NPM-SIDE NOTE: ci.yml is the workflow filename that npm validates against | |
| # the OIDC token's `workflow_ref` claim, because release.yml is invoked via | |
| # `workflow_call`. Each npm package's trusted publisher on npmjs.com must | |
| # list "ci.yml" as the workflow filename. If you rename this file, update | |
| # every trusted publisher entry to match or releases will fail with | |
| # ENEEDAUTH at npm publish. | |
| permissions: | |
| id-token: write | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v6 | |
| - name: Cache rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check that Cargo.lock is up-to-date | |
| run: cargo metadata --format-version 1 --locked | |
| - name: Run cargo fmt | |
| run: cargo fmt --check | |
| - name: Run cargo clippy | |
| run: cargo clippy --all-targets --features git-file-protocol -- -D warnings | |
| - name: Run cargo check | |
| run: cargo check | |
| test: | |
| strategy: | |
| matrix: | |
| runner: [ ubuntu-latest, macos-latest, windows-latest ] | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v6 | |
| - name: Cache rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run cargo test | |
| run: cargo test | |
| - name: Run e2e tests with libgit2 backend | |
| run: cargo test --test e2e --features git-file-protocol | |
| env: | |
| PROTOFETCH_GIT_BACKEND: libgit2 | |
| - name: Run e2e tests with CLI backend | |
| run: cargo test --test e2e --features git-file-protocol | |
| env: | |
| PROTOFETCH_GIT_BACKEND: cli | |
| versions: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-hack,cargo-minimal-versions | |
| - name: Checkout sources | |
| uses: actions/checkout@v6 | |
| - name: Cache rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| # Check with minimal dependency versions and MSRV from Cargo.toml | |
| - name: Check minimal versions | |
| run: cargo minimal-versions check --rust-version --features vendored-openssl,vendored-libgit2 | |
| semver: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v6 | |
| - name: Check semver | |
| uses: obi1kenobi/cargo-semver-checks-action@v2 | |
| flake: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v6 | |
| - name: Install nix | |
| uses: DeterminateSystems/nix-installer-action@v22 | |
| - name: Cache nix dependencies | |
| uses: DeterminateSystems/magic-nix-cache-action@v14 | |
| with: | |
| use-flakehub: false | |
| - name: Build | |
| run: nix flake check | |
| update-release-draft: | |
| runs-on: ubuntu-latest | |
| if: github.repository == 'coralogix/protofetch' && github.ref == 'refs/heads/master' | |
| # Workflow-level permissions narrow the default to `contents: read`, but | |
| # release-drafter needs to create/update draft releases and read merged | |
| # PRs for the release notes. Restore the scopes it needs here. | |
| permissions: | |
| contents: write | |
| pull-requests: read | |
| steps: | |
| - uses: release-drafter/release-drafter@v7 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| package: | |
| needs: [ lint, test, versions, semver ] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - rust: aarch64-unknown-linux-musl | |
| runner: ubuntu-latest | |
| tar: tar | |
| cross: true | |
| ext: '' | |
| - rust: x86_64-unknown-linux-musl | |
| runner: ubuntu-latest | |
| tar: tar | |
| cross: true | |
| ext: '' | |
| - rust: aarch64-apple-darwin | |
| runner: macos-14 | |
| # We use gtar to make sure compressed files are not detected as sparse | |
| tar: gtar | |
| cross: false | |
| ext: '' | |
| - rust: x86_64-apple-darwin | |
| runner: macos-15-intel | |
| # We use gtar to make sure compressed files are not detected as sparse | |
| tar: gtar | |
| cross: false | |
| ext: '' | |
| - rust: x86_64-pc-windows-msvc | |
| runner: windows-latest | |
| tar: tar | |
| cross: false | |
| ext: '.exe' | |
| runs-on: ${{ matrix.target.runner }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Cache rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: ${{ matrix.target.rust }} | |
| - name: Install cross | |
| if: ${{ matrix.target.cross }} | |
| run: cargo install --locked cross | |
| - name: Build | |
| run: ${{ matrix.target.cross && 'cross' || 'cargo' }} build --release --target ${{ matrix.target.rust }} --features vendored-openssl,vendored-libgit2 | |
| - name: Package | |
| run: | | |
| mv target/${{ matrix.target.rust }}/release bin/ | |
| ${{ matrix.target.tar }} -czvf protofetch_${{ matrix.target.rust }}.tar.gz bin/protofetch${{ matrix.target.ext }} | |
| - name: Upload | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: package-${{ matrix.target.rust }} | |
| path: protofetch_${{ matrix.target.rust }}.tar.gz | |
| # Verifies the npm distribution on each real OS/arch: build the main package | |
| # and the host's platform package, install BOTH from local tarballs into a | |
| # clean project (no registry needed), and confirm the `protofetch` command | |
| # runs. This exercises the run.js wrapper resolving the platform binary and | |
| # the binary itself executing on every supported platform. | |
| test-npm-package: | |
| # Pin the check name to "(runner, platform)" so it matches the names | |
| # configured as required status checks in branch protection. Without an | |
| # explicit name, GitHub appends every matrix field (including node_pkg) to | |
| # the auto-generated name, and the required checks would never match (they | |
| # would sit pending forever and block the PR). | |
| name: test-npm-package (${{ matrix.os.runner }}, ${{ matrix.os.platform }}) | |
| needs: [ package ] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - runner: ubuntu-latest | |
| platform: x86_64-unknown-linux-musl | |
| node_pkg: linux-x64 | |
| - runner: macos-14 | |
| platform: aarch64-apple-darwin | |
| node_pkg: darwin-arm64 | |
| - runner: macos-15-intel | |
| platform: x86_64-apple-darwin | |
| node_pkg: darwin-x64 | |
| - runner: windows-latest | |
| platform: x86_64-pc-windows-msvc | |
| node_pkg: win32-x64 | |
| runs-on: ${{ matrix.os.runner }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '22' | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - name: Download artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: package-${{ matrix.os.platform }} | |
| path: artifacts | |
| - name: Build npm packages and pack them | |
| shell: bash | |
| run: | | |
| node .github/npm/prepare-package.js --target main --version 0.0.0-test | |
| node .github/npm/prepare-package.js --target platform --rust ${{ matrix.os.platform }} --version 0.0.0-test --artifacts artifacts | |
| mkdir -p packed | |
| npm pack --pack-destination packed .github/npm/dist/coralogix-protofetch | |
| npm pack --pack-destination packed .github/npm/dist/platform/coralogix-protofetch-${{ matrix.os.node_pkg }} | |
| - name: Test npm installation | |
| shell: bash | |
| run: | | |
| # Consumer project as a workspace subdir with RELATIVE tarball paths: | |
| # avoids Windows backslash / MSYS path-translation issues that an | |
| # absolute $GITHUB_WORKSPACE path would hit under git-bash. | |
| rm -rf consumer-npm && mkdir consumer-npm && cd consumer-npm | |
| npm init -y > /dev/null | |
| # Installing both local tarballs: the explicitly-installed platform | |
| # package satisfies the main package's optionalDependency, so the | |
| # run.js wrapper resolves the binary without contacting a registry. | |
| npm install --no-audit --no-fund ../packed/*.tgz | |
| ./node_modules/.bin/protofetch --version | |
| - name: Test pnpm installation | |
| shell: bash | |
| run: | | |
| rm -rf consumer-pnpm && mkdir consumer-pnpm && cd consumer-pnpm | |
| npm init -y > /dev/null | |
| pnpm add ../packed/*.tgz | |
| ./node_modules/.bin/protofetch --version | |
| # Per-PR preview packages via pkg.pr.new (no git tags / GitHub Releases). | |
| # | |
| # The main package + all five platform packages MUST publish in ONE invocation | |
| # of dist DIRECTORIES (not .tgz): pkg.pr.new only rewrites optionalDependencies | |
| # to the preview URLs for sibling packages in the same call, and tarballs are | |
| # uploaded as-is without rewriting. | |
| preview-publish: | |
| name: pkg.pr.new | |
| needs: [ package ] | |
| if: github.repository == 'coralogix/protofetch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '24' | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| pattern: package-* | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Prepare npm packages | |
| run: | | |
| node .github/npm/prepare-package.js --target main | |
| for rust in \ | |
| aarch64-apple-darwin \ | |
| x86_64-apple-darwin \ | |
| aarch64-unknown-linux-musl \ | |
| x86_64-unknown-linux-musl \ | |
| x86_64-pc-windows-msvc; do | |
| node .github/npm/prepare-package.js --target platform --rust "$rust" --artifacts artifacts | |
| done | |
| - name: Publish preview packages | |
| run: | | |
| npx pkg-pr-new@0.0.75 publish --comment=update --no-template \ | |
| ./.github/npm/dist/coralogix-protofetch \ | |
| ./.github/npm/dist/platform/* | |
| release: | |
| if: github.repository == 'coralogix/protofetch' && startsWith(github.ref, 'refs/tags/') | |
| needs: [ package, test-npm-package ] | |
| # When using `workflow_call`, the parent caller job's permissions are the | |
| # ceiling for what the child workflow can request. We grant the union of | |
| # everything the child needs: | |
| # - id-token: write -> for npm OIDC trusted publishing (both npm jobs) | |
| # - contents: write -> for the `github` job's release-asset upload | |
| permissions: | |
| id-token: write | |
| contents: write | |
| uses: ./.github/workflows/release.yml | |
| secrets: inherit |