421 lines
14 KiB
YAML
421 lines
14 KiB
YAML
name: Secrets CLI - Build & Release
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'src/**'
|
||
- 'Cargo.toml'
|
||
- 'Cargo.lock'
|
||
- '.gitea/workflows/secrets.yml'
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
permissions:
|
||
contents: write
|
||
|
||
env:
|
||
BINARY_NAME: secrets
|
||
CARGO_INCREMENTAL: 0
|
||
CARGO_NET_RETRY: 10
|
||
CARGO_TERM_COLOR: always
|
||
RUST_BACKTRACE: short
|
||
|
||
jobs:
|
||
version:
|
||
name: 版本 & Release
|
||
runs-on: debian
|
||
outputs:
|
||
version: ${{ steps.ver.outputs.version }}
|
||
tag: ${{ steps.ver.outputs.tag }}
|
||
tag_exists: ${{ steps.ver.outputs.tag_exists }}
|
||
release_id: ${{ steps.release.outputs.release_id }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 0
|
||
|
||
- name: 解析版本
|
||
id: ver
|
||
run: |
|
||
version=$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
|
||
tag="secrets-${version}"
|
||
previous_tag=$(git tag --list 'secrets-*' --sort=-v:refname | grep -vx "$tag" | sed -n '1p')
|
||
|
||
echo "version=${version}" >> "$GITHUB_OUTPUT"
|
||
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
|
||
echo "previous_tag=${previous_tag}" >> "$GITHUB_OUTPUT"
|
||
|
||
if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
|
||
echo "tag_exists=true" >> "$GITHUB_OUTPUT"
|
||
echo "版本 ${tag} 已存在"
|
||
else
|
||
echo "tag_exists=false" >> "$GITHUB_OUTPUT"
|
||
echo "将创建新版本 ${tag}"
|
||
fi
|
||
|
||
- name: 创建 Tag
|
||
if: steps.ver.outputs.tag_exists == 'false'
|
||
run: |
|
||
git config user.name "github-actions[bot]"
|
||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||
git tag -a "${{ steps.ver.outputs.tag }}" -m "Release ${{ steps.ver.outputs.tag }}"
|
||
git push origin "${{ steps.ver.outputs.tag }}"
|
||
|
||
- name: 解析或创建 Release
|
||
id: release
|
||
env:
|
||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||
run: |
|
||
if [ -z "$RELEASE_TOKEN" ]; then
|
||
echo "release_id=" >> "$GITHUB_OUTPUT"
|
||
exit 0
|
||
fi
|
||
|
||
command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
|
||
|
||
tag="${{ steps.ver.outputs.tag }}"
|
||
version="${{ steps.ver.outputs.version }}"
|
||
release_api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"
|
||
existing_release=$(curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||
"${release_api}/tags/${tag}" || true)
|
||
release_id=$(printf '%s' "$existing_release" | jq -r '.id // empty')
|
||
|
||
if [ -n "$release_id" ]; then
|
||
echo "release_id=${release_id}" >> "$GITHUB_OUTPUT"
|
||
exit 0
|
||
fi
|
||
|
||
if [ "${{ steps.ver.outputs.tag_exists }}" = "true" ]; then
|
||
echo "release_id=" >> "$GITHUB_OUTPUT"
|
||
exit 0
|
||
fi
|
||
|
||
previous_tag="${{ steps.ver.outputs.previous_tag }}"
|
||
if [ -n "$previous_tag" ]; then
|
||
changes=$(git log --pretty=format:'- %s (%h)' "${previous_tag}..HEAD")
|
||
else
|
||
changes=$(git log --pretty=format:'- %s (%h)')
|
||
fi
|
||
if [ -z "$changes" ]; then
|
||
changes="- 首次发布"
|
||
fi
|
||
|
||
cat > release-body.md <<EOF
|
||
## 变更日志
|
||
|
||
${changes}
|
||
EOF
|
||
|
||
payload=$(jq -n \
|
||
--arg tag "$tag" \
|
||
--arg name "${{ env.BINARY_NAME }} ${version}" \
|
||
--rawfile body release-body.md \
|
||
'{tag_name: $tag, name: $name, body: $body}')
|
||
|
||
response=$(curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||
-H "Content-Type: application/json" \
|
||
-X POST "$release_api" \
|
||
-d "$payload")
|
||
release_id=$(printf '%s' "$response" | jq -r '.id // empty')
|
||
|
||
if [ -z "$release_id" ]; then
|
||
echo "创建 Release 失败"
|
||
exit 1
|
||
fi
|
||
|
||
echo "release_id=${release_id}" >> "$GITHUB_OUTPUT"
|
||
|
||
probe-runners:
|
||
name: 探测 Runner
|
||
runs-on: debian
|
||
outputs:
|
||
has_linux: ${{ steps.probe.outputs.has_linux }}
|
||
has_macos: ${{ steps.probe.outputs.has_macos }}
|
||
has_windows: ${{ steps.probe.outputs.has_windows }}
|
||
steps:
|
||
- name: 查询可用 Runner
|
||
id: probe
|
||
env:
|
||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||
run: |
|
||
if [ -z "$RELEASE_TOKEN" ]; then
|
||
echo "has_linux=true" >> "$GITHUB_OUTPUT"
|
||
echo "has_macos=true" >> "$GITHUB_OUTPUT"
|
||
echo "has_windows=true" >> "$GITHUB_OUTPUT"
|
||
exit 0
|
||
fi
|
||
|
||
command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
|
||
|
||
runners=$(curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runners" || true)
|
||
|
||
if [ -z "$runners" ]; then
|
||
echo "has_linux=true" >> "$GITHUB_OUTPUT"
|
||
echo "has_macos=true" >> "$GITHUB_OUTPUT"
|
||
echo "has_windows=true" >> "$GITHUB_OUTPUT"
|
||
exit 0
|
||
fi
|
||
|
||
has_runner() {
|
||
local label="$1"
|
||
printf '%s' "$runners" | jq -e --arg label "$label" '
|
||
(.runners // .data // . // [])
|
||
| any(
|
||
(
|
||
(.status // (if (.online // false) then "online" else "offline" end))
|
||
| ascii_downcase
|
||
) == "online"
|
||
and (
|
||
(.labels // [])
|
||
| map(if type == "object" then (.name // .label // "") else tostring end)
|
||
| index($label)
|
||
) != null
|
||
)
|
||
' >/dev/null
|
||
}
|
||
|
||
if has_runner "debian"; then
|
||
echo "has_linux=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "has_linux=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
if has_runner "darwin-arm64"; then
|
||
echo "has_macos=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "has_macos=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
if has_runner "windows"; then
|
||
echo "has_windows=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "has_windows=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
check:
|
||
name: 质量检查 (fmt / clippy / test)
|
||
runs-on: debian
|
||
timeout-minutes: 10
|
||
steps:
|
||
- name: 安装 Rust
|
||
run: |
|
||
if ! command -v cargo >/dev/null 2>&1; then
|
||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
||
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||
fi
|
||
source "$HOME/.cargo/env" 2>/dev/null || true
|
||
rustup component add rustfmt clippy
|
||
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: 缓存 Cargo
|
||
uses: actions/cache@v4
|
||
with:
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
target
|
||
key: cargo-check-${{ hashFiles('Cargo.lock') }}
|
||
restore-keys: |
|
||
cargo-check-
|
||
|
||
- run: cargo fmt -- --check
|
||
- run: cargo clippy --locked -- -D warnings
|
||
- run: cargo test --locked
|
||
|
||
build-linux:
|
||
name: Build (x86_64-unknown-linux-musl)
|
||
needs: [version, probe-runners, check]
|
||
if: needs.probe-runners.outputs.has_linux == 'true'
|
||
runs-on: debian
|
||
timeout-minutes: 10
|
||
continue-on-error: true
|
||
steps:
|
||
- name: 安装依赖
|
||
run: |
|
||
sudo apt-get update
|
||
sudo apt-get install -y pkg-config musl-tools binutils curl
|
||
if ! command -v cargo >/dev/null 2>&1; then
|
||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
||
fi
|
||
source "$HOME/.cargo/env" 2>/dev/null || true
|
||
rustup target add x86_64-unknown-linux-musl
|
||
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: 缓存 Cargo
|
||
uses: actions/cache@v4
|
||
with:
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
target
|
||
key: cargo-x86_64-unknown-linux-musl-${{ hashFiles('Cargo.lock') }}
|
||
restore-keys: |
|
||
cargo-x86_64-unknown-linux-musl-
|
||
|
||
- run: cargo build --release --locked --target x86_64-unknown-linux-musl
|
||
- run: strip target/x86_64-unknown-linux-musl/release/${{ env.BINARY_NAME }}
|
||
|
||
- name: 上传 Release 产物
|
||
if: needs.version.outputs.release_id != ''
|
||
env:
|
||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||
run: |
|
||
[ -z "$RELEASE_TOKEN" ] && exit 0
|
||
tag="${{ needs.version.outputs.tag }}"
|
||
bin="target/x86_64-unknown-linux-musl/release/${{ env.BINARY_NAME }}"
|
||
archive="${{ env.BINARY_NAME }}-${tag}-x86_64-linux-musl.tar.gz"
|
||
tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
|
||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||
-F "attachment=@${archive}" \
|
||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
||
|
||
build-macos:
|
||
name: Build (aarch64-apple-darwin)
|
||
needs: [version, probe-runners, check]
|
||
if: needs.probe-runners.outputs.has_macos == 'true'
|
||
runs-on: darwin-arm64
|
||
timeout-minutes: 10
|
||
continue-on-error: true
|
||
steps:
|
||
- name: 安装依赖
|
||
run: |
|
||
if ! command -v cargo >/dev/null 2>&1; then
|
||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
||
fi
|
||
source "$HOME/.cargo/env" 2>/dev/null || true
|
||
rustup target add aarch64-apple-darwin
|
||
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: 缓存 Cargo
|
||
uses: actions/cache@v4
|
||
with:
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
target
|
||
key: cargo-aarch64-apple-darwin-${{ hashFiles('Cargo.lock') }}
|
||
restore-keys: |
|
||
cargo-aarch64-apple-darwin-
|
||
|
||
- run: cargo build --release --locked --target aarch64-apple-darwin
|
||
- run: strip -x target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}
|
||
|
||
- name: 上传 Release 产物
|
||
if: needs.version.outputs.release_id != ''
|
||
env:
|
||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||
run: |
|
||
[ -z "$RELEASE_TOKEN" ] && exit 0
|
||
tag="${{ needs.version.outputs.tag }}"
|
||
bin="target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}"
|
||
archive="${{ env.BINARY_NAME }}-${tag}-aarch64-macos.tar.gz"
|
||
tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
|
||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||
-F "attachment=@${archive}" \
|
||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
||
|
||
build-windows:
|
||
name: Build (x86_64-pc-windows-msvc)
|
||
needs: [version, probe-runners, check]
|
||
if: needs.probe-runners.outputs.has_windows == 'true'
|
||
runs-on: windows
|
||
timeout-minutes: 10
|
||
continue-on-error: true
|
||
steps:
|
||
- name: 安装依赖
|
||
shell: pwsh
|
||
run: |
|
||
if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
|
||
Invoke-WebRequest -Uri "https://win.rustup.rs/x86_64" -OutFile rustup-init.exe
|
||
.\rustup-init.exe -y --default-toolchain stable
|
||
Remove-Item rustup-init.exe
|
||
}
|
||
rustup target add x86_64-pc-windows-msvc
|
||
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: 缓存 Cargo
|
||
uses: actions/cache@v4
|
||
with:
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
target
|
||
key: cargo-x86_64-pc-windows-msvc-${{ hashFiles('Cargo.lock') }}
|
||
restore-keys: |
|
||
cargo-x86_64-pc-windows-msvc-
|
||
|
||
- name: 构建
|
||
shell: pwsh
|
||
run: cargo build --release --locked --target x86_64-pc-windows-msvc
|
||
|
||
- name: 上传 Release 产物
|
||
if: needs.version.outputs.release_id != ''
|
||
shell: pwsh
|
||
env:
|
||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||
run: |
|
||
if (-not $env:RELEASE_TOKEN) { exit 0 }
|
||
$tag = "${{ needs.version.outputs.tag }}"
|
||
$bin = "target\x86_64-pc-windows-msvc\release\${{ env.BINARY_NAME }}.exe"
|
||
$archive = "${{ env.BINARY_NAME }}-${tag}-x86_64-windows.zip"
|
||
Compress-Archive -Path $bin -DestinationPath $archive -Force
|
||
$url = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
||
Invoke-RestMethod -Uri $url -Method Post `
|
||
-Headers @{ "Authorization" = "token $env:RELEASE_TOKEN" } `
|
||
-Form @{ attachment = Get-Item $archive }
|
||
|
||
notify:
|
||
name: 通知
|
||
needs: [version, probe-runners]
|
||
if: always() && github.event_name == 'push'
|
||
runs-on: debian
|
||
timeout-minutes: 1
|
||
continue-on-error: true
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: 发送飞书通知
|
||
env:
|
||
WEBHOOK_URL: ${{ vars.WEBHOOK_URL }}
|
||
run: |
|
||
[ -z "$WEBHOOK_URL" ] && exit 0
|
||
command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
|
||
|
||
tag="${{ needs.version.outputs.tag }}"
|
||
tag_exists="${{ needs.version.outputs.tag_exists }}"
|
||
commit=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "N/A")
|
||
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
||
|
||
msg="${{ env.BINARY_NAME }} 通知"
|
||
if [ "$tag_exists" = "false" ]; then
|
||
msg="${msg}
|
||
🆕 已创建版本标签并开始构建发布"
|
||
else
|
||
msg="${msg}
|
||
🔄 检测到已有版本标签，已开始重复构建"
|
||
fi
|
||
|
||
msg="${msg}
|
||
Runner 可用性：linux=${{ needs.probe-runners.outputs.has_linux }}, macOS=${{ needs.probe-runners.outputs.has_macos }}, windows=${{ needs.probe-runners.outputs.has_windows }}
|
||
提交：${commit}
|
||
版本：${tag}
|
||
作者：${{ github.actor }}
|
||
详情：${url}"
|
||
|
||
payload=$(jq -n --arg text "$msg" '{msg_type: "text", content: {text: $text}}')
|
||
curl -fsS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
|