fix(gui): keep permissions.rs super-import macOS-gated #253
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release PR | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [master] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: 0 | |
| jobs: | |
| # Opens/updates a release PR that bumps the shared workspace version and writes | |
| # changelogs from the conventional commits since the last release. Merging that | |
| # PR is what triggers the actual release in the job below. | |
| release-pr: | |
| name: release-plz PR | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: release-plz-pr-${{ github.ref }} | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install Linux build deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libudev-dev pkg-config gcc g++ clang libssl-dev libzstd-dev | |
| # GitHub App token (not a PAT) so the release PR / tag trigger CI and the | |
| # DMG release workflow — the default GITHUB_TOKEN cannot trigger workflows. | |
| # App credentials come from the same 1Password item as release.yml. | |
| - name: Mint GitHub App token | |
| id: app-token | |
| uses: ./.github/actions/github-app-token-from-1password | |
| with: | |
| op-service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | |
| op-github-app-item: ${{ secrets.OP_GITHUB_APP_ITEM }} | |
| - name: Run release-plz (release-pr) | |
| id: release_pr | |
| uses: release-plz/action@v0.5 | |
| with: | |
| command: release-pr | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| CARGO_REGISTRY_TOKEN: ${{ steps.app-token.outputs.cargo-registry-token }} | |
| # `release-plz/action` swallows a release-pr HTTP 422 as a warning and | |
| # reports no PR, which silently stalls releases (it looks identical to a | |
| # quiet week of commits). Fail loudly when release-plz opened/updated no | |
| # release PR, none is already open, yet release-worthy commits exist since | |
| # the last tag — that combination means a swallowed failure, not a no-op. | |
| # (The blanket 422-swallow is an acknowledged action hack: release-plz/action#264 | |
| # added it to fix that action's own CI; #427 aims to remove it. Once #427 | |
| # lands and we pin an action release that includes it, this guard can go.) | |
| - name: Guard against a silently stalled release | |
| if: steps.release_pr.outputs.prs_created == 'false' | |
| uses: actions/github-script@v8 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const { readFileSync } = require("node:fs"); | |
| const { owner, repo } = context.repo; | |
| // An already-open release PR is the normal "updated, not created" path. | |
| const openPulls = await github.paginate(github.rest.pulls.list, { | |
| owner, | |
| repo, | |
| state: "open", | |
| per_page: 100, | |
| }); | |
| if (openPulls.some((pull) => pull.head.ref.startsWith("release-plz/"))) { | |
| core.info("A release PR is already open — nothing to flag."); | |
| return; | |
| } | |
| const tags = await github.paginate(github.rest.repos.listTags, { | |
| owner, | |
| repo, | |
| per_page: 100, | |
| }); | |
| const lastTag = tags | |
| .map((tag) => tag.name) | |
| .filter((tag) => /^v\d+\.\d+\.\d+/.test(tag)) | |
| .sort((left, right) => right.localeCompare(left, undefined, { numeric: true, sensitivity: "base" }))[0] ?? ""; | |
| // The release job runs in parallel and cuts the `v{version}` tag only | |
| // after publishing, so that tag is usually absent from this job's | |
| // checkout — never trust the local tag list to decide "did a release | |
| // just happen". Read the manifest instead: merging a release PR bumps | |
| // the workspace version, so a manifest version ahead of the last tag | |
| // means the release already landed (the parallel job is tagging it), | |
| // not a stall. Only when the manifest still sits at the last released | |
| // tag can leftover release-worthy commits mean a swallowed release-pr. | |
| const manifestVersion = readFileSync("Cargo.toml", "utf8") | |
| .match(/\[workspace\.package\][\s\S]*?^version\s*=\s*"([^"]+)"/m)?.[1] ?? ""; | |
| if (lastTag && manifestVersion && `v${manifestVersion}` !== lastTag) { | |
| core.info(`Workspace version ${manifestVersion} is ahead of ${lastTag} — a release PR already merged; the release job cuts the tag. Nothing to flag.`); | |
| return; | |
| } | |
| const commits = lastTag | |
| ? (await github.rest.repos.compareCommitsWithBasehead({ | |
| owner, | |
| repo, | |
| basehead: `${lastTag}...${context.sha}`, | |
| })).data.commits | |
| : await github.paginate(github.rest.repos.listCommits, { | |
| owner, | |
| repo, | |
| sha: context.sha, | |
| per_page: 100, | |
| }); | |
| const worthy = commits.filter(({ commit }) => /^(feat|fix|perf)(\(.+\))?!?:|^[a-z]+(\(.+\))?!:/.test(commit.message.split("\n")[0])).length; | |
| if (worthy !== 0) { | |
| core.setFailed(`release-plz opened no release PR, but ${worthy} release-worthy commit(s) exist since ${lastTag || "repo start"} and none is open — likely a swallowed release-plz failure (see the release-pr step).`); | |
| return; | |
| } | |
| core.info(`No release PR and no release-worthy commits since ${lastTag || "repo start"}; nothing to release.`); | |
| # On every push to master, publishes any crate whose manifest version is not yet | |
| # on crates.io — i.e. a no-op until the release PR is merged, at which point it | |
| # publishes the whole workspace and cuts one `v{version}` tag + GitHub Release. | |
| release: | |
| name: release-plz release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install Linux build deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libudev-dev pkg-config gcc g++ clang libssl-dev libzstd-dev | |
| - name: Mint GitHub App token | |
| id: app-token | |
| uses: ./.github/actions/github-app-token-from-1password | |
| with: | |
| op-service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | |
| op-github-app-item: ${{ secrets.OP_GITHUB_APP_ITEM }} | |
| - name: Run release-plz (release) | |
| uses: release-plz/action@v0.5 | |
| with: | |
| command: release | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| CARGO_REGISTRY_TOKEN: ${{ steps.app-token.outputs.cargo-registry-token }} |