|
1
|
name: Release SDK Rust (crates.io) |
|
2
|
|
|
3
|
on: |
|
4
|
push: |
|
5
|
tags: |
|
6
|
- "[0-9]+.[0-9]+.[0-9]+" |
|
7
|
workflow_dispatch: |
|
8
|
|
|
9
|
permissions: |
|
10
|
contents: read |
|
11
|
|
|
12
|
jobs: |
|
13
|
# Cheap ubuntu gate: version agreement, crates.io publishability, tag match. |
|
14
|
# Blocks the expensive job below so a metadata fault never costs runner time. |
|
15
|
preflight: |
|
16
|
uses: ./.github/workflows/release-preflight.yml |
|
17
|
with: |
|
18
|
tag: ${{ github.ref_type == 'tag' && github.ref_name || '' }} |
|
19
|
|
|
20
|
publish: |
|
21
|
needs: preflight |
|
22
|
name: cargo publish |
|
23
|
runs-on: macos-26 |
|
24
|
|
|
25
|
env: |
|
26
|
GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }} |
|
27
|
GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }} |
|
28
|
GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }} |
|
29
|
GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }} |
|
30
|
HF_TOKEN: ${{ secrets.HF_TOKEN }} |
|
31
|
|
|
32
|
steps: |
|
33
|
- name: Checkout |
|
34
|
uses: actions/checkout@v6 |
|
35
|
|
|
36
|
- name: Read Rust toolchain |
|
37
|
run: | |
|
38
|
rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)" |
|
39
|
if [ -z "$rust_toolchain" ]; then |
|
40
|
echo "::error::Failed to read channel from rust-toolchain.toml" |
|
41
|
exit 1 |
|
42
|
fi |
|
43
|
echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV" |
|
44
|
|
|
45
|
- name: Install stable Rust toolchain |
|
46
|
uses: dtolnay/rust-toolchain@stable |
|
47
|
with: |
|
48
|
toolchain: ${{ env.RUST_TOOLCHAIN }} |
|
49
|
|
|
50
|
# Skip a version already on crates.io instead of hard-failing. crates.io is |
|
51
|
# immutable, so a re-run of a partially-failed release would otherwise die |
|
52
|
# here on "already uploaded" — the npm workflow has had this guard all along. |
|
53
|
- name: Check whether this version is already published |
|
54
|
id: published |
|
55
|
run: | |
|
56
|
VERSION="$(python3 scripts/sync-release-version.py --print)" |
|
57
|
if cargo info "onde@${VERSION}" >/dev/null 2>&1; then |
|
58
|
echo "onde ${VERSION} is already on crates.io — skipping publish." |
|
59
|
echo "skip=true" >> "$GITHUB_OUTPUT" |
|
60
|
else |
|
61
|
echo "skip=false" >> "$GITHUB_OUTPUT" |
|
62
|
fi |
|
63
|
|
|
64
|
# --locked forbids resolving anything other than the committed Cargo.lock, |
|
65
|
# so the crate published is built from the same graph CI tested. |
|
66
|
- name: cargo publish --dry-run |
|
67
|
if: steps.published.outputs.skip != 'true' |
|
68
|
run: cargo publish --dry-run --locked |
|
69
|
|
|
70
|
- name: cargo publish |
|
71
|
if: startsWith(github.ref, 'refs/tags/') && steps.published.outputs.skip != 'true' |
|
72
|
env: |
|
73
|
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |
|
74
|
run: cargo publish --locked |