Release #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| # Manual "Run workflow" button to (re)publish the current version | |
| # without pushing a new tag or bumping the version. | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: install dependencies (ubuntu) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| # PyO3 (default backend) embeds CPython, so a Python interpreter must be | |
| # available to build & run the verification build / tests. | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.x' | |
| - name: build release | |
| run: cargo build --release --all-targets | |
| - name: test | |
| run: cargo test --release | |
| # Only create a GitHub Release for real tag pushes, not manual re-runs. | |
| - name: Create GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| publish-crates-io: | |
| name: Publish to crates.io | |
| runs-on: ubuntu-22.04 | |
| needs: release | |
| environment: release | |
| permissions: | |
| # Required for crates.io Trusted Publishing (OIDC). | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: install dependencies (ubuntu) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| # cargo publish runs a verification build; PyO3 needs a Python interpreter. | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.x' | |
| # Exchange the GitHub OIDC token for a short-lived crates.io token. | |
| # Sets CARGO_REGISTRY_TOKEN in the environment for subsequent steps. | |
| - name: Authenticate to crates.io (Trusted Publishing) | |
| uses: rust-lang/crates-io-auth-action@v1 | |
| id: auth | |
| # Skip if this version is already on crates.io so re-running the | |
| # workflow (or moving the tag) doesn't fail on a duplicate publish. | |
| - name: Publish to crates.io | |
| run: | | |
| NAME=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['name'])") | |
| VERSION=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['version'])") | |
| if curl -sf "https://crates.io/api/v1/crates/$NAME/$VERSION" > /dev/null; then | |
| echo "crates.io already has $NAME@$VERSION — skipping publish." | |
| else | |
| cargo publish | |
| fi | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| publish-npm: | |
| name: Publish to npm | |
| runs-on: ubuntu-22.04 | |
| needs: release | |
| environment: release | |
| permissions: | |
| # Required for npm Trusted Publishing (OIDC): GitHub mints a short-lived | |
| # identity token that npm verifies — no NPM_TOKEN/OTP needed. | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: lts/* | |
| registry-url: 'https://registry.npmjs.org' | |
| # Trusted Publishing (OIDC) requires npm >= 11.5.1; the version bundled | |
| # with the LTS Node release is older. | |
| - name: Upgrade npm | |
| run: npm install -g npm@latest | |
| - name: install dependencies | |
| run: pnpm install | |
| # npm publish runs `prepublishOnly` (pnpm build) to produce dist-js/. | |
| # Use the npm CLI (not pnpm) so OIDC trusted publishing is used. | |
| # Skip if this version is already on npm so re-running doesn't fail | |
| # on a duplicate publish. | |
| - name: Publish to npm | |
| run: | | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| if [ -n "$(npm view "$NAME@$VERSION" version 2>/dev/null)" ]; then | |
| echo "npm already has $NAME@$VERSION — skipping publish." | |
| else | |
| npm publish --access public | |
| fi |