Resharing hardening #65
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Dilithium Release Tag & Publish | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_TERM_COLOR: always | |
| on: | |
| pull_request: | |
| types: [closed] | |
| branches: | |
| - master | |
| # Default to read-only; jobs that need to push tags or create releases | |
| # override this with explicit `contents: write` (see create-tag, create-github-release). | |
| permissions: | |
| contents: read | |
| jobs: | |
| create-tag: | |
| name: Create Dilithium Tag | |
| if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'dilithium-release-proposal') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| version: ${{ steps.extract_version.outputs.version }} | |
| is_draft: ${{ steps.extract_version.outputs.is_draft }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Extract version from PR title | |
| id: extract_version | |
| run: | | |
| # Extract version from PR title (format: "ci: Automate dilithium version bump to dilithium-vX.Y.Z") | |
| VERSION=$(echo "${{ github.event.pull_request.title }}" | grep -o 'dilithium-v[0-9]\+\.[0-9]\+\.[0-9]\+') | |
| if [ -z "$VERSION" ]; then | |
| echo "Error: Could not extract dilithium version from PR title: ${{ github.event.pull_request.title }}" | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| # Check if this is a draft release | |
| if [[ "${{ contains(github.event.pull_request.labels.*.name, 'draft-release') }}" == "true" ]]; then | |
| echo "is_draft=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_draft=false" >> $GITHUB_OUTPUT | |
| fi | |
| echo "Extracted dilithium version: $VERSION" | |
| - name: Create and push tag | |
| run: | | |
| git config user.name "${{ github.actor }}" | |
| git config user.email "${{ github.actor }}@users.noreply.github.com" | |
| git tag -a "${{ steps.extract_version.outputs.version }}" -m "Dilithium Release ${{ steps.extract_version.outputs.version }}" | |
| git push origin "${{ steps.extract_version.outputs.version }}" | |
| format-checks: | |
| name: 🏁 Format Checks | |
| needs: create-tag | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code at tag | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.create-tag.outputs.version }} | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: | | |
| rustup toolchain install | |
| rustup component add rustfmt --toolchain nightly | |
| - name: Install taplo | |
| run: cargo install taplo-cli --locked | |
| - name: Run format checks | |
| run: | | |
| taplo format --check --config taplo.toml | |
| cargo +nightly fmt --all -- --check | |
| build-and-test: | |
| name: 🛠️ Build & Test Dilithium | |
| needs: [create-tag, format-checks] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code at tag | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.create-tag.outputs.version }} | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: | | |
| rustup toolchain install | |
| rustup component add clippy rust-src | |
| - name: Cache cargo registry | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Build workspace (for dilithium dependencies) | |
| run: cargo build --workspace --locked | |
| - name: Test dilithium | |
| run: | | |
| cd dilithium | |
| cargo test --locked | |
| - name: Run clippy on dilithium | |
| run: | | |
| cd dilithium | |
| cargo clippy --all-targets --all-features --locked -- -D warnings | |
| - name: Generate dilithium documentation | |
| run: | | |
| cd dilithium | |
| cargo doc --locked --no-deps --all-features | |
| - name: Check dilithium documentation | |
| run: | | |
| cd dilithium | |
| cargo doc --locked --no-deps --all-features --document-private-items | |
| security-audit: | |
| name: 🔒 Security Audit | |
| needs: [create-tag, format-checks] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code at tag | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.create-tag.outputs.version }} | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Run security audit | |
| run: cargo audit | |
| create-github-release: | |
| name: 🚀 Create Dilithium GitHub Release | |
| needs: [create-tag, build-and-test, security-audit] | |
| if: always() && needs.build-and-test.result == 'success' && needs.security-audit.result == 'success' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.create-tag.outputs.version }} | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| # Required before `cargo publish` below: rustup does not auto-install the | |
| # active toolchain anymore, so we must install the version pinned in | |
| # `rust-toolchain` explicitly. Idempotent if already present. | |
| - name: Install Rust toolchain (from rust-toolchain file) | |
| run: rustup toolchain install | |
| - name: Create GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.ADMIN_PAT }} | |
| NEW_VERSION: ${{ needs.create-tag.outputs.version }} | |
| run: | | |
| release_notes="Automated dilithium release for version $NEW_VERSION." | |
| printf "%s" "$release_notes" > release_notes.txt | |
| # Add draft flag if this is a draft release | |
| if [[ "${{ needs.create-tag.outputs.is_draft }}" == "true" ]]; then | |
| DRAFT_FLAG="--draft" | |
| else | |
| DRAFT_FLAG="" | |
| fi | |
| echo "Creating dilithium release with DRAFT_FLAG: $DRAFT_FLAG" | |
| gh release create "$NEW_VERSION" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --title "Quantus qp-rusty-crystals-dilithium - $NEW_VERSION" \ | |
| --notes-file release_notes.txt \ | |
| --target master \ | |
| $DRAFT_FLAG | |
| - name: Publish dilithium to crates.io | |
| run: | | |
| cd dilithium | |
| cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} --allow-dirty | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} |