Skip to content

Release

Release #3

Workflow file for this run

name: Release
on:
push:
tags:
- 'v*'
# Manual "Run workflow" button to (re)publish the current version
# without pushing a new tag or bumping the version.
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
jobs:
release:
name: Release
runs-on: ubuntu-22.04
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: install dependencies (ubuntu)
run: |
sudo apt-get update
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
# PyO3 (default backend) embeds CPython, so a Python interpreter must be
# available to build & run the verification build / tests.
- uses: actions/setup-python@v5
with:
python-version: '3.x'
- name: build release
run: cargo build --release --all-targets
- name: test
run: cargo test --release
# Only create a GitHub Release for real tag pushes, not manual re-runs.
- name: Create GitHub Release
if: startsWith(github.ref, 'refs/tags/')
uses: softprops/action-gh-release@v2
with:
generate_release_notes: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
publish-crates-io:
name: Publish to crates.io
runs-on: ubuntu-22.04
needs: release
environment: release
permissions:
# Required for crates.io Trusted Publishing (OIDC).
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: install dependencies (ubuntu)
run: |
sudo apt-get update
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
# cargo publish runs a verification build; PyO3 needs a Python interpreter.
- uses: actions/setup-python@v5
with:
python-version: '3.x'
# Exchange the GitHub OIDC token for a short-lived crates.io token.
# Sets CARGO_REGISTRY_TOKEN in the environment for subsequent steps.
- name: Authenticate to crates.io (Trusted Publishing)
uses: rust-lang/crates-io-auth-action@v1
id: auth
# Skip if this version is already on crates.io so re-running the
# workflow (or moving the tag) doesn't fail on a duplicate publish.
- name: Publish to crates.io
run: |
NAME=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['name'])")
VERSION=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['version'])")
if curl -sf "https://crates.io/api/v1/crates/$NAME/$VERSION" > /dev/null; then
echo "crates.io already has $NAME@$VERSION — skipping publish."
else
cargo publish
fi
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
publish-npm:
name: Publish to npm
runs-on: ubuntu-22.04
needs: release
environment: release
permissions:
# Required for npm Trusted Publishing (OIDC): GitHub mints a short-lived
# identity token that npm verifies — no NPM_TOKEN/OTP needed.
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: lts/*
registry-url: 'https://registry.npmjs.org'
# Trusted Publishing (OIDC) requires npm >= 11.5.1; the version bundled
# with the LTS Node release is older.
- name: Upgrade npm
run: npm install -g npm@latest
- name: install dependencies
run: pnpm install
# npm publish runs `prepublishOnly` (pnpm build) to produce dist-js/.
# Use the npm CLI (not pnpm) so OIDC trusted publishing is used.
# Skip if this version is already on npm so re-running doesn't fail
# on a duplicate publish.
- name: Publish to npm
run: |
NAME=$(node -p "require('./package.json').name")
VERSION=$(node -p "require('./package.json').version")
if [ -n "$(npm view "$NAME@$VERSION" version 2>/dev/null)" ]; then
echo "npm already has $NAME@$VERSION — skipping publish."
else
npm publish --access public
fi