-
-
Notifications
You must be signed in to change notification settings - Fork 4
128 lines (108 loc) · 3.99 KB
/
build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Build
on:
push:
branches: ["main"]
pull_request:
branches: ["main"]
workflow_call:
inputs:
disable-cache:
type: boolean
default: false
permissions:
contents: read
jobs:
build:
permissions:
id-token: write
attestations: write
strategy:
matrix:
target:
- aarch64-apple-darwin
- x86_64-apple-darwin
- aarch64-pc-windows-msvc
- x86_64-pc-windows-msvc
include:
- target: aarch64-apple-darwin
runner: macos-14
- target: x86_64-apple-darwin
runner: macos-latest
- target: aarch64-pc-windows-msvc
runner: windows-latest
- target: x86_64-pc-windows-msvc
runner: windows-latest
fail-fast: false
runs-on: ${{ matrix.runner }}
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
with:
persist-credentials: false
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # ratchet:dtolnay/rust-toolchain@stable
with:
toolchain: stable
target: ${{ matrix.target }}
- name: Setup Rust cache
uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # ratchet:Swatinem/rust-cache@v2
if: ${{ inputs.disable-cache != true }}
- name: Install cargo-auditable
uses: taiki-e/install-action@575f713d0233afba556737a7b85080563be14186 # ratchet:taiki-e/install-action@v2
with:
tool: cargo-auditable
- name: Build
run: cargo auditable build --release --locked --target ${{ matrix.target }}
env:
CARGO_PROFILE_RELEASE_LTO: "fat"
CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
- name: Generate build provenance attestations
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # ratchet:actions/attest-build-provenance@v2
if: ${{ github.event_name != 'pull_request' }}
with:
subject-path: |
./target/${{ matrix.target }}/release/nrr
./target/${{ matrix.target }}/release/nrr.exe
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
with:
if-no-files-found: "error"
name: nrr-${{ matrix.target }}
path: |
./target/${{ matrix.target }}/release/nrr
./target/${{ matrix.target }}/release/nrr.exe
linux-static:
permissions:
id-token: write
attestations: write
strategy:
matrix:
target:
- "x86_64-unknown-linux-musl"
- "aarch64-unknown-linux-musl"
include:
- target: "x86_64-unknown-linux-musl"
runner: ubuntu-24.04
- target: "aarch64-unknown-linux-musl"
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
with:
persist-credentials: false
- name: Install Nix
uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # ratchet:cachix/install-nix-action@v31
- name: Build
run: nix build --print-build-logs '.#nrr-static-${{ matrix.target }}'
- name: Generate build provenance attestations
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # ratchet:actions/attest-build-provenance@v2
if: ${{ github.event_name != 'pull_request' }}
with:
subject-path: ./result/bin/nrr
- name: Upload artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
with:
if-no-files-found: "error"
name: nrr-${{ matrix.target }}
path: ./result/bin/nrr