codaro/.github/workflows/launcher-release.yml at main · eddmpython/codaro · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Launcher Release

on:
  push:
    tags:
      - "v*-launcher"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to create, for example v0.1.0-launcher"
        required: true
        type: string

permissions:
  contents: write

jobs:
  build:
    runs-on: windows-latest
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Build release
        working-directory: launcher/codaro-launcher
        run: cargo build --release

      - name: Compute SHA256
        shell: pwsh
        run: |
          $hash = (Get-FileHash "launcher/target/release/codaro-launcher.exe" -Algorithm SHA256).Hash.ToLower()
          "$hash  Codaro.exe" | Out-File -FilePath "launcher/target/release/Codaro.exe.sha256" -Encoding utf8

      - name: Rename binary
        shell: pwsh
        run: |
          Copy-Item "launcher/target/release/codaro-launcher.exe" "launcher/target/release/Codaro.exe"

      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@v0
        with:
          path: launcher/codaro-launcher
          format: spdx-json
          output-file: launcher/target/release/Codaro.spdx.json

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          target_commitish: ${{ github.sha }}
          name: Codaro Launcher ${{ env.RELEASE_TAG }}
          fail_on_unmatched_files: true
          body: |
            Download `Codaro.exe`, verify `Codaro.exe.sha256`, then run the launcher.

            This launcher-only release is for manual binary verification. Product releases are created from normal `vX.Y.Z` tags and include `release-manifest.json`, managed Python runtime assets, and the exact backend wheel asset.

            The release also includes `Codaro.spdx.json` for dependency transparency.
          files: |
            launcher/target/release/Codaro.exe
            launcher/target/release/Codaro.exe.sha256
            launcher/target/release/Codaro.spdx.json
          generate_release_notes: true
          prerelease: true
          make_latest: false