name: CI # Forgejo reads .forgejo/workflows before .github/workflows. Actions referenced # bare (actions/checkout, actions/cache, ...) resolve through the instance's # DEFAULT_ACTIONS_URL, which points at data.forgejo.org, so nothing here reaches # out to github.com. on: push: # Pushing a branch whose name starts with Release cuts a release: the version # comes from Cargo.toml and the release job creates the tag itself. Pushing a # v* tag by hand still works and takes the same path. The lowercase pattern is # there because branch names are case-sensitive and a silent no-op would be a # miserable thing to debug, as is the fact that * does not match / in these # filters - Release/0.9.1 needs the ** form to be seen at all. branches: [master, 'Release*', 'Release/**', 'release*', 'release/**'] tags: ['v*'] pull_request: branches: [master] workflow_dispatch: concurrency: group: ci-${{ github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} env: CARGO_TERM_COLOR: always # Incremental artifacts are never reused between CI runs and would bloat the # cached target/ tree for nothing. CARGO_INCREMENTAL: '0' RUST_BACKTRACE: '1' jobs: # ---------------------------------------------------------------- linux ---- # # The container base is load-bearing: packaging/build-deb.sh derives the # package's libc6 floor with objdump from the binary it just built, so the # .deb inherits the *builder's* glibc. Ubuntu 22.04 fixes that floor at 2.35, # which covers 22.04 LTS and newer plus Debian 12 and newer. Packages built by # hand on a dev machine declared libc6 (>= 2.43) and installed on almost # nothing. # # catthehacker/ubuntu is the act-compatible image family. A bare ubuntu:22.04 # will not work: JS actions need Node already present in the image, and no # step can install it before actions/checkout runs. linux: runs-on: self-hosted container: image: catthehacker/ubuntu:act-22.04 env: # crates/quicksearch-core/src/config.rs has a test that expects a home # directory and panics without one. HOME: /root # The highest libc6 version the .deb is allowed to require. MAX_GLIBC: '2.35' steps: - uses: actions/checkout@v4 - name: Check the tag matches the workspace version # Asset names come from [workspace.package] version, not from the tag, so # tagging v0.9.0 against version 0.8.8 would publish a release called # v0.9.0 full of 0.8.8 files. Fails in seconds, before anything is built. if: startsWith(github.ref, 'refs/tags/v') run: | version=$(sed -n '/^\[workspace\.package\]/,/^\[/{ s/^version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p }' Cargo.toml) tag="${GITHUB_REF#refs/tags/}" if [ "v$version" != "$tag" ]; then echo "ERROR: tag $tag does not match the workspace version $version." >&2 echo "Bump [workspace.package] version in Cargo.toml, refresh Cargo.lock," >&2 echo "commit, delete the tag and re-tag." >&2 exit 1 fi echo "OK: $tag matches the workspace version" - name: Install build dependencies run: | apt-get update -qq # rusqlite's bundled-sqlcipher-vendored-openssl and keyring's vendored # feature compile SQLCipher, OpenSSL and libdbus from source, so a C # toolchain plus perl covers them and no -dev packages are needed. # winit and glutin dlopen the whole display stack, so there are no X11 # or Wayland headers here either. The rest is what build-deb.sh checks # for before it will run. apt-get install -y --no-install-recommends \ build-essential perl pkg-config \ binutils dpkg-dev desktop-file-utils gzip - name: Trust the workspace # checkout writes as root into a directory git then considers dubiously # owned; build-deb.sh and the version scrape both shell out to git. run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Install Rust run: | # --default-toolchain none defers to rust-toolchain.toml, so the pinned # channel and its targets are downloaded exactly once. curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \ | sh -s -- -y --profile minimal --default-toolchain none echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" # Materialise the pinned toolchain here rather than partway through the # build, so a toolchain problem shows up as its own failed step. "$HOME/.cargo/bin/rustup" show - uses: actions/cache@v4 with: path: | ~/.cargo/registry/index ~/.cargo/registry/cache ~/.cargo/git/db target # Keyed per job so this tree never collides with the cross-compiled one. key: ${{ github.job }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }} restore-keys: ${{ github.job }}-cargo- - name: Build run: cargo build --release --locked -p quicksearch-gui - name: Test # Release mode is not a nicety: tests/encrypted.rs derives an Argon2id key # at m=64 MiB, t=3, which takes about half a second in release and minutes # in debug. tests/snippet_perf.rs self-skips without QSB_SNIPPET_PERF=1. run: cargo test --release --locked --workspace - name: Build the .deb # --no-build reuses the binaries from the Build step rather than # recompiling. SOURCE_DATE_EPOCH pins the generated changelog date so # repeat builds of the same commit are byte-identical. run: | SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)" \ ./packaging/build-deb.sh --no-build - name: Check the glibc floor # The whole point of pinning the container. If someone bumps the image, # this fails loudly instead of quietly shipping an uninstallable package. run: | deb=$(ls dist/*.deb) depends=$(dpkg-deb -f "$deb" Depends) echo "$depends" floor=$(printf '%s' "$depends" | sed -n 's/.*libc6 (>= \([0-9][0-9.]*\)).*/\1/p') [ -n "$floor" ] || { echo "could not read the libc6 floor from $deb" >&2; exit 1; } # dpkg's own comparator, so 2.9 does not sort above 2.35. if ! dpkg --compare-versions "$floor" le "$MAX_GLIBC"; then echo "ERROR: the .deb requires glibc $floor, above the $MAX_GLIBC target." >&2 echo "The build container base has probably changed." >&2 exit 1 fi echo "OK: glibc floor $floor <= $MAX_GLIBC" - name: Package the binaries # A tarball for anyone not installing the .deb, stripped to match what # build-deb.sh ships. run: | version=$(sed -n '/^\[workspace\.package\]/,/^\[/{ s/^version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p }' Cargo.toml) [ -n "$version" ] || { echo "could not read the version from Cargo.toml" >&2; exit 1; } stage="quicksearch-$version-linux-x86_64" mkdir -p "dist/$stage" for bin in quicksearch quicksearch-cli; do install -m755 "target/release/$bin" "dist/$stage/$bin" strip --strip-unneeded "dist/$stage/$bin" done install -m644 README.md config_example.toml LICENSE "dist/$stage/" tar -czf "dist/$stage.tar.gz" -C dist "$stage" rm -rf "dist/$stage" ls -l dist/ - uses: actions/upload-artifact@v4 with: name: linux-x86_64 path: | dist/*.deb dist/*.tar.gz if-no-files-found: error retention-days: 14 # -------------------------------------------------------- windows-cross ---- # # Deliberately a newer base than the linux job. This job emits a PE binary # linked against msvcrt.dll, so the container's glibc cannot affect what the # .exe runs on; pinning it to 22.04 would buy nothing while forcing the build # through mingw-w64 10.3 instead of 13.2. windows-cross: runs-on: self-hosted container: image: catthehacker/ubuntu:act-24.04 env: HOME: /root TARGET: x86_64-pc-windows-gnu # rusqlite, zstd-sys and openssl-src all shell out to a C compiler, which # has to be the cross one rather than the host's cc. CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc AR_x86_64_pc_windows_gnu: x86_64-w64-mingw32-ar steps: - uses: actions/checkout@v4 - name: Install build dependencies run: | apt-get update -qq apt-get install -y --no-install-recommends \ build-essential perl make pkg-config \ gcc-mingw-w64-x86-64 zip - name: Trust the workspace run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Install Rust run: | curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \ | sh -s -- -y --profile minimal --default-toolchain none echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" # Materialise the pinned toolchain here rather than partway through the # build, so a toolchain problem shows up as its own failed step. "$HOME/.cargo/bin/rustup" show - uses: actions/cache@v4 with: path: | ~/.cargo/registry/index ~/.cargo/registry/cache ~/.cargo/git/db target key: ${{ github.job }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }} restore-keys: ${{ github.job }}-cargo- - name: Build # rust-toolchain.toml already lists the target, so no `rustup target add`. run: cargo build --release --locked -p quicksearch-gui --target "$TARGET" - name: Check for non-system DLL dependencies # Debian's default mingw alternative uses posix threads, which can pull # in libwinpthread-1.dll or libgcc_s_seh-1.dll and produce an .exe that # refuses to start on a clean Windows machine. The binaries are currently # clean - every import is a system DLL - and this keeps them that way. run: | for exe in "target/$TARGET"/release/quicksearch.exe "target/$TARGET"/release/quicksearch-cli.exe; do dlls=$(x86_64-w64-mingw32-objdump -p "$exe" | sed -n 's/^[[:space:]]*DLL Name: //p' | sort -fu) printf '%s:\n%s\n\n' "$exe" "$dlls" if printf '%s\n' "$dlls" | grep -qiE '^(libgcc|libwinpthread|libstdc\+\+|libssp)'; then echo "ERROR: $exe imports a non-system DLL and will not run on a clean Windows install." >&2 exit 1 fi done - name: Package the binaries run: | version=$(sed -n '/^\[workspace\.package\]/,/^\[/{ s/^version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p }' Cargo.toml) [ -n "$version" ] || { echo "could not read the version from Cargo.toml" >&2; exit 1; } stage="quicksearch-$version-windows-x86_64" mkdir -p "dist/$stage" for exe in quicksearch.exe quicksearch-cli.exe; do install -m755 "target/$TARGET/release/$exe" "dist/$stage/$exe" x86_64-w64-mingw32-strip --strip-unneeded "dist/$stage/$exe" done install -m644 README.md config_example.toml LICENSE "dist/$stage/" (cd dist && zip -qr "$stage.zip" "$stage") rm -rf "dist/$stage" ls -l dist/ - uses: actions/upload-artifact@v4 with: name: windows-x86_64 path: dist/*.zip if-no-files-found: error retention-days: 14 # -------------------------------------------------------------- release ---- # # Two ways in, one path out: # push a Release* branch -> the tag is derived from the workspace version # push a v* tag by hand -> that tag is used as-is # # Either way this runs only after linux and windows-cross are green, so a # failing test cannot produce a release. # # The tag is created by the same API call that creates the release. Creating it # in an earlier step would not work: a tag pushed with CI's own token does not # re-trigger workflows, so a design that tagged first and waited for the tag # event would stall with no release and no error. release: needs: [linux, windows-cross] if: >- startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/Release') || startsWith(github.ref, 'refs/heads/release') runs-on: self-hosted container: image: catthehacker/ubuntu:act-24.04 steps: # Only needed to read the workspace version on a Release* branch push. - uses: actions/checkout@v4 - uses: actions/download-artifact@v4 with: path: artifacts - name: Publish the release # Forgejo populates GITHUB_API_URL, GITHUB_REPOSITORY and the token by # itself, so this needs no configuration. Talking to the API directly # keeps the release step off any third-party action's release cadence. env: RELEASE_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | api="${GITHUB_API_URL:-$GITHUB_SERVER_URL/api/v1}" auth="Authorization: token $RELEASE_TOKEN" repo="$GITHUB_REPOSITORY" # One source of truth for the version: the same [workspace.package] # field build-deb.sh reads and the artifact names already carry. The # branch name only signals intent - nothing is parsed out of it. case "$GITHUB_REF" in refs/tags/*) tag="${GITHUB_REF#refs/tags/}" ;; *) version=$(sed -n '/^\[workspace\.package\]/,/^\[/{ s/^version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p }' Cargo.toml) [ -n "$version" ] || { echo "could not read the version from Cargo.toml" >&2; exit 1; } tag="v$version" ;; esac echo "release tag: $tag commit: $GITHUB_SHA" # A published version is immutable. If the tag already exists at some # other commit, stop rather than ship two different builds under one # version - the usual cause is forgetting to bump Cargo.toml. at=$(curl -sS -H "$auth" "$api/repos/$repo/tags/$tag" | jq -r '.commit.sha // empty') if [ -n "$at" ] && [ "$at" != "$GITHUB_SHA" ]; then echo "ERROR: tag $tag already exists at $at, not $GITHUB_SHA." >&2 echo "Bump [workspace.package] version in Cargo.toml, refresh Cargo.lock" >&2 echo "with 'cargo update -w', commit and push again." >&2 exit 1 fi mkdir -p dist find artifacts -type f -exec mv -t dist -- {} + ls -l dist/ # Creating a release whose tag_name does not exist yet makes Forgejo # create the tag at target_commitish, so this one call both tags and # publishes. Reuse an existing release so a re-run replaces assets # instead of failing. id=$(curl -sS -H "$auth" "$api/repos/$repo/releases/tags/$tag" | jq -r '.id // empty') if [ -z "$id" ]; then id=$(curl -fsS -X POST "$api/repos/$repo/releases" \ -H "$auth" -H 'Content-Type: application/json' \ -d "$(jq -n --arg t "$tag" --arg c "$GITHUB_SHA" \ '{tag_name: $t, target_commitish: $c, name: $t, draft: false, prerelease: false}')" \ | jq -r '.id // empty') fi [ -n "$id" ] || { echo "could not create or find a release for $tag" >&2; exit 1; } for f in dist/*; do name=$(basename "$f") echo "uploading $name" # Replace an asset of the same name left by an earlier run. old=$(curl -sS -H "$auth" "$api/repos/$repo/releases/$id/assets" \ | jq -r --arg n "$name" '.[] | select(.name == $n) | .id') [ -z "$old" ] || curl -fsS -X DELETE -H "$auth" \ "$api/repos/$repo/releases/$id/assets/$old" curl -fsS -X POST "$api/repos/$repo/releases/$id/assets?name=$name" \ -H "$auth" -F "attachment=@$f" -o /dev/null done echo "published $tag"