release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  linux-binary:
    runs-on: ubuntu-latest
    permissions:
      # Needed to attach the binary to the release.
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Rust
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
          rustup toolchain install stable --profile minimal --target x86_64-unknown-linux-musl
          rustup default stable
      - name: Check that the tag matches Cargo.toml
        env:
          TAG: ${{ github.event.release.tag_name }}
        run: |
          version=$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)
          if [ "$TAG" != "v$version" ]; then
            echo "Tag $TAG does not match version $version in Cargo.toml"
            exit 1
          fi
      - run: cargo test --locked
      # Static build, so it runs in any Linux container regardless of its glibc.
      - run: cargo build --release --locked --target x86_64-unknown-linux-musl
      - name: Attach to release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.event.release.tag_name }}
        run: |
          mkdir dist
          cp target/x86_64-unknown-linux-musl/release/version-api dist/version-api-x86_64-linux
          cd dist
          sha256sum version-api-x86_64-linux > version-api-x86_64-linux.sha256
          gh release upload "$TAG" version-api-x86_64-linux version-api-x86_64-linux.sha256 \
            --repo "$GITHUB_REPOSITORY" --clobber