27.0.0 #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: publish | |
| on: | |
| release: | |
| types: | |
| - published | |
| permissions: | |
| contents: write # release job creates/updates the GitHub Release | |
| attestations: write # actions/attest-build-provenance + actions/attest publish to the repo's attestation store | |
| id-token: write # OIDC token used by buildx provenance and the attest actions | |
| artifact-metadata: write # actions/attest creates an artifact storage record | |
| env: | |
| # Override per-repo via Settings → Variables → Actions (vars.REGISTRY). | |
| # Useful for forks that want to publish to a personal registry for | |
| # testing without forking the workflow itself. | |
| REGISTRY: ${{ vars.REGISTRY || 'docker.io/stellar/stellar-cli' }} | |
| jobs: | |
| matrix: | |
| name: resolve matrix | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| matrix: ${{ steps.resolve.outputs.matrix }} | |
| stellar_cli_version: ${{ steps.scope.outputs.version }} | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: validate builds.json | |
| run: ./scripts/validate_json.py | |
| - name: scope to one cli version | |
| id: scope | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| # Tag is "v<version>" or "v<version>-<N>" (refresh iterations). | |
| # Strip leading "v" and trailing "-<N>" if present to derive | |
| # the stellar-cli version. | |
| no_prefix="${RELEASE_TAG#v}" | |
| version="${no_prefix%%-*}" | |
| test -n "$version" || { echo "::error::could not determine stellar_cli_version from release tag '$RELEASE_TAG'"; exit 1; } | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: resolve matrix | |
| id: resolve | |
| env: | |
| STELLAR_CLI_VERSION: ${{ steps.scope.outputs.version }} | |
| run: | | |
| matrix="$(./scripts/resolve_matrix.py \ | |
| --stellar-cli-version "$STELLAR_CLI_VERSION")" | |
| echo "matrix=$matrix" >> "$GITHUB_OUTPUT" | |
| build: | |
| name: ${{ matrix.stellar_cli_version }} rust${{ matrix.rust_base_key }} ${{ matrix.arch }} | |
| needs: matrix | |
| strategy: | |
| matrix: ${{ fromJson(needs.matrix.outputs.matrix) }} | |
| fail-fast: false | |
| runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }} | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: set up buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: resolve tag | |
| id: tag | |
| run: | | |
| tag="$(./scripts/tag_names.py \ | |
| --stellar-cli-version ${{ matrix.stellar_cli_version }} \ | |
| --rust-version ${{ matrix.rust_base_key }} \ | |
| --platform ${{ matrix.platform }})" | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| echo "image=$REGISTRY:$tag" >> "$GITHUB_OUTPUT" | |
| - name: login to Docker Hub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: build metadata | |
| id: meta | |
| run: | | |
| echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT" | |
| - name: build and push | |
| id: build | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| push: true | |
| platforms: ${{ matrix.platform }} | |
| tags: ${{ steps.tag.outputs.image }} | |
| provenance: mode=max | |
| sbom: true | |
| build-args: | | |
| RUST_VERSION=${{ matrix.rust_version }} | |
| RUST_BASE_SUFFIX=${{ matrix.rust_base_suffix }} | |
| RUST_IMAGE_DIGEST=${{ matrix.rust_image_digest }} | |
| STELLAR_CLI_REV=${{ matrix.stellar_cli_ref }} | |
| STELLAR_CLI_VERSION=${{ matrix.stellar_cli_version }} | |
| BUILD_DATE=${{ steps.meta.outputs.build_date }} | |
| SOURCE_REPO=${{ github.repository }} | |
| - name: generate SBOM file | |
| uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| with: | |
| image: ${{ steps.tag.outputs.image }}@${{ steps.build.outputs.digest }} | |
| format: spdx-json | |
| output-file: sbom-${{ matrix.stellar_cli_version }}-rust${{ matrix.rust_base_id }}-${{ matrix.arch }}.spdx.json | |
| upload-release-assets: false | |
| upload-artifact: false | |
| - name: attest build provenance | |
| id: attest-prov | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | |
| with: | |
| subject-name: ${{ env.REGISTRY }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| # Also push the signed Sigstore attestation alongside the image | |
| # in the registry, so consumers can verify with cosign without | |
| # needing the gh CLI or access to the GitHub attestations API. | |
| push-to-registry: true | |
| - name: attest SBOM | |
| id: attest-sbom | |
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 | |
| with: | |
| subject-name: ${{ env.REGISTRY }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| sbom-path: sbom-${{ matrix.stellar_cli_version }}-rust${{ matrix.rust_base_id }}-${{ matrix.arch }}.spdx.json | |
| push-to-registry: true | |
| - name: write per-arch metadata | |
| run: | | |
| ./scripts/write_metadata.py \ | |
| --output "meta-${{ matrix.stellar_cli_version }}-rust${{ matrix.rust_base_id }}-${{ matrix.arch }}.json" \ | |
| --arch "${{ matrix.arch }}" \ | |
| --stellar-cli-version "${{ matrix.stellar_cli_version }}" \ | |
| --digest "${{ steps.build.outputs.digest }}" \ | |
| --image "${{ steps.tag.outputs.image }}" \ | |
| --rust-base-key "${{ matrix.rust_base_key }}" \ | |
| --rust-version "${{ matrix.rust_version }}" \ | |
| --tag "${{ steps.tag.outputs.tag }}" | |
| - name: rename provenance bundle | |
| run: | | |
| cp "${{ steps.attest-prov.outputs.bundle-path }}" \ | |
| "prov-${{ matrix.stellar_cli_version }}-rust${{ matrix.rust_base_id }}-${{ matrix.arch }}.intoto.jsonl" | |
| - name: upload release artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: release-artifacts-${{ matrix.stellar_cli_version }}-rust${{ matrix.rust_base_id }}-${{ matrix.arch }} | |
| path: | | |
| sbom-*.spdx.json | |
| prov-*.intoto.jsonl | |
| meta-*.json | |
| retention-days: 7 | |
| if-no-files-found: error | |
| manifest: | |
| name: assemble manifest lists | |
| needs: [matrix, build] | |
| runs-on: ubuntu-24.04 | |
| env: | |
| STELLAR_CLI_VERSION: ${{ needs.matrix.outputs.stellar_cli_version }} | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: set up buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: login to Docker Hub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: create manifest list per (cli, rust base) pair | |
| run: | | |
| ./scripts/publish_manifests.py \ | |
| --stellar-cli-version "$STELLAR_CLI_VERSION" \ | |
| --registry "$REGISTRY" | |
| aliases: | |
| name: publish moving aliases | |
| needs: [matrix, manifest] | |
| runs-on: ubuntu-24.04 | |
| env: | |
| STELLAR_CLI_VERSION: ${{ needs.matrix.outputs.stellar_cli_version }} | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: set up buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: login to Docker Hub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: publish :<cli> and :latest aliases | |
| run: | | |
| ./scripts/publish_aliases.py \ | |
| --stellar-cli-version "$STELLAR_CLI_VERSION" \ | |
| --registry "$REGISTRY" | |
| description: | |
| name: update Docker Hub description | |
| needs: [manifest] | |
| # Skip for forks publishing to a non-Docker-Hub registry; the Docker Hub | |
| # API only makes sense for docker.io repositories. | |
| if: startsWith(vars.REGISTRY || 'docker.io/stellar/stellar-cli', 'docker.io/') | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: update full description from docker/README.md | |
| env: | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: | | |
| # Derive the Docker Hub "namespace/repo" path from REGISTRY by | |
| # dropping the docker.io/ host prefix. | |
| repo="${REGISTRY#docker.io/}" | |
| token=$(jq -n --arg u "$DOCKERHUB_USERNAME" --arg p "$DOCKERHUB_TOKEN" \ | |
| '{username: $u, password: $p}' | \ | |
| curl -sSf -X POST "https://hub.docker.com/v2/users/login/" \ | |
| -H "Content-Type: application/json" \ | |
| -d @- \ | |
| | jq -er .token) | |
| jq -n --arg desc "$(cat ./docker/README.md)" '{"full_description": $desc}' | \ | |
| curl -sSf -X PATCH "https://hub.docker.com/v2/repositories/${repo}/" \ | |
| -H "Content-Type: application/json" \ | |
| -H "Authorization: Bearer ${token}" \ | |
| -d @- \ | |
| > /dev/null | |
| release: | |
| name: enrich github release with sbom and provenance | |
| needs: [matrix, aliases] | |
| runs-on: ubuntu-24.04 | |
| env: | |
| STELLAR_CLI_VERSION: ${{ needs.matrix.outputs.stellar_cli_version }} | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: download per-arch release artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: release-artifacts | |
| pattern: release-artifacts-* | |
| merge-multiple: true | |
| - name: compose structural body section | |
| run: | | |
| ./scripts/release_body.py \ | |
| --stellar-cli-version "$STELLAR_CLI_VERSION" \ | |
| --metadata-dir release-artifacts \ | |
| --registry "$REGISTRY" \ | |
| --repo "${{ github.repository }}" \ | |
| > release-body.md | |
| - name: update the github release | |
| uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 | |
| with: | |
| tag_name: ${{ github.event.release.tag_name }} | |
| body_path: release-body.md | |
| append_body: true | |
| files: | | |
| release-artifacts/sbom-*.spdx.json | |
| release-artifacts/prov-*.intoto.jsonl | |
| complete: | |
| if: always() | |
| needs: | |
| - matrix | |
| - build | |
| - manifest | |
| - aliases | |
| - description | |
| - release | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: check upstream jobs | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: exit 1 |