mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-29 10:42:03 +01:00
aiongg
7d9abd95af
A source replacement, a patch or a path override in either cargo config never shows up in Cargo.lock, so the check refuses them. Both files are parsed as TOML, as Cargo reads them.
84 lines
3.4 KiB
YAML
84 lines
3.4 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [release]
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version override for a test run, e.g. 0.2.0-rc.1 (empty: Cargo.toml)"
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
git-sources:
|
|
name: Git dependencies come from storytold
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Git dependencies come from storytold
|
|
run: |
|
|
set -euo pipefail
|
|
test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
|
|
# Source replacement, patches and path overrides in cargo config never show up
|
|
# in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
|
|
# Cargo still reads the legacy .cargo/config.
|
|
python3 - <<'PY'
|
|
import os, sys, tomllib
|
|
for path in (".cargo/config", ".cargo/config.toml"):
|
|
if not os.path.exists(path):
|
|
continue
|
|
config = tomllib.load(open(path, "rb"))
|
|
replaced = [name for name, source in config.get("source", {}).items()
|
|
if isinstance(source, dict) and "replace-with" in source]
|
|
if replaced or "patch" in config or "paths" in config:
|
|
print(f"{path} replaces, patches or overrides a source")
|
|
sys.exit(1)
|
|
PY
|
|
# Fails when Cargo.lock is out of date with the manifests.
|
|
cargo metadata --locked --format-version 1 > /dev/null
|
|
python3 - <<'PY'
|
|
import sys, tomllib
|
|
lock = tomllib.load(open("Cargo.lock", "rb"))
|
|
bad = sorted({p["source"] for p in lock.get("package", [])
|
|
if p.get("source", "").startswith("git+")
|
|
and not p["source"].startswith("git+https://github.com/storytold/")})
|
|
if bad:
|
|
print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
|
|
sys.exit(1)
|
|
PY
|
|
|
|
release:
|
|
needs: git-sources
|
|
# Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
|
|
uses: storytold/craft-common-actions/.github/workflows/release.yml@main
|
|
with:
|
|
app-name: photocraft
|
|
app-title: PhotoCraft
|
|
craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
|
|
version: ${{ inputs.version }}
|
|
secrets:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
|
|
WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
|
|
AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
|
|
AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
|