Viewing is open to everyone. Downloading and starring need a GitHub sign-in.
Sign in with GitHub
release.yml
v0.1.0-build.85
Latest
Commit ede38f5
Sign in with GitHub to download. Each download is recorded with your GitHub username.
| 1 | # Official releases (spec §7, §8): built only from immutable tags on a |
| 2 | # Stable-Release commit. Produces checksummed artifacts with Sigstore build |
| 3 | # provenance and a draft GitHub Release for the maintainer to publish. |
| 4 | name: Release |
| 5 | on: |
| 6 | push: |
| 7 | tags: ['v*'] |
| 8 | permissions: |
| 9 | contents: read |
| 10 | jobs: |
| 11 | verify: |
| 12 | runs-on: ubuntu-24.04 |
| 13 | outputs: |
| 14 | version: ${{ steps.v.outputs.version }} |
| 15 | steps: |
| 16 | - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
| 17 | with: |
| 18 | fetch-depth: 0 |
| 19 | - id: v |
| 20 | name: Tag matches VERSION and is on Stable-Release |
| 21 | run: | |
| 22 | version="$(cat VERSION)" |
| 23 | test "${GITHUB_REF_NAME}" = "v${version}" || { echo "tag ${GITHUB_REF_NAME} does not match VERSION ${version}"; exit 1; } |
| 24 | git fetch origin Stable-Release |
| 25 | git merge-base --is-ancestor "${GITHUB_SHA}" origin/Stable-Release || { echo "tag is not on Stable-Release"; exit 1; } |
| 26 | python3 tools/check_version.py |
| 27 | echo "version=${version}" >> "$GITHUB_OUTPUT" |
| 28 | - name: Full test suite |
| 29 | run: | |
| 30 | cmake -S . -B build -DCMAKE_BUILD_TYPE=Release |
| 31 | cmake --build build --parallel 2 |
| 32 | ctest --test-dir build --output-on-failure |
| 33 | |
| 34 | build: |
| 35 | needs: verify |
| 36 | strategy: |
| 37 | matrix: |
| 38 | include: |
| 39 | - os: ubuntu-24.04 |
| 40 | name: linux-x64 |
| 41 | - os: macos-15 |
| 42 | name: macos-arm64 |
| 43 | - os: windows-2022 |
| 44 | name: windows-x64 |
| 45 | runs-on: ${{ matrix.os }} |
| 46 | steps: |
| 47 | - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
| 48 | - name: Build and install |
| 49 | shell: bash |
| 50 | run: | |
| 51 | cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCKEY_BUILD_TESTS=OFF |
| 52 | cmake --build build --config Release --parallel 2 |
| 53 | cmake --install build --config Release --prefix "ckey-${{ needs.verify.outputs.version }}-${{ matrix.name }}" |
| 54 | - name: Archive |
| 55 | shell: bash |
| 56 | run: | |
| 57 | dir="ckey-${{ needs.verify.outputs.version }}-${{ matrix.name }}" |
| 58 | cp LICENSE README.md CHANGELOG.md "$dir/" |
| 59 | tar -czf "$dir.tar.gz" "$dir" |
| 60 | - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 |
| 61 | with: |
| 62 | name: ckey-${{ matrix.name }} |
| 63 | path: ckey-*.tar.gz |
| 64 | |
| 65 | # The SDK workflows, reused, build and test each release package. |
| 66 | sdk-web: |
| 67 | needs: verify |
| 68 | uses: ./.github/workflows/sdk-web.yml |
| 69 | sdk-android: |
| 70 | needs: verify |
| 71 | uses: ./.github/workflows/sdk-android.yml |
| 72 | sdk-dotnet: |
| 73 | needs: verify |
| 74 | uses: ./.github/workflows/sdk-dotnet.yml |
| 75 | sdk-swift: |
| 76 | needs: verify |
| 77 | uses: ./.github/workflows/sdk-swift.yml |
| 78 | |
| 79 | publish: |
| 80 | needs: [verify, build, sdk-web, sdk-android, sdk-dotnet, sdk-swift] |
| 81 | runs-on: ubuntu-24.04 |
| 82 | permissions: |
| 83 | contents: write # create the draft release |
| 84 | id-token: write # Sigstore signing for provenance |
| 85 | attestations: write |
| 86 | steps: |
| 87 | - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
| 88 | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
| 89 | with: |
| 90 | pattern: ckey-*-x64 |
| 91 | path: dist |
| 92 | merge-multiple: true |
| 93 | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
| 94 | with: |
| 95 | pattern: ckey-macos-* |
| 96 | path: dist |
| 97 | merge-multiple: true |
| 98 | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
| 99 | with: |
| 100 | name: ckey-npm |
| 101 | path: dist |
| 102 | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
| 103 | with: |
| 104 | name: nuget-packages |
| 105 | path: dist |
| 106 | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
| 107 | with: |
| 108 | name: ckey-android-maven |
| 109 | path: maven |
| 110 | - name: Package downloads (Maven repository zip, Swift source zip) |
| 111 | run: | |
| 112 | version="${{ needs.verify.outputs.version }}" |
| 113 | (cd maven && zip -qr "../dist/ckey-android-maven-${version}.zip" .) |
| 114 | git archive --format=zip --prefix="ckey-swift-${version}/" HEAD Package.swift LICENSE src include sdk/swift > "dist/ckey-swift-${version}.zip" |
| 115 | ls -la dist |
| 116 | - name: Source archive and Homebrew formula |
| 117 | run: | |
| 118 | tag="${GITHUB_REF_NAME}" |
| 119 | curl -fsSL -o "dist/ckey-${tag}-source.tar.gz" "https://github.com/${GITHUB_REPOSITORY}/archive/refs/tags/${tag}.tar.gz" |
| 120 | python3 tools/release/make_homebrew_formula.py "${tag}" "dist/ckey-${tag}-source.tar.gz" > dist/ckey.rb |
| 121 | cp docs/support-matrix.json dist/ |
| 122 | - name: Checksums |
| 123 | working-directory: dist |
| 124 | run: sha256sum * > SHA256SUMS |
| 125 | - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 |
| 126 | with: |
| 127 | subject-path: 'dist/*' |
| 128 | - name: Draft GitHub Release |
| 129 | env: |
| 130 | GH_TOKEN: ${{ github.token }} |
| 131 | run: | |
| 132 | gh release create "${GITHUB_REF_NAME}" dist/* --draft --verify-tag \ |
| 133 | --title "CKey ${{ needs.verify.outputs.version }}" \ |
| 134 | --notes "See CHANGELOG-STABLE.md. Verify downloads with SHA256SUMS and 'gh attestation verify <file> --repo ${GITHUB_REPOSITORY}'." |