From 89f9d46fa1483d713ec054dc5f9f73456ddc97eb Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 14:05:26 +0530 Subject: [PATCH 1/6] feat: onboarding upload-rust-binary-action --- .cspell.json | 52 ++ .editorconfig | 24 + .git-blame-ignore-revs | 2 + .gitattributes | 3 + .github/.cspell/project-dictionary.txt | 3 + .github/.cspell/rust-dependencies.txt | 2 + .github/dependabot.yml | 11 + .github/workflows/actions_release.yml | 22 + .github/workflows/audit_package.yml | 28 + .github/workflows/auto_cherry_pick.yml | 37 ++ .github/workflows/ci.yml | 156 +++++ .github/workflows/release.yml | 31 + .github/zizmor.yml | 6 + .gitignore | 4 + .markdownlint-cli2.yaml | 11 + .shellcheckrc | 38 ++ CHANGELOG.md | 288 +++++++++ LICENSE | 21 + LICENSE-APACHE | 177 ++++++ LICENSE-MIT | 23 + README.md | 775 ++++++++++++++++++++++++- SECURITY.md | 5 + action.yml | 207 +++++++ main.sh | 640 ++++++++++++++++++++ tools/.tidy-check-license-headers | 1 + tools/tidy.sh | 143 +++++ 26 files changed, 2709 insertions(+), 1 deletion(-) create mode 100644 .cspell.json create mode 100644 .editorconfig create mode 100644 .git-blame-ignore-revs create mode 100644 .gitattributes create mode 100644 .github/.cspell/project-dictionary.txt create mode 100644 .github/.cspell/rust-dependencies.txt create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/actions_release.yml create mode 100644 .github/workflows/audit_package.yml create mode 100644 .github/workflows/auto_cherry_pick.yml create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/release.yml create mode 100644 .github/zizmor.yml create mode 100644 .gitignore create mode 100644 .markdownlint-cli2.yaml create mode 100644 .shellcheckrc create mode 100644 CHANGELOG.md create mode 100644 LICENSE create mode 100644 LICENSE-APACHE create mode 100644 LICENSE-MIT create mode 100644 SECURITY.md create mode 100644 action.yml create mode 100755 main.sh create mode 100644 tools/.tidy-check-license-headers create mode 100755 tools/tidy.sh diff --git a/.cspell.json b/.cspell.json new file mode 100644 index 0000000..860713a --- /dev/null +++ b/.cspell.json @@ -0,0 +1,52 @@ +{ + "version": "0.2", + "gitignoreRoot": ".", + "useGitignore": true, + "dictionaryDefinitions": [ + { + "name": "organization-dictionary", + "path": "https://raw.githubusercontent.com/taiki-e/github-actions/HEAD/.github/.cspell/organization-dictionary.txt", + "addWords": true + }, + { + "name": "project-dictionary", + "path": "./.github/.cspell/project-dictionary.txt", + "addWords": true + }, + { + "name": "rust-dependencies", + "path": "./.github/.cspell/rust-dependencies.txt", + "addWords": true + } + ], + "dictionaries": [ + "organization-dictionary", + "project-dictionary", + "rust-dependencies" + ], + "ignoreRegExpList": [ + // Copyright notice + "Copyright .*", + "SPDX-(File|Snippet)CopyrightText: .*", + // GHA actions/workflows + "uses: .+@[\\w_.-]+", + // GHA context (repo name, owner name, etc.) + "github.[\\w_.-]+ (=|!)= '[^']+'", + // GH username + "( |\\[)@[\\w_-]+", + // Git config username + "git config( --[^ ]+)? user.name .*", + // Username in TODO|FIXME comment + "(TODO|FIXME)\\([\\w_., -]+\\)", + // Cargo.toml authors + "authors *= *\\[[^\\]]*\\]", + "\"[^\"]* <[\\w_.+-]+@[\\w.-]+>\"" + ], + "languageSettings": [ + { + "languageId": ["*"], + "dictionaries": ["bash", "cpp-refined", "rust"] + } + ], + "ignorePaths": [] +} diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..17aaa0c --- /dev/null +++ b/.editorconfig @@ -0,0 +1,24 @@ +# EditorConfig configuration +# https://editorconfig.org + +root = true + +[*] +charset = utf-8 +end_of_line = lf +indent_size = 4 +indent_style = space +insert_final_newline = true +trim_trailing_whitespace = true + +[*.{css,html,json,md,rb,ps1,sh,yml,yaml}] +indent_size = 2 + +[*.{js,yml,yaml}] +quote_type = single + +[*.sh] +# https://google.github.io/styleguide/shellguide.html#s5.3-pipelines +binary_next_line = true +# https://google.github.io/styleguide/shellguide.html#s5.5-case-statement +switch_case_indent = true diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs new file mode 100644 index 0000000..2c42b40 --- /dev/null +++ b/.git-blame-ignore-revs @@ -0,0 +1,2 @@ +# Change indent size of shell script files to match scripts in CI config +fed5c724a578d2b6d7a663e60b5e6012dac3a7e5 diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..36b9413 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,3 @@ +* text=auto eol=lf +tools/tidy.sh linguist-detectable=false +.github/.cspell/rust-dependencies.txt linguist-generated diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt new file mode 100644 index 0000000..3cfb7d5 --- /dev/null +++ b/.github/.cspell/project-dictionary.txt @@ -0,0 +1,3 @@ +codesign +coreutils +lipo diff --git a/.github/.cspell/rust-dependencies.txt b/.github/.cspell/rust-dependencies.txt new file mode 100644 index 0000000..a500d2c --- /dev/null +++ b/.github/.cspell/rust-dependencies.txt @@ -0,0 +1,2 @@ +# This file is @generated by tidy.sh. +# It is not intended for manual editing. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..1e56873 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + cooldown: + default-days: 14 + commit-message: + prefix: '' + labels: [] diff --git a/.github/workflows/actions_release.yml b/.github/workflows/actions_release.yml new file mode 100644 index 0000000..8e484ee --- /dev/null +++ b/.github/workflows/actions_release.yml @@ -0,0 +1,22 @@ +name: Release GitHub Actions + +on: + workflow_dispatch: + inputs: + tag: + description: "Tag for the release" + required: true + +permissions: + contents: read + +jobs: + release: + permissions: + actions: read + id-token: write + contents: write + + uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1 + with: + tag: "${{ github.event.inputs.tag }}" diff --git a/.github/workflows/audit_package.yml b/.github/workflows/audit_package.yml new file mode 100644 index 0000000..2cc740e --- /dev/null +++ b/.github/workflows/audit_package.yml @@ -0,0 +1,28 @@ +name: NPM Audit Fix Run + +on: + workflow_dispatch: + inputs: + force: + description: "Use --force flag for npm audit fix?" + required: true + type: boolean + base_branch: + description: "Specify a base branch" + required: false + default: "main" + schedule: + - cron: "0 0 * * 1" + +jobs: + audit-fix: + uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1 + with: + force: ${{ inputs.force || false }} + base_branch: ${{ inputs.base_branch || 'main' }} + +permissions: + contents: write + pull-requests: write + packages: read + issues: write diff --git a/.github/workflows/auto_cherry_pick.yml b/.github/workflows/auto_cherry_pick.yml new file mode 100644 index 0000000..3845638 --- /dev/null +++ b/.github/workflows/auto_cherry_pick.yml @@ -0,0 +1,37 @@ +name: Auto Cherry-Pick from Upstream + +on: + workflow_run: + workflows: [ "Release GitHub Actions" ] + types: + - completed + + workflow_dispatch: + inputs: + base_branch: + description: "Base branch to create the PR against" + required: true + default: "main" + mode: + description: "Run mode: cherry-pick or verify" + required: false + default: "cherry-pick" + + pull_request: + types: [ opened, synchronize, labeled ] + +permissions: + contents: write + pull-requests: write + packages: read + issues: write + +jobs: + cherry-pick: + if: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required') + uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1 + with: + original-owner: "taiki-e" + repo-name: "upload-rust-binary-action" + base_branch: ${{ inputs.base_branch || 'main' }} + mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode || 'cherry-pick' }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..456cdb2 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,156 @@ +name: CI + +permissions: {} + +on: + pull_request: + push: + branches: + - main + - dev + schedule: + - cron: '0 2 * * *' + workflow_dispatch: + +env: + CARGO_INCREMENTAL: 0 + CARGO_NET_GIT_FETCH_WITH_CLI: true + CARGO_NET_RETRY: 10 + CARGO_TERM_COLOR: always + RUST_BACKTRACE: 1 + RUSTFLAGS: -D warnings + RUSTUP_MAX_RETRIES: 10 + +defaults: + run: + shell: bash --noprofile --norc -CeEuxo pipefail {0} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: true + +jobs: + tidy: + uses: taiki-e/github-actions/.github/workflows/tidy.yml@e6a1170cbd07eb898017958967912976fce18f2d # 2026.7.3 + permissions: + security-events: write # for github/codeql-action/* + + # TODO: test container + test: + needs: tidy + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-24.04 + - os: ubuntu-24.04-arm + - os: ubuntu-24.04 + target: aarch64-unknown-linux-gnu + package: test-crate + - os: ubuntu-24.04 + target: aarch64-unknown-linux-gnu + build-tool: cargo + package: test-crate,test-crate + - os: ubuntu-24.04 + target: x86_64-unknown-linux-gnu.2.17 + build-tool: cargo-zigbuild + - os: macos-latest + checksums: sha256,sha512,sha1,md5 + - os: macos-latest + checksums: | + sha256 + sha512 + sha1 + md5 + target: x86_64-apple-darwin + workspace: true + - os: macos-latest + checksums: sha256 sha512 sha1 md5 + target: aarch64-apple-darwin + - os: macos-latest + checksums: sha256, sha512, sha1, md5 + target: universal-apple-darwin + - os: macos-latest + checksums: sha256,sha512,sha1,md5 + target: universal-apple-darwin + build-tool: cargo + - os: windows-latest + - os: windows-latest + target: x86_64-pc-windows-gnu + - os: windows-latest + target: aarch64-pc-windows-msvc + - os: windows-11-arm + runs-on: ${{ matrix.os || 'ubuntu-24.04' }} + timeout-minutes: 60 + steps: + - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2 + - uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4 + with: + tool: rust@stable + fallback: none + - uses: taiki-e/setup-cross-toolchain-action@3d9770ce98eb7dbcf378563182a5e8031165f75b # v1.41.0 + with: + target: ${{ matrix.target }} + runner: none + if: matrix.target != '' && matrix.build-tool == 'cargo' + - run: cargo new --bin test-crate + - uses: ./ + id: upload-rust-binary-action + with: + dry-run: true + bin: test-crate + target: ${{ matrix.target }} + build-tool: ${{ matrix.build-tool }} + no-default-features: true + all-features: true + package: ${{ matrix.package }} + workspace: ${{ matrix.workspace || 'false' }} + checksum: ${{ matrix.checksums || 'b2,sha256,sha512,sha1,md5' }} + tar: all + tar-xz: all + zip: all + manifest-path: test-crate/Cargo.toml + codesign: '-' + codesign-prefix: 'com.example.' + codesign-options: 'runtime' + - name: Check action outputs + run: | + printf 'outputs.archive should not be empty\n' + test -n "${OUTPUT_ARCHIVE}" + + printf 'outputs.zip should be a file\n' + test -f "${OUTPUT_ZIP}" + + printf 'outputs.tar should be a file\n' + test -f "${OUTPUT_TAR}" + + printf 'outputs.tar-xz should be a file\n' + test -f "${OUTPUT_TAR_XZ}" + + printf 'outputs.sha256 should be a file\n' + test -f "${OUTPUT_SHA256}" + + printf 'outputs.sha512 should be a file\n' + test -f "${OUTPUT_SHA512}" + + printf 'outputs.sha1 should be a file\n' + test -f "${OUTPUT_SHA1}" + + printf 'outputs.md5 should be a file\n' + test -f "${OUTPUT_MD5}" + env: + OUTPUT_ARCHIVE: ${{ steps.upload-rust-binary-action.outputs.archive }} + OUTPUT_ZIP: ${{ steps.upload-rust-binary-action.outputs.zip }} + OUTPUT_TAR: ${{ steps.upload-rust-binary-action.outputs.tar }} + OUTPUT_TAR_XZ: ${{ steps.upload-rust-binary-action.outputs.tar-xz }} + OUTPUT_SHA256: ${{ steps.upload-rust-binary-action.outputs.sha256 }} + OUTPUT_SHA512: ${{ steps.upload-rust-binary-action.outputs.sha512 }} + OUTPUT_SHA1: ${{ steps.upload-rust-binary-action.outputs.sha1 }} + OUTPUT_MD5: ${{ steps.upload-rust-binary-action.outputs.md5 }} + - name: Check b2 output + if: ${{ contains(matrix.checksums || 'b2,sha256,sha512,sha1,md5', 'b2') }} + run: | + printf 'outputs.b2 should not be empty\n' + test -n "${OUTPUT_B2}" + env: + OUTPUT_B2: ${{ steps.upload-rust-binary-action.outputs.b2 }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..00f4aa0 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,31 @@ +name: Release + +permissions: {} + +on: + workflow_dispatch: + inputs: + version: + description: Version to be increased + required: true + type: choice + options: + - patch + - minor + - major + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +jobs: + release: + if: github.repository_owner == 'taiki-e' + uses: taiki-e/github-actions/.github/workflows/action-release.yml@e6a1170cbd07eb898017958967912976fce18f2d # 2026.7.3 + permissions: + contents: write # for taiki-e/create-gh-release-action + secrets: + PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }} + PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }} + with: + version: ${{ inputs.version }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..ab5c01c --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +# zizmor configuration +# https://docs.zizmor.sh/configuration/ + +rules: + anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant. + dependabot-cooldown: { config: { days: 14 } } diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..33da979 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ + +# For platform and editor specific settings, it is recommended to add to +# a global .gitignore file. +# Refs: https://docs.github.com/en/github/using-git/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml new file mode 100644 index 0000000..9f27f0b --- /dev/null +++ b/.markdownlint-cli2.yaml @@ -0,0 +1,11 @@ +# https://github.com/DavidAnson/markdownlint/blob/HEAD/doc/Rules.md +config: + line-length: false # MD013 + no-duplicate-heading: false # MD024 + no-blanks-blockquote: false # MD028 (this warns valid GFM alerts usage) + no-inline-html: false # MD033 + no-emphasis-as-heading: false # MD036 + +# https://github.com/DavidAnson/markdownlint-cli2#markdownlint-cli2jsonc +noBanner: true +noProgress: true diff --git a/.shellcheckrc b/.shellcheckrc new file mode 100644 index 0000000..54bdb7b --- /dev/null +++ b/.shellcheckrc @@ -0,0 +1,38 @@ +# ShellCheck configuration +# https://github.com/koalaman/shellcheck/blob/HEAD/shellcheck.1.md#rc-files + +# See also: +# https://github.com/koalaman/shellcheck/wiki/Optional +# https://google.github.io/styleguide/shellguide.html + +# https://github.com/koalaman/shellcheck/wiki/Directive#external-sources +external-sources=true + +# https://github.com/koalaman/shellcheck/wiki/SC2249 +# enable=add-default-case + +# https://github.com/koalaman/shellcheck/wiki/SC2244 +enable=avoid-nullary-conditions + +# https://github.com/koalaman/shellcheck/wiki/SC2312 +# enable=check-extra-masked-returns + +# https://github.com/koalaman/shellcheck/wiki/SC2310 +# https://github.com/koalaman/shellcheck/wiki/SC2311 +# enable=check-set-e-suppressed + +# enable=check-unassigned-uppercase + +# https://github.com/koalaman/shellcheck/wiki/SC2230 +enable=deprecate-which + +# https://github.com/koalaman/shellcheck/wiki/SC2248 +enable=quote-safe-variables + +# https://github.com/koalaman/shellcheck/wiki/SC2292 +# https://google.github.io/styleguide/shellguide.html#s6.3-tests +enable=require-double-brackets + +# https://github.com/koalaman/shellcheck/wiki/SC2250 +# https://google.github.io/styleguide/shellguide.html#s5.6-variable-expansion +enable=require-variable-braces diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..3ab8ed5 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,288 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +This project adheres to [Semantic Versioning](https://semver.org). + + + +## [Unreleased] + +## [1.30.2] - 2026-04-17 + +- Enhance security when `dry-run` is true. + +## [1.30.1] - 2026-04-17 + +- Enhance security against supply chain attacks. + +## [1.30.0] - 2026-04-04 + +- upload-rust-binary-action no longer requires `token` input. This action now uses `${{ github.token }}` as the default token, like `actions/checkout` does. + +- Support trailing comma in `bin`, `package`, `include`, `asset`, and `checksum` input options. + +- Documentation improvements. + +## [1.29.1] - 2026-03-18 + +- Fix missing default value for `all-features` causing build errors. ([#114](https://github.com/taiki-e/upload-rust-binary-action/pull/114), thanks @ftnfurina) + +## [1.29.0] - 2026-03-17 + +- Add `all-features` and `workspace` input options. ([#112](https://github.com/taiki-e/upload-rust-binary-action/pull/112)) + +- Accept whitespace or comma separated list in `package` input option. ([#112](https://github.com/taiki-e/upload-rust-binary-action/pull/112)) + +## [1.28.1] - 2026-03-08 + +- Avoid triggering [zizmor ref-confusion](https://docs.zizmor.sh/audits/#ref-confusion) when using this action in form of `uses: taiki-e/upload-rust-binary-action@v1`. + +## [1.28.0] - 2026-02-11 + +- `bin`, `checksum`, `include`, and `asset` input options now support whitespace (space, tab, and line) or comma separated list. Previously, only comma-separated list was supported. ([#111](https://github.com/taiki-e/upload-rust-binary-action/pull/111)) + +- Enable [release immutability](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases). + +## [1.27.0] - 2025-06-14 + +- Add `package` input option. ([#103](https://github.com/taiki-e/upload-rust-binary-action/pull/103), thanks @A4-Tacks) + +## [1.26.0] - 2025-05-03 + +- Add `dry-run-intended` input option to suppress informational warnings generated by `dry-run` ([#100](https://github.com/taiki-e/upload-rust-binary-action/pull/100), thanks @eirnym) + +## [1.25.0] - 2025-04-26 + +- Add `tar-xz` input option to upload `.tar.xz` archive. ([#98](https://github.com/taiki-e/upload-rust-binary-action/pull/98), thanks @A4-Tacks) + +## [1.24.0] - 2024-12-17 + +- Add `locked` input option. ([#91](https://github.com/taiki-e/upload-rust-binary-action/pull/91), thanks @crazyscot) + +## [1.23.0] - 2024-11-11 + +- Add support for BLAKE2 checksums. ([#89](https://github.com/taiki-e/upload-rust-binary-action/issues/89), thanks @aartoni) + +## [1.22.1] - 2024-10-19 + +- Fix failure when cross-compiling to Windows on non-Windows. ([#86](https://github.com/taiki-e/upload-rust-binary-action/issues/86)) + +## [1.22.0] - 2024-08-12 + +- Add `codesign-prefix` and `codesign-options` input options. ([#81](https://github.com/taiki-e/upload-rust-binary-action/pull/81), thanks @matiaskorhonen) + +## [1.21.1] - 2024-07-12 + +- Work around rustc's strip bug that mostly affects illumos build. See [#80](https://github.com/taiki-e/upload-rust-binary-action/pull/80) for details. + +## [1.21.0] - 2024-06-02 + +- Add outputs for the archive and checksum files. ([#77](https://github.com/taiki-e/upload-rust-binary-action/pull/77), thanks @matiaskorhonen) + +## [1.20.0] - 2024-04-10 + +- Add `bin-leading-dir` input option. ([#73](https://github.com/taiki-e/upload-rust-binary-action/pull/73), thanks @linrongbin16) + +## [1.19.2] - 2024-04-03 + +- Add a warning for `macos-latest` runner architecture change. ([#70](https://github.com/taiki-e/upload-rust-binary-action/pull/70)) + + > warning: GitHub Actions changed default architecture of macos-latest since macos-14; consider passing 'target' input option to clarify which target you are building for. + +## [1.19.1] - 2024-03-26 + +- Work around strip bugs in rustc and cargo. See [#69](https://github.com/taiki-e/upload-rust-binary-action/pull/69) for details. + +## [1.19.0] - 2024-03-05 + +- Align default strip behavior to [Cargo 1.77+'s default (strip=debuginfo)](https://github.com/rust-lang/cargo/pull/13257). See [#66](https://github.com/taiki-e/upload-rust-binary-action/pull/66) for details. + +## [1.18.0] - 2023-12-03 + +- Support signing with `codesign` on macOS. ([#61](https://github.com/taiki-e/upload-rust-binary-action/pull/61), thanks @doinkythederp) + +## [1.17.1] - 2023-10-23 + +- Fix error when `build-tool` is explicitly set to cargo and installation for targets is needed. ([#57](https://github.com/taiki-e/upload-rust-binary-action/pull/57), thanks @sunshowers) + +## [1.17.0] - 2023-10-09 + +- Add `dry-run` input option. ([#55](https://github.com/taiki-e/upload-rust-binary-action/pull/55)) + +- Allow "kebab-case" input option names. ([#56](https://github.com/taiki-e/upload-rust-binary-action/pull/56)) + + Previously, option names were only in "snake_case", but now both "kebab-case" and "snake_case" are available. + +## [1.16.1] - 2023-09-09 + +- Improve robustness for temporary network failures. + +## [1.16.0] - 2023-08-06 + +- Support [cargo-zigbuild](https://github.com/rust-cross/cargo-zigbuild) as build tool. ([#50](https://github.com/taiki-e/upload-rust-binary-action/pull/50)) + +## [1.15.0] - 2023-06-26 + +- Use [multi-target builds](https://blog.rust-lang.org/2022/09/22/Rust-1.64.0.html#cargo-improvements-workspace-inheritance-and-multi-target-builds) for `universal-apple-darwin` (universal macOS binary) on Rust 1.64+. This could make `universal-apple-darwin` builds up to about 2x faster. + +## [1.14.0] - 2023-05-13 + +- Add `profile` input option to allow specifying custom profiles. ([#44](https://github.com/taiki-e/upload-rust-binary-action/pull/44), thanks @afnanenayet) + +## [1.13.0] - 2023-03-22 + +- Switch to composite action ([#42](https://github.com/taiki-e/upload-rust-binary-action/pull/42)) + +## [1.12.1] - 2023-03-19 + +- Diagnostics improvements. + +## [1.12.0] - 2023-01-10 + +- Support universal macOS binary as `target: universal-apple-darwin`. ([#38](https://github.com/taiki-e/upload-rust-binary-action/pull/38)) + +## [1.11.1] - 2022-12-28 + +- Fix installation of cross. + +- Improve support for stripping. + +## [1.11.0] - 2022-12-03 + +- Skip stripping by this action if cargo's [`strip` profile option](https://doc.rust-lang.org/cargo/reference/profiles.html#strip) is set. + +- Diagnostics improvements. + +## [1.10.0] - 2022-10-28 + +- Add `manifest_path` input option. ([#32](https://github.com/taiki-e/upload-rust-binary-action/pull/32), thanks @GeorgeHahn) + +## [1.9.1] - 2022-09-16 + +- Fix "command not found" error when `checksum` input option is passed on macOS. ([#30](https://github.com/taiki-e/upload-rust-binary-action/pull/30)) + +## [1.9.0] - 2022-09-08 + +- Add `token` input option to use the specified token instead of `GITHUB_TOKEN` environment variable. + +- Add `ref` input option to use the specified tag ref instead of `GITHUB_REF` environment variable. + +## [1.8.0] - 2022-08-28 + +- Add `no_default_features` input option. ([#28](https://github.com/taiki-e/upload-rust-binary-action/pull/28), thanks @samtay) + +## [1.7.2] - 2022-07-08 + +- Fix regression introduced in 1.7.0. + +## [1.7.1] - 2022-07-08 + +- Fix "no such file" error when `target` input option is passed. + +## [1.7.0] - 2022-07-07 + +- Add `asset` input option to upload additional files separately. ([#23](https://github.com/taiki-e/upload-rust-binary-action/pull/23)) + +- `--target` flag no longer passed to cargo when `target` input option is not specified. + +## [1.6.1] - 2022-07-06 + +- Fix unbound variable error on macOS. + +## [1.6.0] - 2022-07-05 + +- Support building and uploading multiple binaries at the same step. ([#18](https://github.com/taiki-e/upload-rust-binary-action/pull/18)) + +- Add `checksum` input option to upload checksum. ([#21](https://github.com/taiki-e/upload-rust-binary-action/pull/21)) + +- Add `build_tool` input option to specify the tool to build binaries. ([#20](https://github.com/taiki-e/upload-rust-binary-action/pull/20)) + +## [1.5.0] - 2022-07-05 + +- Add `include` input option to include additional files to the archive. ([#17](https://github.com/taiki-e/upload-rust-binary-action/pull/17)) + +## [1.4.0] - 2022-06-08 + +- Respect host cross-compilation setup. ([#16](https://github.com/taiki-e/upload-rust-binary-action/pull/16)) + +## [1.3.0] - 2022-05-01 + +- Update default runtime to node16. + +## [1.2.0] - 2021-12-30 + +- Skip the installation of `cross` if it is already installed. + + Previously, on Linux, if the target is different from the host and `cross` supports the target, `cross` was always installed. + +## [1.1.0] - 2021-09-29 + +- Add `features` input option. ([#7](https://github.com/taiki-e/upload-rust-binary-action/pull/7), thanks @ririsoft) + +- Fix strip error on non-x86 targets. ([#9](https://github.com/taiki-e/upload-rust-binary-action/pull/9)) + +## [1.0.2] - 2021-02-28 + +- Documentation improvements. + +## [1.0.1] - 2021-02-12 + +- Pass `--noprofile` and `--norc` options to bash. + +## [1.0.0] - 2021-02-03 + +Initial release + +[Unreleased]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.2...HEAD +[1.30.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.1...v1.30.2 +[1.30.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.0...v1.30.1 +[1.30.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.29.1...v1.30.0 +[1.29.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.29.0...v1.29.1 +[1.29.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.28.1...v1.29.0 +[1.28.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.28.0...v1.28.1 +[1.28.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.27.0...v1.28.0 +[1.27.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.26.0...v1.27.0 +[1.26.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.25.0...v1.26.0 +[1.25.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.24.0...v1.25.0 +[1.24.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.23.0...v1.24.0 +[1.23.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.22.1...v1.23.0 +[1.22.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.22.0...v1.22.1 +[1.22.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.21.1...v1.22.0 +[1.21.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.21.0...v1.21.1 +[1.21.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.20.0...v1.21.0 +[1.20.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.2...v1.20.0 +[1.19.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.1...v1.19.2 +[1.19.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.0...v1.19.1 +[1.19.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.18.0...v1.19.0 +[1.18.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.17.1...v1.18.0 +[1.17.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.17.0...v1.17.1 +[1.17.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.16.1...v1.17.0 +[1.16.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.16.0...v1.16.1 +[1.16.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.15.0...v1.16.0 +[1.15.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.14.0...v1.15.0 +[1.14.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.13.0...v1.14.0 +[1.13.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.12.1...v1.13.0 +[1.12.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.12.0...v1.12.1 +[1.12.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.11.1...v1.12.0 +[1.11.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.11.0...v1.11.1 +[1.11.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.10.0...v1.11.0 +[1.10.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.9.1...v1.10.0 +[1.9.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.9.0...v1.9.1 +[1.9.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.8.0...v1.9.0 +[1.8.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.2...v1.8.0 +[1.7.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.1...v1.7.2 +[1.7.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.0...v1.7.1 +[1.7.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.6.1...v1.7.0 +[1.6.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.6.0...v1.6.1 +[1.6.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.5.0...v1.6.0 +[1.5.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.4.0...v1.5.0 +[1.4.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.3.0...v1.4.0 +[1.3.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.2.0...v1.3.0 +[1.2.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.1.0...v1.2.0 +[1.1.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.2...v1.1.0 +[1.0.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.1...v1.0.2 +[1.0.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.0...v1.0.1 +[1.0.0]: https://github.com/taiki-e/upload-rust-binary-action/releases/tag/v1.0.0 diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1d59427 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2026 StepSecurity + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/LICENSE-APACHE b/LICENSE-APACHE new file mode 100644 index 0000000..f433b1a --- /dev/null +++ b/LICENSE-APACHE @@ -0,0 +1,177 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS diff --git a/LICENSE-MIT b/LICENSE-MIT new file mode 100644 index 0000000..31aa793 --- /dev/null +++ b/LICENSE-MIT @@ -0,0 +1,23 @@ +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md index c2df69a..7e7de5e 100644 --- a/README.md +++ b/README.md @@ -1 +1,774 @@ -# upload-rust-binary-action \ No newline at end of file +[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions) + +# upload-rust-binary-action + +[![release](https://img.shields.io/github/release/step-security/upload-rust-binary-action?style=flat-square&logo=github)](https://github.com/step-security/upload-rust-binary-action/releases/latest) +[![github actions](https://img.shields.io/github/actions/workflow/status/step-security/upload-rust-binary-action/ci.yml?branch=main&style=flat-square&logo=github)](https://github.com/step-security/upload-rust-binary-action/actions) + +GitHub Action for building and uploading Rust binary to GitHub Releases. + +- [Usage](#usage) + - [Inputs](#inputs) + - [Outputs](#outputs) + - [Example workflow: Basic usage](#example-workflow-basic-usage) + - [Example workflow: Basic usage (multiple platforms)](#example-workflow-basic-usage-multiple-platforms) + - [Example workflow: Customize archive name](#example-workflow-customize-archive-name) + - [Example workflow: Build with different features on different platforms](#example-workflow-build-with-different-features-on-different-platforms) + - [Example workflow: Cross-compilation](#example-workflow-cross-compilation) + - [cross](#cross) + - [setup-cross-toolchain-action](#setup-cross-toolchain-action) + - [cargo-zigbuild](#cargo-zigbuild) + - [Example workflow: Include additional files](#example-workflow-include-additional-files) + - [Other examples](#other-examples) + - [Optimize Rust binary](#optimize-rust-binary) +- [Supported events](#supported-events) +- [Security](#security) +- [Compatibility](#compatibility) +- [Related Projects](#related-projects) +- [License](#license) + +## Usage + +This action builds and uploads Rust binary that specified by `bin` option to +GitHub Releases. + +Currently, this action is basically intended to be used in combination with an action like [create-gh-release-action] that creates a GitHub release when a tag is pushed. See also [supported events](#supported-events). + +### Inputs + +| Name | Required | Description | Type | Default | +| ---- | :------: | ----------- | ---- | ------- | +| bin | **✓** | Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list) | String | | +| token | | GitHub token for uploading assets to GitHub Releases (see [action.yml](action.yml) for more) | String | `${{ github.token }}` | +| archive | | Archive name (non-extension portion of filename) to be uploaded | String | `$bin-$target` | +| target | \[1] | Target triple, default is host triple | String | (host triple) | +| features | | Cargo build features to enable (space or comma separated list) | String | | +| no-default-features | | Whether to disable cargo build default features | Boolean | `false` | +| all-features | | Whether to build with `--all-features` flag | Boolean | `false` | +| package | | Package names to build (whitespace or comma separated list) | String | | +| workspace | | Whether to build with `--workspace` flag | Boolean | `false` | +| locked | | Whether to build with `--locked` flag | Boolean | `false` | +| tar | | On which platform to distribute the `.tar.gz` file (all, unix, windows, or none) | String | `unix` | +| tar-xz | | On which platform to distribute the `.tar.xz` file (all, unix, windows, or none) | String | `none` | +| zip | | On which platform to distribute the `.zip` file (all, unix, windows, or none) | String | `windows` | +| checksum | | Algorithms to be used for checksum (sha256, sha512, b2, sha1, or md5) (whitespace or comma separated list).
Note: b2 is not available by default on macOS, install `b2sum` to use it. sha1 and md5 are insecure and strongly discouraged. | String | | +| include | | Additional files to be included to the archive (whitespace or comma separated list) | String | | +| asset | | Additional files to be uploaded separately (whitespace or comma separated list) | String | | +| leading-dir | | Whether to create the leading directory in the archive or not | Boolean | `false` | +| bin-leading-dir | | Create extra leading directory(s) for binary file(s) specified by `bin` option | String | | +| build-tool | | Tool to build binaries (cargo, cross, or cargo-zigbuild, see [cross-compilation example](#example-workflow-cross-compilation) for more) | String | | +| ref | | Fully-formed tag ref for this release (see [action.yml](action.yml) for more) | String | | +| manifest-path | | Path to Cargo.toml | String | `Cargo.toml` | +| profile | | The cargo profile to build. This defaults to the release profile. | String | `release` | +| dry-run | | Build and compress binaries, but do not upload them (see [action.yml](action.yml) for more) | Boolean | `false` | +| dry-run-intended | | Suppress informational `dry-run` warnings, keeping the rest | Boolean | `false` | +| codesign | | Sign build products using `codesign` on macOS | String | | +| codesign-prefix | | Prefix for the `codesign` identifier on macOS | String | | +| codesign-options | | Specifies a set of option flags to be embedded in the code signature on macOS. See the `codesign` manpage for details. | String | | + +\[1] This is optional but it is recommended that this always be set to clarify which target you are building for if macOS is included in the matrix because GitHub Actions changed the default architecture of macos-latest since macos-14.
+ +(Previously, option names were only in "snake_case", but now both "kebab-case" and "snake_case" are available.) + +### Outputs + +| Name | Description | +| ---- | ----------- | +| archive | Archive base name. | +| zip | `.zip` archive file name. | +| tar | `.tar.gz` archive file name. | +| tar-xz | `.tar.xz` archive file name. | +| sha256 | SHA256 checksum file name. | +| sha512 | SHA512 checksum file name. | +| b2 | BLAKE2 checksum file name. | +| sha1 | SHA1 checksum file name. | +| md5 | MD5 checksum file name. | + +### Example workflow: Basic usage + +In this example, when a new tag is pushed, creating a new GitHub Release by +using [create-gh-release-action], then uploading Rust binary to the created +GitHub Release. + +An archive file with a name like `$bin-$target.tar.gz` will be uploaded to +GitHub Release. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + runs-on: ubuntu-latest + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... +``` + +You can specify multiple binaries when the root manifest is a virtual manifest or specified binaries are in the same crate. + +```yaml +- uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: app1,app2 + # (optional) Archive name (non-extension portion of filename) to be uploaded. + # [default value: $bin-$target] + # [possible values: the following variables and any string] + # variables: + # - $bin - Binary name (non-extension portion of filename). + # - $target - Target triple. + # - $tag - Tag of this release. + # When multiple binary names are specified, default archive name or $bin variable cannot be used. + archive: app-$target +``` + +### Example workflow: Basic usage (multiple platforms) + +This action supports Linux, macOS, and Windows as a host OS and supports +binaries for various targets. + +See also [cross-compilation example](#example-workflow-cross-compilation). + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + strategy: + matrix: + include: + - target: x86_64-unknown-linux-gnu + os: ubuntu-latest + - target: x86_64-apple-darwin + os: macos-latest + - target: x86_64-pc-windows-msvc + os: windows-latest + runs-on: ${{ matrix.os }} + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Target triple, default is host triple. + # This is optional but it is recommended that this always be set to + # clarify which target you are building for if macOS is included in + # the matrix because GitHub Actions changed the default architecture + # of macos-latest since macos-14. + target: ${{ matrix.target }} + # (optional) On which platform to distribute the `.tar.gz` file. + # [default value: unix] + # [possible values: all, unix, windows, none] + tar: unix + # (optional) On which platform to distribute the `.zip` file. + # [default value: windows] + # [possible values: all, unix, windows, none] + zip: windows +``` + +### Example workflow: Customize archive name + +By default, this action will upload an archive file with a name like +`$bin-$target.$extension`. + +You can customize archive name by `archive` option. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + runs-on: ubuntu-latest + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + bin: ... + # (optional) Archive name (non-extension portion of filename) to be uploaded. + # [default value: $bin-$target] + # [possible values: the following variables and any string] + # variables: + # - $bin - Binary name (non-extension portion of filename). + # - $target - Target triple. + # - $tag - Tag of this release. + # When multiple binary names are specified, default archive name or $bin variable cannot be used. + archive: $bin-$tag-$target +``` + +### Example workflow: Build with different features on different platforms + +This action enables the `systemd` and `io_uring` features for Linux, and leave macOS, and Windows with default set of features. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + strategy: + matrix: + include: + - target: x86_64-unknown-linux-gnu + os: ubuntu-latest + features: systemd,io_uring + - target: x86_64-apple-darwin + os: macos-latest + - target: x86_64-pc-windows-msvc + os: windows-latest + runs-on: ${{ matrix.os }} + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Target triple, default is host triple. + target: ${{ matrix.target }} + # (optional) On which platform to distribute the `.tar.gz` file. + # [default value: unix] + # [possible values: all, unix, windows, none] + tar: unix + # (optional) On which platform to distribute the `.zip` file. + # [default value: windows] + # [possible values: all, unix, windows, none] + zip: windows + # (optional) Build with the given set of features if any. + features: ${{ matrix.features || '' }} +``` + +### Example workflow: Cross-compilation + +#### cross + +By default, this action uses [cross] for cross-compilation (if cross supports that target). In the following example, only aarch64-unknown-linux-gnu uses cross, the rest use cargo. + +If cross is not installed, this action calls `cargo install cross --locked` to install cross. If you want to speed up the installation of cross or use an older version of cross, consider using [install-action]. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + strategy: + matrix: + include: + - target: aarch64-unknown-linux-gnu + os: ubuntu-latest + - target: aarch64-apple-darwin + os: macos-latest + - target: x86_64-unknown-linux-gnu + os: ubuntu-latest + - target: x86_64-apple-darwin + os: macos-latest + # Universal macOS binary is supported as universal-apple-darwin. + - target: universal-apple-darwin + os: macos-latest + runs-on: ${{ matrix.os }} + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Target triple, default is host triple. + target: ${{ matrix.target }} +``` + +#### setup-cross-toolchain-action + +However, if the host has another cross-compilation setup, it will be respected. +The following is an example using [setup-cross-toolchain-action]. In this example, this action uses cargo for all targets. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + strategy: + matrix: + include: + - target: aarch64-unknown-linux-gnu + os: ubuntu-latest + - target: aarch64-apple-darwin + os: macos-latest + - target: x86_64-unknown-linux-gnu + os: ubuntu-latest + - target: x86_64-apple-darwin + os: macos-latest + runs-on: ${{ matrix.os }} + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - name: Install cross-compilation tools + uses: taiki-e/setup-cross-toolchain-action@v1 + with: + target: ${{ matrix.target }} + runner: none # Skip installation of cross-testing related tools because we only do cross-compilation. + if: startsWith(matrix.os, 'ubuntu') + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Target triple, default is host triple. + target: ${{ matrix.target }} +``` + +#### cargo-zigbuild + +if you want to use [cargo-zigbuild], if the heuristic to detect host cross-compilation setups does not work well, or if you want to force the use of cargo or cross, you can use the `build-tool` input option. + +If cargo-zigbuild is not installed, this action calls `pip3 install cargo-zigbuild` to install cargo-zigbuild. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + strategy: + matrix: + include: + - target: x86_64-unknown-linux-gnu + os: ubuntu-latest + build-tool: cargo-zigbuild + # cargo-zigbuild's glibc version suffix is also supported. + - target: aarch64-unknown-linux-gnu.2.17 + os: ubuntu-latest + build-tool: cargo-zigbuild + - target: aarch64-apple-darwin + os: macos-latest + build-tool: cargo + runs-on: ${{ matrix.os }} + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) + bin: ... + # (optional) Target triple, default is host triple. + target: ${{ matrix.target }} + # (optional) Tool to build binaries (cargo, cross, or cargo-zigbuild) + build-tool: ${{ matrix.build-tool }} +``` + +### Example workflow: Include additional files + +If you want include additional file *to the archive*, you can use the `include` option. + +```yaml +name: Release + +permissions: + contents: read + +on: + push: + tags: + - v[0-9]+.* + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write # for taiki-e/create-gh-release-action + steps: + - uses: actions/checkout@v6 + - uses: taiki-e/create-gh-release-action@v1 + with: + # (optional) Path to changelog. + changelog: CHANGELOG.md + + upload-assets: + needs: create-release + runs-on: ubuntu-latest + permissions: + contents: write # for step-security/upload-rust-binary-action + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Additional files to be included to the archive (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + include: LICENSE,README.md +``` + +By default, the expanded archive does not include the leading directory. In the above example, the directory structure of the archive would be as follows: + +```text +/ +/LICENSE +/README.md +``` + +You can use the `leading-dir` option to create the leading directory. + +```yaml +- uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Additional files to be included to the archive (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + include: LICENSE,README.md + # (optional) Whether to create the leading directory in the archive or not. default to false. + leading-dir: true +``` + +In the above example, the directory structure of the archive would be as follows: + +```text +// +// +//LICENSE +//README.md +``` + +You can use the `bin-leading-dir` option to create extra leading directory(s) for binary file(s) specified by `bin` option. + +```yaml +- uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Additional files to be included to the archive (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + include: LICENSE,README.md + # (optional) Whether to create the leading directory in the archive or not. default to false. + leading-dir: true + # (optional) Create extra leading directory(s) for binary file(s) specified by `bin` option. default to empty. + bin-leading-dir: opt/leading +``` + +In the above example, the directory structure of the archive would be as follows: + +```text +// +//opt/leading/ +//LICENSE +//README.md +``` + +If you want upload additional file *separately*, you can use the `asset` option. + +```yaml +upload-assets: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: step-security/upload-rust-binary-action@v1 + with: + # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + bin: ... + # (optional) Additional files to be uploaded separately (whitespace or comma separated list). + # Note that glob pattern is not supported yet. + asset: LICENSE,README.md +``` + +In the above example, the following 3 files will be uploaded: + +```text +-.tar.gz +LICENSE +README.md +``` + +### Other examples + +- [cargo-hack](https://github.com/taiki-e/cargo-hack/blob/202e6e59d491c9202ce148c9ef423853267226db/.github/workflows/release.yml#L47-L84) +- [tokio-console](https://github.com/tokio-rs/console/blob/9699300ec7901b71dce0d3555a7be2c86ec4e533/.github/workflows/release.yaml#L28-L43) + +### Optimize Rust binary + +You can optimize performance or size of Rust binaries by passing the profile options. +The profile options can be specified by [`[profile]` table in `Cargo.toml`](https://doc.rust-lang.org/cargo/reference/profiles.html), [cargo config](https://doc.rust-lang.org/cargo/reference/config.html), [environment variables](https://doc.rust-lang.org/cargo/reference/environment-variables.html#configuration-environment-variables), etc. + +The followings are examples to specify profile options: + +- [lto](https://doc.rust-lang.org/cargo/reference/profiles.html#lto) + + With profile: + + ```toml + [profile.release] + lto = true + ``` + + With environment variable: + + ```yaml + env: + CARGO_PROFILE_RELEASE_LTO: true + ``` + +- [codegen-units](https://doc.rust-lang.org/cargo/reference/profiles.html#codegen-units) + + With profile: + + ```toml + [profile.release] + codegen-units = 1 + ``` + + With environment variable: + + ```yaml + env: + CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1 + ``` + +- [strip](https://doc.rust-lang.org/cargo/reference/profiles.html#strip) + + With profile: + + ```toml + [profile.release] + strip = "symbols" + ``` + + [Default is `strip = debuginfo`.](https://github.com/rust-lang/cargo/pull/13257) + +**Note:** Some of these options may increase the build time. + +## Supported events + +The following two events are supported by default: + +- tags ([`on.push.tags`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push)) + + For example: + + ```yaml + on: + push: + tags: + - v[0-9]+.* + ``` + +- GitHub release ([`on.release`](https://docs.github.com/en/actions/reference/events-that-trigger-workflows#release)) + + For example: + + ```yaml + on: + release: + types: [created] + ``` + +You can upload binaries from arbitrary event to arbitrary tag by specifying the `ref` input option. + +For example, to upload binaries to the `my_tag` tag, specify `ref` input option as follows: + +```yaml +with: + ref: refs/tags/my_tag +``` + +## Security + +The `@v` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v..` tag or their hash to pin the version and regularly updating with dependency cooldown. Since all releases are immutable, pinning the version in either way should have the same effect. + +## Compatibility + +This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows). + +To use this action in self-hosted runners or in containers, at least the following tools are required: + +- rustup, cargo, rustc +- bash +- GNU tar +- [gh (GitHub CLI)](https://github.com/cli/cli#installation) +- zip (only Unix-like) +- 7z (only Windows) + +Note that what this action installs for its setup (such as above tools) is considered an implementation detail if they are installed by this action's side, and there is no guarantee that they will be available in subsequent steps, because this action is not an action for installing those tools. + +## Related Projects + +- [create-gh-release-action]: GitHub Action for creating GitHub Releases based on changelog. +- [setup-cross-toolchain-action]: GitHub Action for setup toolchains for cross compilation and cross testing for Rust. +- [install-action]: GitHub Action for installing development tools. +- [cache-cargo-install-action]: GitHub Action for `cargo install` with cache. +- [checkout-action]: GitHub Action for checking out a repository. (Simplified actions/checkout alternative that does not depend on Node.js.) + +[cache-cargo-install-action]: https://github.com/taiki-e/cache-cargo-install-action +[cargo-zigbuild]: https://github.com/rust-cross/cargo-zigbuild +[checkout-action]: https://github.com/taiki-e/checkout-action +[create-gh-release-action]: https://github.com/taiki-e/create-gh-release-action +[cross]: https://github.com/cross-rs/cross +[install-action]: https://github.com/taiki-e/install-action +[setup-cross-toolchain-action]: https://github.com/taiki-e/setup-cross-toolchain-action + +## License + +Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or +[MIT license](LICENSE-MIT) at your option. + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall +be dual licensed as above, without any additional terms or conditions. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..77568b2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,5 @@ +# Security Policy + +## Reporting a Vulnerability + +Please report security vulnerabilities to security@stepsecurity.io diff --git a/action.yml b/action.yml new file mode 100644 index 0000000..5050f88 --- /dev/null +++ b/action.yml @@ -0,0 +1,207 @@ +name: Build and upload Rust binary to GitHub Releases +description: GitHub Action for building and uploading Rust binary to GitHub Releases + +inputs: + bin: + description: > + Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). + Note that glob pattern is not supported yet. + required: true + archive: + description: Archive name (non-extension portion of filename) to be uploaded (variables `$bin`, `$target`, `$tag`, and any string) + required: false + default: '$bin-$target' + target: + description: Target name, default is host triple + required: false + features: + description: Cargo build features to enable (space or comma separated list) + required: false + no-default-features: + description: Whether to disable cargo build default features + required: false + no_default_features: + description: Alias for 'no-default-features' + required: false + default: 'false' + all-features: + description: Whether to build with `--all-features` flag + required: false + default: 'false' + package: + description: Package names to build (whitespace or comma separated list) + required: false + workspace: + description: Whether to build with `--workspace` flag + required: false + default: 'false' + locked: + description: Whether to build with `--locked` flag + required: false + default: 'false' + manifest-path: + description: Override cargo manifest path + required: false + manifest_path: + description: Alias for 'manifest-path' + required: false + tar: + description: On which platform to distribute the `.tar.gz` file (all, unix, windows, or none) + required: false + default: 'unix' + tar-xz: + description: On which platform to distribute the `.tar.xz` file (all, unix, windows, or none) + required: false + default: 'none' + zip: + description: On which platform to distribute the `.zip` file (all, unix, windows, or none) + required: false + default: 'windows' + include: + description: > + Additional files to be included to the archive (whitespace or comma separated list). + Note that glob pattern is not supported yet. + required: false + asset: + description: > + Additional files to be uploaded separately (whitespace or comma separated list). + Note that glob pattern is not supported yet. + required: false + leading-dir: + description: Whether to create the leading directory in the archive or not + required: false + leading_dir: + description: Alias for 'leading-dir' + required: false + default: 'false' + bin-leading-dir: + description: Create extra leading directory(s) for binary file(s) specified by 'bin' option + required: false + build-tool: + description: Tool to build binaries (cargo, cross, or cargo-zigbuild) + required: false + build_tool: + description: Alias for 'build-tool' + required: false + checksum: + description: > + Algorithms to be used for checksum (sha256, sha512, b2, sha1, or md5) (whitespace or comma separated list) + + Note: b2 is not available by default on macOS, install `b2sum` to use it. + sha1 and md5 are insecure and strongly discouraged. + required: false + token: + description: > + GitHub token for uploading assets to GitHub Releases. + + If not set this option, the GITHUB_TOKEN environment variable will be used. + If not set both this option and the GITHUB_TOKEN environment variable, github.token will be used. + required: false + ref: + description: > + Fully-formed tag ref for this release. + + If not set this option, the GITHUB_REF environment variable (automatically set by GitHub Actions) will be used. + required: false + profile: + description: The cargo profile to build. This defaults to the release profile. + required: false + default: 'release' + dry-run: + description: > + Build and compress binaries, but do not upload them. + + Note that some errors are downgraded to warnings in this mode. + required: false + dry-run-intended: + description: > + Suppress informational warnings for `dru-run` keeping the rest + required: false + default: 'false' + dry_run: + description: Alias for 'dry-run' + required: false + default: 'false' + codesign: + description: Sign build products using `codesign` on macOS + required: false + codesign-prefix: + description: Prefix for the `codesign` identifier on macOS + required: false + codesign_prefix: + description: Alias for 'codesign-prefix' + required: false + codesign-options: + description: Specifies a set of option flags to be embedded in the code signature on macOS. See the codesign manpage for details. + required: false + codesign_options: + description: Alias for 'codesign-options' + required: false + +outputs: + archive: + description: 'Archive base name' + value: ${{ steps.upload-rust-binary-action.outputs.archive }} + zip: + description: '.zip archive file name' + value: ${{ steps.upload-rust-binary-action.outputs.zip }} + tar: + description: '.tar.gz archive file name' + value: ${{ steps.upload-rust-binary-action.outputs.tar }} + tar-xz: + description: '.tar.xz archive file name' + value: ${{ steps.upload-rust-binary-action.outputs.tar-xz }} + b2: + description: 'BLAKE2 checksum file name' + value: ${{ steps.upload-rust-binary-action.outputs.b2 }} + sha256: + description: 'SHA256 checksum file name' + value: ${{ steps.upload-rust-binary-action.outputs.sha256 }} + sha512: + description: 'SHA512 checksum file name' + value: ${{ steps.upload-rust-binary-action.outputs.sha512 }} + sha1: + description: 'SHA1 checksum file name' + value: ${{ steps.upload-rust-binary-action.outputs.sha1 }} + md5: + description: 'MD5 checksum file name' + value: ${{ steps.upload-rust-binary-action.outputs.md5 }} + +# Note: +# - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665 +# - Use GITHUB_*/RUNNER_* instead of github.*/runner.* due to https://github.com/actions/runner/issues/2185 +runs: + using: composite + steps: + - id: upload-rust-binary-action + run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh" + shell: bash + env: + INPUT_BIN: ${{ inputs.bin }} + INPUT_ARCHIVE: ${{ inputs.archive }} + INPUT_TARGET: ${{ inputs.target }} + INPUT_FEATURES: ${{ inputs.features }} + INPUT_NO_DEFAULT_FEATURES: ${{ inputs.no-default-features || inputs.no_default_features }} + INPUT_ALL_FEATURES: ${{ inputs.all-features }} + INPUT_PACKAGE: ${{ inputs.package }} + INPUT_WORKSPACE: ${{ inputs.workspace }} + INPUT_LOCKED: ${{ inputs.locked }} + INPUT_MANIFEST_PATH: ${{ inputs.manifest-path || inputs.manifest_path }} + INPUT_TAR: ${{ inputs.tar }} + INPUT_TAR_XZ: ${{ inputs.tar-xz }} + INPUT_ZIP: ${{ inputs.zip }} + INPUT_INCLUDE: ${{ inputs.include }} + INPUT_ASSET: ${{ inputs.asset }} + INPUT_LEADING_DIR: ${{ inputs.leading-dir || inputs.leading_dir }} + INPUT_BIN_LEADING_DIR: ${{ inputs.bin-leading-dir }} + INPUT_BUILD_TOOL: ${{ inputs.build-tool || inputs.build_tool }} + INPUT_CHECKSUM: ${{ inputs.checksum }} + INPUT_TOKEN: ${{ (inputs.dry-run || inputs.dry_run) != 'true' && inputs.token || '' }} + INPUT_REF: ${{ inputs.ref }} + INPUT_PROFILE: ${{ inputs.profile }} + INPUT_DRY_RUN: ${{ inputs.dry-run || inputs.dry_run }} + INPUT_DRY_RUN_INTENDED: ${{ inputs.dry-run-intended }} + INPUT_CODESIGN: ${{ inputs.codesign }} + INPUT_CODESIGN_PREFIX: ${{ inputs.codesign-prefix || inputs.codesign_prefix }} + INPUT_CODESIGN_OPTIONS: ${{ inputs.codesign-options || inputs.codesign_options }} + DEFAULT_GITHUB_TOKEN: ${{ (inputs.dry-run || inputs.dry_run) != 'true' && github.token || '' }} diff --git a/main.sh b/main.sh new file mode 100755 index 0000000..484b69b --- /dev/null +++ b/main.sh @@ -0,0 +1,640 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: Apache-2.0 OR MIT +set -CeEuo pipefail +IFS=$'\n\t' + +x() { + ( + set -x + "$@" + ) +} +retry() { + for i in {1..10}; do + if "$@"; then + return 0 + else + sleep "${i}" + fi + done + "$@" +} +bail() { + printf '::error::%s\n' "$*" + exit 1 +} +warn() { + printf '::warning::%s\n' "$*" +} +info() { + printf >&2 'info: %s\n' "$*" +} +normalize_comma_or_space_separated() { + # Normalize whitespace characters into space because it's hard to handle single input contains lines with POSIX sed alone. + local list="${1//[$'\r\n\t']/ }" + if [[ "${list}" == *","* ]]; then + # If a comma is contained, consider it is a comma-separated list. + # Drop leading and trailing whitespaces in each element. + sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list}," + else + # Otherwise, consider it is a whitespace-separated list. + # Convert whitespace characters into comma. + sed -E 's/ +/,/g; s/^.//' <<<" ${list} " + fi +} + +export CARGO_NET_RETRY=10 +export RUSTUP_MAX_RETRIES=10 + +if [[ $# -gt 0 ]]; then + bail "invalid argument '$1'" +fi + +dry_run="${INPUT_DRY_RUN:-}" +case "${dry_run}" in + true) dry_run=1 ;; + false) dry_run='' ;; + *) bail "'dry-run' input option must be 'true' or 'false': '${dry_run}'" ;; +esac + +dry_run_intended="${INPUT_DRY_RUN_INTENDED:-}" +case "${dry_run_intended}" in + true) dry_run_intended=1 ;; + false) dry_run_intended='' ;; + '') dry_run_intended='' ;; + *) bail "'dry-run-intended' input option must be 'true' or 'false': '${dry_run_intended}'" ;; +esac + +if [[ -n "${INPUT_TOKEN}" ]] || [[ -n "${DEFAULT_GITHUB_TOKEN}" ]]; then + if [[ -n "${dry_run}" ]]; then + bail "internal error: INPUT_TOKEN and DEFAULT_GITHUB_TOKEN must be empty for dry-run" + fi +fi +token="${INPUT_TOKEN:-"${GITHUB_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}" +# This prevents tokens from being exposed to subprocesses via environment variables. +# Note that this does not prevent token leaks via reading `/proc/*/environ` on Linux or +# via `ps -Eww` on macOS. It only reduces the risk of leaks. +unset INPUT_TOKEN GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN +ref="${INPUT_REF:-"${GITHUB_REF:-}"}" + +if [[ -z "${token}" ]]; then + if [[ -z "${dry_run}" ]]; then + bail "neither GITHUB_TOKEN environment variable nor 'token' input option is set" + fi +fi + +if [[ "${ref}" != "refs/tags/"* ]]; then + if [[ -n "${dry_run}" ]]; then + if [[ -z "${dry_run_intended}" ]]; then + # TODO: The warnings are somewhat noisy if we have a lot of build matrix: + # https://github.com/taiki-e/upload-rust-binary-action/pull/55#discussion_r1349880455 + warn "tag ref should start with 'refs/tags/': '${ref}'; this action only supports events from tag or release by default; see for more (downgraded error to info because action is running in dry-run mode)" + fi + ref='refs/tags/dry-run' + else + bail "tag ref should start with 'refs/tags/': '${ref}'; this action only supports events from tag or release by default; see for more" + fi +fi +tag="${ref#refs/tags/}" + +features="${INPUT_FEATURES:-}" +archive="${INPUT_ARCHIVE:?}" + +if [[ ! "${INPUT_TAR}" =~ ^(all|unix|windows|none)$ ]]; then + bail "invalid input 'tar': ${INPUT_TAR}" +elif [[ ! "${INPUT_TAR_XZ}" =~ ^(all|unix|windows|none)$ ]]; then + bail "invalid input 'tar-xz': ${INPUT_TAR_XZ}" +elif [[ ! "${INPUT_ZIP}" =~ ^(all|unix|windows|none)$ ]]; then + bail "invalid input 'zip': ${INPUT_ZIP}" +fi + +leading_dir="${INPUT_LEADING_DIR:-}" +case "${leading_dir}" in + true) leading_dir=1 ;; + false) leading_dir='' ;; + *) bail "'leading-dir' input option must be 'true' or 'false': '${leading_dir}'" ;; +esac + +bin_leading_dir="${INPUT_BIN_LEADING_DIR:-}" + +no_default_features="${INPUT_NO_DEFAULT_FEATURES:-}" +case "${no_default_features}" in + true) no_default_features=1 ;; + false) no_default_features='' ;; + *) bail "'no-default-features' input option must be 'true' or 'false': '${no_default_features}'" ;; +esac + +all_features="${INPUT_ALL_FEATURES:-}" +case "${all_features}" in + true) all_features=1 ;; + false) all_features='' ;; + *) bail "'all-features' input option must be 'true' or 'false': '${all_features}'" ;; +esac + +build_locked="${INPUT_LOCKED:-}" +case "${build_locked}" in + true) build_locked=1 ;; + false) build_locked='' ;; + *) bail "'locked' input option must be 'true' or 'false': '${build_locked}'" ;; +esac + +build_workspace="${INPUT_WORKSPACE:-}" +case "${build_workspace}" in + true) build_workspace=1 ;; + false) build_workspace='' ;; + *) bail "'workspace' input option must be 'true' or 'false': '${build_workspace}'" ;; +esac + +build_package="${INPUT_PACKAGE:-}" +build_packages=() +if [[ -n "${build_package}" ]]; then + while IFS= read -rd,; do + build_packages+=("${REPLY}") + done < <(normalize_comma_or_space_separated "${build_package}") +fi + +bin_name="${INPUT_BIN:?}" +bin_names=() +if [[ -n "${bin_name}" ]]; then + # We can expand a glob by expanding a variable without quote, but that way + # has a security issue of shell injection. + if [[ "${bin_name}" == *"?"* ]] || [[ "${bin_name}" == *"*"* ]] || [[ "${bin_name}" == *"["* ]]; then + # This check is not for security but for diagnostic purposes. + # We quote the filename, so without this uses get an error like + # "cp: cannot stat 'app-*': No such file or directory". + bail "glob pattern in 'bin' input option is not supported yet" + fi + while IFS= read -rd,; do + bin_names+=("${REPLY}") + done < <(normalize_comma_or_space_separated "${bin_name}") +fi +if [[ ${#bin_names[@]} -gt 1 ]] && [[ "${archive}" == *"\$bin"* ]]; then + bail "when multiple binary names are specified, default archive name or '\$bin' variable cannot be used in 'archive' option" +fi + +include="${INPUT_INCLUDE:-}" +includes=() +if [[ -n "${include}" ]]; then + # We can expand a glob by expanding a variable without quote, but that way + # has a security issue of shell injection. + if [[ "${include}" == *"?"* ]] || [[ "${include}" == *"*"* ]] || [[ "${include}" == *"["* ]]; then + # This check is not for security but for diagnostic purposes. + # We quote the filename, so without this uses get an error like + # "cp: cannot stat 'LICENSE-*': No such file or directory". + bail "glob pattern in 'include' input option is not supported yet" + fi + while IFS= read -rd,; do + includes+=("${REPLY}") + done < <(normalize_comma_or_space_separated "${include}") +fi + +asset="${INPUT_ASSET:-}" +assets=() +if [[ -n "${asset}" ]]; then + # We can expand a glob by expanding a variable without quote, but that way + # has a security issue of shell injection. + if [[ "${asset}" == *"?"* ]] || [[ "${asset}" == *"*"* ]] || [[ "${asset}" == *"["* ]]; then + # This check is not for security but for diagnostic purposes. + # We quote the filename, so without this uses get an error like + # "cp: cannot stat 'LICENSE-*': No such file or directory". + bail "glob pattern in 'asset' input option is not supported yet" + fi + while IFS= read -rd,; do + assets+=("${REPLY}") + done < <(normalize_comma_or_space_separated "${asset}") +fi + +checksum="${INPUT_CHECKSUM:-}" +checksums=() +if [[ -n "${checksum}" ]]; then + while IFS= read -rd,; do + checksums+=("${REPLY}") + case "${REPLY}" in + b2 | sha256 | sha512 | sha1 | md5) ;; + *) bail "'checksum' input option must be 'b2', 'sha256', 'sha512', 'sha1', or 'md5': '${REPLY}'" ;; + esac + done < <(normalize_comma_or_space_separated "${checksum}") +fi + +host=$(rustc -vV | grep -E '^host:' | cut -d' ' -f2) +rustc_version=$(rustc -vV | grep -E '^release:' | cut -d' ' -f2) +rustc_minor_version="${rustc_version#*.}" +rustc_minor_version="${rustc_minor_version%%.*}" +target="${INPUT_TARGET:-"${host}"}" +zigbuild_target='' +build_tool="${INPUT_BUILD_TOOL:-}" +if [[ "${build_tool}" == "cargo-zigbuild" ]]; then + # cargo-zigbuild supports . suffix + zigbuild_target="${target}" + target="${target%%.*}" +fi +case "${target}" in + wasm*) exe=.wasm ;; + *-windows*) exe=.exe ;; + *) exe='' ;; +esac +target_lower="${target//-/_}" +target_lower="${target_lower//./_}" +target_upper=$(tr '[:lower:]' '[:upper:]' <<<"${target_lower}") + +case "$(uname -s)" in + Linux) + platform=unix + host_os=linux + ;; + Darwin) + platform=unix + host_os=macos + # Work around https://github.com/actions/cache/issues/403 by using GNU tar + # instead of BSD tar. + if ! type -P gtar >/dev/null; then + brew install gnu-tar &>/dev/null + fi + tar() { gtar "$@"; } + if [[ -z "${INPUT_TARGET:-}" ]]; then + warn "GitHub Actions changed default architecture of macos-latest since macos-14; consider passing 'target' input option to clarify which target you are building for" + fi + ;; + MINGW* | MSYS* | CYGWIN* | Windows_NT) + platform=windows + host_os=windows + ;; + *) bail "unrecognized OS type '$(uname -s)'" ;; +esac + +if [[ -z "${build_tool}" ]]; then + build_tool=cargo + if [[ "${host}" != "${target}" ]]; then + # If any of these are set, it is obvious that the user has set up a cross-compilation environment on the host. + if [[ -z "$(eval "printf '%s\n' \${CARGO_TARGET_${target_upper}_LINKER:-}")" ]] && [[ -z "$(eval "printf '%s\n' \${CARGO_TARGET_${target_upper}_RUNNER:-}")" ]]; then + case "${target}" in + # https://github.com/cross-rs/cross#supported-targets + *-windows*) + case "${host_os}" in + windows) ;; + *) build_tool=cross ;; + esac + ;; + *-apple-*) + case "${host_os}" in + macos) ;; + *) build_tool=cross ;; + esac + ;; + *-fuchsia* | *-redox*) ;; + *) build_tool=cross ;; + esac + fi + fi +fi + +if [[ "${build_tool}" == "cargo" ]]; then + case "${target}" in + universal-apple-darwin) retry rustup target add aarch64-apple-darwin x86_64-apple-darwin ;; + *) retry rustup target add "${target}" ;; + esac +fi + +archive="${archive/\$bin/${bin_names[0]}}" +archive="${archive/\$target/${target}}" +archive="${archive/\$tag/${tag}}" + +if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'archive=%s\n' "${archive}" >>"${GITHUB_OUTPUT}" +else + warn "GITHUB_OUTPUT is not set; skip setting the 'archive' output" + printf 'archive: %s\n' "${archive}" +fi + +input_profile=${INPUT_PROFILE:-release} +case "${input_profile}" in + release) build_options=(--release) ;; + *) build_options=(--profile "${input_profile}") ;; +esac + +# There are some special profiles that correspond to different target directory +# names. If we don't hit one of those conditionals then we just use the profile +# name. +# See: https://doc.rust-lang.org/nightly/cargo/reference/profiles.html#custom-profiles +case "${input_profile}" in + bench) profile_directory=release ;; + dev | test) profile_directory=debug ;; + *) profile_directory=${input_profile} ;; +esac + +bins=() +for bin_name in "${bin_names[@]}"; do + bins+=("${bin_name}${exe}") + build_options+=(--bin "${bin_name}") +done +if [[ -n "${features}" ]]; then + build_options+=(--features "${features}") +fi +if [[ -n "${no_default_features}" ]]; then + build_options+=(--no-default-features) +fi +if [[ -n "${all_features}" ]]; then + build_options+=(--all-features) +fi +if [[ -n "${build_locked}" ]]; then + build_options+=(--locked) +fi +if [[ -n "${build_workspace}" ]]; then + build_options+=(--workspace) +fi +for build_package in ${build_packages[@]+"${build_packages[@]}"}; do + build_options+=(--package "${build_package}") +done +metadata_options=(--format-version=1 --no-deps) +manifest_path="${INPUT_MANIFEST_PATH:-}" +if [[ -n "${manifest_path}" ]]; then + build_options+=(--manifest-path "${manifest_path}") + metadata_options+=(--manifest-path "${manifest_path}") +fi +eval "$(cargo metadata "${metadata_options[@]}" | jq -r '@sh "target_dir=\(.target_directory) WORKSPACE_ROOT=\(.workspace_root)"')" + +# Skip setting the strip option (requires Cargo 1.59) if it is unavailable or already set. +# TODO: This check is somewhat rough as it does not look at the type of profile. +if [[ "${rustc_minor_version}" -ge 59 ]] && [[ -z "${CARGO_PROFILE_RELEASE_STRIP:-}" ]] && ! grep -Eq '^\s*strip\s*=' "${WORKSPACE_ROOT}/Cargo.toml"; then + if [[ "${rustc_minor_version}" -lt 79 ]]; then + # On pre-1.77, align to Cargo 1.77+'s default: https://github.com/rust-lang/cargo/pull/13257 + # However, set environment variable on pre-1.79 because it is 1.79+ that actually works correctly due to https://github.com/rust-lang/cargo/issues/13617. + case "${target}" in + # Do not strip debuginfo on MSVC https://github.com/rust-lang/cargo/pull/13630 + # This is the same behavior as pre-1.19.0 upload-rust-binary-action. + *-windows-msvc) strip_default=none ;; + *) strip_default=debuginfo ;; + esac + export CARGO_PROFILE_RELEASE_STRIP="${strip_default}" + fi + # On pre-1.84, do not strip debuginfo on these targets in cross-compilation (including docker via cross). + # https://github.com/rust-lang/rust/pull/131405 + # https://github.com/nextest-rs/nextest/commit/d4f982b3184f07ff5c40cc90c52d3fc6567be0b9#commitcomment-140325483 + # https://github.com/rust-lang/rust/issues/123151#issuecomment-2024743520 + # https://github.com/rust-lang/rust/blob/1.83.0/compiler/rustc_codegen_ssa/src/back/link.rs#L1089-L1137 + if [[ "${rustc_minor_version}" -lt 84 ]]; then + case "${target}" in + *-apple-*) + case "${host_os}" in + macos) ;; # apple to apple cross-compilation is okay + *) export CARGO_PROFILE_RELEASE_STRIP=none ;; + esac + ;; + # illumos/AIX host is not supported on GitHub Actions. + *-illumos* | *-aix*) export CARGO_PROFILE_RELEASE_STRIP=none ;; + esac + fi +fi + +build() { + case "${build_tool}" in + cargo) x cargo build "${build_options[@]}" "$@" ;; + cross) + if ! type -P cross >/dev/null; then + x cargo install cross --locked + fi + x cross build "${build_options[@]}" "$@" + ;; + cargo-zigbuild) + if ! type -P cargo-zigbuild >/dev/null; then + x pip3 install cargo-zigbuild + fi + case "${INPUT_TARGET:-}" in + '') ;; + universal2-apple-darwin) retry rustup target add aarch64-apple-darwin x86_64-apple-darwin ;; + *) retry rustup target add "${target}" ;; + esac + x cargo zigbuild "${build_options[@]}" "$@" + ;; + *) bail "unrecognized build tool '${build_tool}'" ;; + esac +} +do_codesign() { + if [[ -n "${INPUT_CODESIGN:-}" ]]; then + local codesign_options=(--sign "${INPUT_CODESIGN}") + if [[ -n "${INPUT_CODESIGN_PREFIX:-}" ]]; then + codesign_options+=(--prefix "${INPUT_CODESIGN_PREFIX}") + fi + if [[ -n "${INPUT_CODESIGN_OPTIONS:-}" ]]; then + codesign_options+=(--options "${INPUT_CODESIGN_OPTIONS}") + fi + + for bin_exe in "${bins[@]}"; do + x codesign "${codesign_options[@]}" "${target_dir}/${bin_exe}" + done + fi +} + +case "${INPUT_TARGET:-}" in + '') + build + target_dir="${target_dir}/${profile_directory}" + ;; + universal-apple-darwin) + # Refs: https://developer.apple.com/documentation/apple-silicon/building-a-universal-macos-binary + # multi-target builds requires 1.64 + if [[ "${rustc_minor_version}" -ge 64 ]]; then + build --target aarch64-apple-darwin --target x86_64-apple-darwin + else + build --target aarch64-apple-darwin + build --target x86_64-apple-darwin + fi + aarch64_target_dir="${target_dir}/aarch64-apple-darwin/${profile_directory}" + x86_64_target_dir="${target_dir}/x86_64-apple-darwin/${profile_directory}" + target_dir="${target_dir}/${target}/${profile_directory}" + mkdir -p -- "${target_dir}" + for bin_exe in "${bins[@]}"; do + x lipo -create -output "${target_dir}/${bin_exe}" "${aarch64_target_dir}/${bin_exe}" "${x86_64_target_dir}/${bin_exe}" + done + ;; + *) + build --target "${zigbuild_target:-"${target}"}" + target_dir="${target_dir}/${target}/${profile_directory}" + ;; +esac + +case "${host_os}" in + macos) + if type -P codesign >/dev/null; then + do_codesign + fi + ;; +esac + +if [[ "${INPUT_TAR/all/${platform}}" == "${platform}" ]] \ + || [[ "${INPUT_TAR_XZ/all/${platform}}" == "${platform}" ]] \ + || [[ "${INPUT_ZIP/all/${platform}}" == "${platform}" ]]; then + cwd="${PWD}" + tmpdir=$(mktemp -d) + mkdir -- "${tmpdir:?}/${archive}" + if [[ -n "${bin_leading_dir}" ]]; then + mkdir -p -- "${tmpdir}/${archive}/${bin_leading_dir}"/ + # TODO: %%/* is wrong if bin_leading_dir starts with / + filenames=("${bin_leading_dir%%/*}") + else + filenames=("${bins[@]}") + fi + for bin_exe in "${bins[@]}"; do + if [[ -n "${bin_leading_dir}" ]]; then + x cp -- "${target_dir}/${bin_exe}" "${tmpdir}/${archive}/${bin_leading_dir}"/ + else + x cp -- "${target_dir}/${bin_exe}" "${tmpdir}/${archive}"/ + fi + done + for include in ${includes[@]+"${includes[@]}"}; do + x cp -r -- "${include}" "${tmpdir}/${archive}"/ + filenames+=("$(basename -- "${include}")") + done + pushd -- "${tmpdir}" >/dev/null + if [[ -n "${leading_dir}" ]]; then + # with leading directory + # + # /${archive} + # /${archive}/${bins} + # /${archive}/${includes} + if [[ "${INPUT_TAR/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.tar.gz") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'tar=%s.tar.gz\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'tar' output" + printf 'tar: %s.tar.gz\n' "${archive}" + fi + + x tar acf "${cwd}/${archive}.tar.gz" "${archive}" + fi + if [[ "${INPUT_TAR_XZ/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.tar.xz") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'tar-xz=%s.tar.xz\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'tar-xz' output" + printf 'tar-xz: %s.tar.xz\n' "${archive}" + fi + + x tar acf "${cwd}/${archive}.tar.xz" "${archive}" + fi + if [[ "${INPUT_ZIP/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.zip") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'zip=%s.zip\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'zip' output" + printf 'zip: %s.zip\n' "${archive}" + fi + + if [[ "${platform}" == "unix" ]]; then + x zip -r "${cwd}/${archive}.zip" "${archive}" + else + x 7z a "${cwd}/${archive}.zip" "${archive}" + fi + fi + else + # without leading directory + # + # /${bins} + # /${includes} + pushd -- "${archive}" >/dev/null + if [[ "${INPUT_TAR/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.tar.gz") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'tar=%s.tar.gz\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'tar' output" + printf 'tar: %s.tar.gz\n' "${archive}" + fi + + x tar acf "${cwd}/${archive}.tar.gz" "${filenames[@]}" + fi + if [[ "${INPUT_TAR_XZ/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.tar.xz") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'tar-xz=%s.tar.xz\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'tar-xz' output" + printf 'tar-xz: %s.tar.xz\n' "${archive}" + fi + + x tar acf "${cwd}/${archive}.tar.xz" "${filenames[@]}" + fi + if [[ "${INPUT_ZIP/all/${platform}}" == "${platform}" ]]; then + assets+=("${archive}.zip") + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf 'zip=%s.zip\n' "${archive}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the 'zip' output" + printf 'zip: %s.zip\n' "${archive}" + fi + + if [[ "${platform}" == "unix" ]]; then + x zip -r "${cwd}/${archive}.zip" "${filenames[@]}" + else + x 7z a "${cwd}/${archive}.zip" "${filenames[@]}" + fi + fi + popd >/dev/null + fi + popd >/dev/null + rm -rf -- "${tmpdir:?}/${archive}" +fi + +# Checksum of all assets except for . files. +final_assets=("${assets[@]}") +for checksum in ${checksums[@]+"${checksums[@]}"}; do + # TODO: Should we allow customizing the name of checksum files? + if type -P "${checksum}sum" >/dev/null; then + "${checksum}sum" "${assets[@]}" >"${archive}.${checksum}" + else + # GitHub-hosted macOS runner does not install GNU Coreutils by default. + # https://github.com/actions/runner-images/issues/90 + case "${checksum}" in + b2) + bail "checksum for '${checksum}' requires '${checksum}sum' command; consider installing it" + ;; + sha*) + if type -P shasum >/dev/null; then + shasum -a "${checksum#sha}" "${assets[@]}" >"${archive}.${checksum}" + else + bail "checksum for '${checksum}' requires '${checksum}sum' or 'shasum' command; consider installing one of them" + fi + ;; + md5) + if type -P md5 >/dev/null; then + md5 "${assets[@]}" >"${archive}.${checksum}" + else + bail "checksum for '${checksum}' requires '${checksum}sum' or 'md5' command; consider installing one of them" + fi + ;; + *) bail "unrecognized 'checksum' input option '${checksum}'" ;; + esac + fi + x cat -- "${archive}.${checksum}" + + if [[ -n "${GITHUB_OUTPUT:-}" ]]; then + printf '%s=%s.%s\n' "${checksum}" "${archive}" "${checksum}" >>"${GITHUB_OUTPUT}" + else + warn "GITHUB_OUTPUT is not set; skip setting the '${checksum}' output" + printf '%s: %s.%s\n' "${checksum}" "${archive}" "${checksum}" + fi + + final_assets+=("${archive}.${checksum}") +done + +if [[ -n "${dry_run}" ]]; then + if [[ -z "${dry_run_intended}" ]]; then + info "skipped upload because action is running in dry-run mode" + printf "tag: %s ('dry-run' if tag ref is not start with 'refs/tags/')\n" "${tag}" + fi + IFS=',' + printf 'assets: %s\n' "${final_assets[*]}" + IFS=$'\n\t' +else + # https://cli.github.com/manual/gh_release_upload + GITHUB_TOKEN="${token}" retry gh release upload "${tag}" "${final_assets[@]}" --clobber +fi diff --git a/tools/.tidy-check-license-headers b/tools/.tidy-check-license-headers new file mode 100644 index 0000000..46c7417 --- /dev/null +++ b/tools/.tidy-check-license-headers @@ -0,0 +1 @@ +git ls-files diff --git a/tools/tidy.sh b/tools/tidy.sh new file mode 100755 index 0000000..2796be0 --- /dev/null +++ b/tools/tidy.sh @@ -0,0 +1,143 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: Apache-2.0 OR MIT +set -CeEuo pipefail +IFS=$'\n\t' +trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT +cd -- "$(dirname -- "$0")"/.. + +# USAGE: +# GITHUB_TOKEN=$(gh auth token) ./tools/tidy.sh +# +# Note: This script requires the following tools: +# - docker or podman (or compatible CLI specified by TIDY_DOCKER_PATH. when both available and TIDY_DOCKER_PATH is not set, docker is preferred) +# +# This script is shared by projects under github.com/taiki-e, so there may also +# be checks for files not included in this repository, but they will be skipped +# if the corresponding files do not exist. +# It is not intended for manual editing. + +bail() { + if [[ -n "${GITHUB_ACTIONS:-}" ]]; then + printf '::error::%s\n' "$*" + else + printf >&2 'error: %s\n' "$*" + fi + exit 1 +} + +if [[ $# -gt 0 ]]; then + cat <"${tmp}"/dummy +code=0 +color='' +if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then + color=1 +fi +# Refs: +# - https://docs.docker.com/reference/cli/docker/container/run/ +# - https://docs.podman.io/en/latest/markdown/podman-run.1.html +# - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html +common_args=( + run --rm --init + --cap-drop=all + --security-opt=no-new-privileges + --read-only + --env GITHUB_ACTIONS + --env CI + --env CARGO_TERM_COLOR + --env REMOVE_UNUSED_WORDS + --env TIDY_COLOR_ALWAYS="${color}" + --env TIDY_CALLER="$0" + --env TIDY_EXPECTED_MARKDOWN_FILE_COUNT + --env TIDY_EXPECTED_RUST_FILE_COUNT + --env TIDY_EXPECTED_CLANG_FORMAT_FILE_COUNT + --env TIDY_EXPECTED_PRETTIER_FILE_COUNT + --env TIDY_EXPECTED_TOML_FILE_COUNT + --env TIDY_EXPECTED_SHELL_FILE_COUNT + --env TIDY_EXPECTED_DOCKER_FILE_COUNT +) +if [[ -n "${TIDY_DOCKER_PATH:-}" ]]; then + docker="${TIDY_DOCKER_PATH}" +elif type -P docker >/dev/null; then + docker='docker' +elif type -P podman >/dev/null; then + docker='podman' +else + bail 'this script requires docker or podman' +fi +rootless='' +if [[ "$("${docker}" --version)" == *'podman'* ]]; then + if [[ "$("${docker}" info)" == *'rootless: true'* ]]; then + rootless=1 + fi +elif [[ "$("${docker}" info -f '{{println .SecurityOptions}}')" == *'rootless'* ]]; then + rootless=1 +fi +if [[ -n "${rootless}" ]]; then + printf 'docker path: %s\n' "${docker} (rootless)" +else + printf 'docker path: %s\n' "${docker}" + common_args+=(--user "${user}") +fi + +# Map ignored files (e.g., .env) to dummy files. +while IFS= read -r path; do + if [[ -d "${path}" ]]; then + common_args+=( + --mount "type=bind,source=${tmp}/dummy-dir,target=${workdir}/${path},readonly" + ) + else + common_args+=( + --mount "type=bind,source=${tmp}/dummy,target=${workdir}/${path},readonly" + ) + fi +done < <(git status --porcelain --ignored | grep -E '^!!' | cut -d' ' -f2) + +docker_run() { + local script="$1" + shift + "${docker}" "${common_args[@]}" "$@" "${image}" /checks/"${script}" + code2="$?" + if [[ ${code} -eq 0 ]] && [[ ${code2} -ne 0 ]]; then + code="${code2}" + fi +} + +set +e +docker_run offline.sh \ + --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \ + --mount "type=bind,source=${workdir}/.git,target=${workdir}/.git,readonly" \ + --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \ + --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \ + --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \ + --network=none +# Some good audits requires access to GitHub API. +docker_run zizmor.sh \ + --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \ + --mount "type=bind,source=${tmp}/zizmor-cache,target=/.cache/zizmor" \ + --env GH_TOKEN --env GITHUB_TOKEN --env ZIZMOR_GITHUB_TOKEN +# We use remote dictionary. +docker_run cspell.sh \ + --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \ + --mount "type=bind,source=${workdir}/.github/.cspell/project-dictionary.txt,target=${workdir}/.github/.cspell/project-dictionary.txt" \ + --mount "type=bind,source=${workdir}/.github/.cspell/rust-dependencies.txt,target=${workdir}/.github/.cspell/rust-dependencies.txt" \ + --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" + +exit "${code}" From b40677f262fef0452a6e35dfe5459a2f8e045542 Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 14:15:48 +0530 Subject: [PATCH 2/6] feat: added subscription check and other changes --- .editorconfig | 24 --- .git-blame-ignore-revs | 2 - .gitattributes | 3 - .github/dependabot.yml | 11 -- .github/workflows/audit_package.yml | 28 --- .github/workflows/ci.yml | 79 +++++++- .github/workflows/release.yml | 31 --- .gitignore | 4 - CHANGELOG.md | 288 ---------------------------- LICENSE-APACHE | 177 ----------------- LICENSE-MIT | 23 --- README.md | 59 ++---- action.yml | 44 +++++ 13 files changed, 134 insertions(+), 639 deletions(-) delete mode 100644 .editorconfig delete mode 100644 .git-blame-ignore-revs delete mode 100644 .gitattributes delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/audit_package.yml delete mode 100644 .github/workflows/release.yml delete mode 100644 CHANGELOG.md delete mode 100644 LICENSE-APACHE delete mode 100644 LICENSE-MIT diff --git a/.editorconfig b/.editorconfig deleted file mode 100644 index 17aaa0c..0000000 --- a/.editorconfig +++ /dev/null @@ -1,24 +0,0 @@ -# EditorConfig configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 4 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.{css,html,json,md,rb,ps1,sh,yml,yaml}] -indent_size = 2 - -[*.{js,yml,yaml}] -quote_type = single - -[*.sh] -# https://google.github.io/styleguide/shellguide.html#s5.3-pipelines -binary_next_line = true -# https://google.github.io/styleguide/shellguide.html#s5.5-case-statement -switch_case_indent = true diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs deleted file mode 100644 index 2c42b40..0000000 --- a/.git-blame-ignore-revs +++ /dev/null @@ -1,2 +0,0 @@ -# Change indent size of shell script files to match scripts in CI config -fed5c724a578d2b6d7a663e60b5e6012dac3a7e5 diff --git a/.gitattributes b/.gitattributes deleted file mode 100644 index 36b9413..0000000 --- a/.gitattributes +++ /dev/null @@ -1,3 +0,0 @@ -* text=auto eol=lf -tools/tidy.sh linguist-detectable=false -.github/.cspell/rust-dependencies.txt linguist-generated diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 1e56873..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,11 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: monthly - cooldown: - default-days: 14 - commit-message: - prefix: '' - labels: [] diff --git a/.github/workflows/audit_package.yml b/.github/workflows/audit_package.yml deleted file mode 100644 index 2cc740e..0000000 --- a/.github/workflows/audit_package.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: NPM Audit Fix Run - -on: - workflow_dispatch: - inputs: - force: - description: "Use --force flag for npm audit fix?" - required: true - type: boolean - base_branch: - description: "Specify a base branch" - required: false - default: "main" - schedule: - - cron: "0 0 * * 1" - -jobs: - audit-fix: - uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1 - with: - force: ${{ inputs.force || false }} - base_branch: ${{ inputs.base_branch || 'main' }} - -permissions: - contents: write - pull-requests: write - packages: read - issues: write diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 456cdb2..e43ea1a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,9 +7,6 @@ on: push: branches: - main - - dev - schedule: - - cron: '0 2 * * *' workflow_dispatch: env: @@ -31,12 +28,13 @@ concurrency: jobs: tidy: - uses: taiki-e/github-actions/.github/workflows/tidy.yml@e6a1170cbd07eb898017958967912976fce18f2d # 2026.7.3 + uses: taiki-e/github-actions/.github/workflows/tidy.yml@2026.8.8 permissions: security-events: write # for github/codeql-action/* # TODO: test container test: + if: github.actor != 'dependabot[bot]' needs: tidy strategy: fail-fast: false @@ -83,12 +81,12 @@ jobs: runs-on: ${{ matrix.os || 'ubuntu-24.04' }} timeout-minutes: 60 steps: - - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2 - - uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4 + - uses: taiki-e/checkout-action@v1 + - uses: taiki-e/install-action@v2 with: tool: rust@stable fallback: none - - uses: taiki-e/setup-cross-toolchain-action@3d9770ce98eb7dbcf378563182a5e8031165f75b # v1.41.0 + - uses: step-security/setup-cross-toolchain-action@release # replace post release with: target: ${{ matrix.target }} runner: none @@ -154,3 +152,70 @@ jobs: test -n "${OUTPUT_B2}" env: OUTPUT_B2: ${{ steps.upload-rust-binary-action.outputs.b2 }} + + test-dependabot: + if: github.actor == 'dependabot[bot]' + needs: tidy + runs-on: ubuntu-24.04 + timeout-minutes: 60 + steps: + - uses: taiki-e/checkout-action@v1 + - uses: taiki-e/install-action@v2 + with: + tool: rust@stable + fallback: none + - run: cargo new --bin test-crate + - uses: ./ + id: upload-rust-binary-action + with: + dry-run: true + bin: test-crate + workspace: 'false' + checksum: 'b2,sha256,sha512,sha1,md5' + tar: all + tar-xz: all + zip: all + manifest-path: test-crate/Cargo.toml + codesign: '-' + codesign-prefix: 'com.example.' + codesign-options: 'runtime' + - name: Check action outputs + run: | + printf 'outputs.archive should not be empty\n' + test -n "${OUTPUT_ARCHIVE}" + + printf 'outputs.zip should be a file\n' + test -f "${OUTPUT_ZIP}" + + printf 'outputs.tar should be a file\n' + test -f "${OUTPUT_TAR}" + + printf 'outputs.tar-xz should be a file\n' + test -f "${OUTPUT_TAR_XZ}" + + printf 'outputs.sha256 should be a file\n' + test -f "${OUTPUT_SHA256}" + + printf 'outputs.sha512 should be a file\n' + test -f "${OUTPUT_SHA512}" + + printf 'outputs.sha1 should be a file\n' + test -f "${OUTPUT_SHA1}" + + printf 'outputs.md5 should be a file\n' + test -f "${OUTPUT_MD5}" + env: + OUTPUT_ARCHIVE: ${{ steps.upload-rust-binary-action.outputs.archive }} + OUTPUT_ZIP: ${{ steps.upload-rust-binary-action.outputs.zip }} + OUTPUT_TAR: ${{ steps.upload-rust-binary-action.outputs.tar }} + OUTPUT_TAR_XZ: ${{ steps.upload-rust-binary-action.outputs.tar-xz }} + OUTPUT_SHA256: ${{ steps.upload-rust-binary-action.outputs.sha256 }} + OUTPUT_SHA512: ${{ steps.upload-rust-binary-action.outputs.sha512 }} + OUTPUT_SHA1: ${{ steps.upload-rust-binary-action.outputs.sha1 }} + OUTPUT_MD5: ${{ steps.upload-rust-binary-action.outputs.md5 }} + - name: Check b2 output + run: | + printf 'outputs.b2 should not be empty\n' + test -n "${OUTPUT_B2}" + env: + OUTPUT_B2: ${{ steps.upload-rust-binary-action.outputs.b2 }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 00f4aa0..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Release - -permissions: {} - -on: - workflow_dispatch: - inputs: - version: - description: Version to be increased - required: true - type: choice - options: - - patch - - minor - - major - -concurrency: - group: ${{ github.workflow }} - cancel-in-progress: false - -jobs: - release: - if: github.repository_owner == 'taiki-e' - uses: taiki-e/github-actions/.github/workflows/action-release.yml@e6a1170cbd07eb898017958967912976fce18f2d # 2026.7.3 - permissions: - contents: write # for taiki-e/create-gh-release-action - secrets: - PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }} - PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }} - with: - version: ${{ inputs.version }} diff --git a/.gitignore b/.gitignore index 33da979..e69de29 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +0,0 @@ - -# For platform and editor specific settings, it is recommended to add to -# a global .gitignore file. -# Refs: https://docs.github.com/en/github/using-git/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 3ab8ed5..0000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,288 +0,0 @@ -# Changelog - -All notable changes to this project will be documented in this file. - -This project adheres to [Semantic Versioning](https://semver.org). - - - -## [Unreleased] - -## [1.30.2] - 2026-04-17 - -- Enhance security when `dry-run` is true. - -## [1.30.1] - 2026-04-17 - -- Enhance security against supply chain attacks. - -## [1.30.0] - 2026-04-04 - -- upload-rust-binary-action no longer requires `token` input. This action now uses `${{ github.token }}` as the default token, like `actions/checkout` does. - -- Support trailing comma in `bin`, `package`, `include`, `asset`, and `checksum` input options. - -- Documentation improvements. - -## [1.29.1] - 2026-03-18 - -- Fix missing default value for `all-features` causing build errors. ([#114](https://github.com/taiki-e/upload-rust-binary-action/pull/114), thanks @ftnfurina) - -## [1.29.0] - 2026-03-17 - -- Add `all-features` and `workspace` input options. ([#112](https://github.com/taiki-e/upload-rust-binary-action/pull/112)) - -- Accept whitespace or comma separated list in `package` input option. ([#112](https://github.com/taiki-e/upload-rust-binary-action/pull/112)) - -## [1.28.1] - 2026-03-08 - -- Avoid triggering [zizmor ref-confusion](https://docs.zizmor.sh/audits/#ref-confusion) when using this action in form of `uses: taiki-e/upload-rust-binary-action@v1`. - -## [1.28.0] - 2026-02-11 - -- `bin`, `checksum`, `include`, and `asset` input options now support whitespace (space, tab, and line) or comma separated list. Previously, only comma-separated list was supported. ([#111](https://github.com/taiki-e/upload-rust-binary-action/pull/111)) - -- Enable [release immutability](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases). - -## [1.27.0] - 2025-06-14 - -- Add `package` input option. ([#103](https://github.com/taiki-e/upload-rust-binary-action/pull/103), thanks @A4-Tacks) - -## [1.26.0] - 2025-05-03 - -- Add `dry-run-intended` input option to suppress informational warnings generated by `dry-run` ([#100](https://github.com/taiki-e/upload-rust-binary-action/pull/100), thanks @eirnym) - -## [1.25.0] - 2025-04-26 - -- Add `tar-xz` input option to upload `.tar.xz` archive. ([#98](https://github.com/taiki-e/upload-rust-binary-action/pull/98), thanks @A4-Tacks) - -## [1.24.0] - 2024-12-17 - -- Add `locked` input option. ([#91](https://github.com/taiki-e/upload-rust-binary-action/pull/91), thanks @crazyscot) - -## [1.23.0] - 2024-11-11 - -- Add support for BLAKE2 checksums. ([#89](https://github.com/taiki-e/upload-rust-binary-action/issues/89), thanks @aartoni) - -## [1.22.1] - 2024-10-19 - -- Fix failure when cross-compiling to Windows on non-Windows. ([#86](https://github.com/taiki-e/upload-rust-binary-action/issues/86)) - -## [1.22.0] - 2024-08-12 - -- Add `codesign-prefix` and `codesign-options` input options. ([#81](https://github.com/taiki-e/upload-rust-binary-action/pull/81), thanks @matiaskorhonen) - -## [1.21.1] - 2024-07-12 - -- Work around rustc's strip bug that mostly affects illumos build. See [#80](https://github.com/taiki-e/upload-rust-binary-action/pull/80) for details. - -## [1.21.0] - 2024-06-02 - -- Add outputs for the archive and checksum files. ([#77](https://github.com/taiki-e/upload-rust-binary-action/pull/77), thanks @matiaskorhonen) - -## [1.20.0] - 2024-04-10 - -- Add `bin-leading-dir` input option. ([#73](https://github.com/taiki-e/upload-rust-binary-action/pull/73), thanks @linrongbin16) - -## [1.19.2] - 2024-04-03 - -- Add a warning for `macos-latest` runner architecture change. ([#70](https://github.com/taiki-e/upload-rust-binary-action/pull/70)) - - > warning: GitHub Actions changed default architecture of macos-latest since macos-14; consider passing 'target' input option to clarify which target you are building for. - -## [1.19.1] - 2024-03-26 - -- Work around strip bugs in rustc and cargo. See [#69](https://github.com/taiki-e/upload-rust-binary-action/pull/69) for details. - -## [1.19.0] - 2024-03-05 - -- Align default strip behavior to [Cargo 1.77+'s default (strip=debuginfo)](https://github.com/rust-lang/cargo/pull/13257). See [#66](https://github.com/taiki-e/upload-rust-binary-action/pull/66) for details. - -## [1.18.0] - 2023-12-03 - -- Support signing with `codesign` on macOS. ([#61](https://github.com/taiki-e/upload-rust-binary-action/pull/61), thanks @doinkythederp) - -## [1.17.1] - 2023-10-23 - -- Fix error when `build-tool` is explicitly set to cargo and installation for targets is needed. ([#57](https://github.com/taiki-e/upload-rust-binary-action/pull/57), thanks @sunshowers) - -## [1.17.0] - 2023-10-09 - -- Add `dry-run` input option. ([#55](https://github.com/taiki-e/upload-rust-binary-action/pull/55)) - -- Allow "kebab-case" input option names. ([#56](https://github.com/taiki-e/upload-rust-binary-action/pull/56)) - - Previously, option names were only in "snake_case", but now both "kebab-case" and "snake_case" are available. - -## [1.16.1] - 2023-09-09 - -- Improve robustness for temporary network failures. - -## [1.16.0] - 2023-08-06 - -- Support [cargo-zigbuild](https://github.com/rust-cross/cargo-zigbuild) as build tool. ([#50](https://github.com/taiki-e/upload-rust-binary-action/pull/50)) - -## [1.15.0] - 2023-06-26 - -- Use [multi-target builds](https://blog.rust-lang.org/2022/09/22/Rust-1.64.0.html#cargo-improvements-workspace-inheritance-and-multi-target-builds) for `universal-apple-darwin` (universal macOS binary) on Rust 1.64+. This could make `universal-apple-darwin` builds up to about 2x faster. - -## [1.14.0] - 2023-05-13 - -- Add `profile` input option to allow specifying custom profiles. ([#44](https://github.com/taiki-e/upload-rust-binary-action/pull/44), thanks @afnanenayet) - -## [1.13.0] - 2023-03-22 - -- Switch to composite action ([#42](https://github.com/taiki-e/upload-rust-binary-action/pull/42)) - -## [1.12.1] - 2023-03-19 - -- Diagnostics improvements. - -## [1.12.0] - 2023-01-10 - -- Support universal macOS binary as `target: universal-apple-darwin`. ([#38](https://github.com/taiki-e/upload-rust-binary-action/pull/38)) - -## [1.11.1] - 2022-12-28 - -- Fix installation of cross. - -- Improve support for stripping. - -## [1.11.0] - 2022-12-03 - -- Skip stripping by this action if cargo's [`strip` profile option](https://doc.rust-lang.org/cargo/reference/profiles.html#strip) is set. - -- Diagnostics improvements. - -## [1.10.0] - 2022-10-28 - -- Add `manifest_path` input option. ([#32](https://github.com/taiki-e/upload-rust-binary-action/pull/32), thanks @GeorgeHahn) - -## [1.9.1] - 2022-09-16 - -- Fix "command not found" error when `checksum` input option is passed on macOS. ([#30](https://github.com/taiki-e/upload-rust-binary-action/pull/30)) - -## [1.9.0] - 2022-09-08 - -- Add `token` input option to use the specified token instead of `GITHUB_TOKEN` environment variable. - -- Add `ref` input option to use the specified tag ref instead of `GITHUB_REF` environment variable. - -## [1.8.0] - 2022-08-28 - -- Add `no_default_features` input option. ([#28](https://github.com/taiki-e/upload-rust-binary-action/pull/28), thanks @samtay) - -## [1.7.2] - 2022-07-08 - -- Fix regression introduced in 1.7.0. - -## [1.7.1] - 2022-07-08 - -- Fix "no such file" error when `target` input option is passed. - -## [1.7.0] - 2022-07-07 - -- Add `asset` input option to upload additional files separately. ([#23](https://github.com/taiki-e/upload-rust-binary-action/pull/23)) - -- `--target` flag no longer passed to cargo when `target` input option is not specified. - -## [1.6.1] - 2022-07-06 - -- Fix unbound variable error on macOS. - -## [1.6.0] - 2022-07-05 - -- Support building and uploading multiple binaries at the same step. ([#18](https://github.com/taiki-e/upload-rust-binary-action/pull/18)) - -- Add `checksum` input option to upload checksum. ([#21](https://github.com/taiki-e/upload-rust-binary-action/pull/21)) - -- Add `build_tool` input option to specify the tool to build binaries. ([#20](https://github.com/taiki-e/upload-rust-binary-action/pull/20)) - -## [1.5.0] - 2022-07-05 - -- Add `include` input option to include additional files to the archive. ([#17](https://github.com/taiki-e/upload-rust-binary-action/pull/17)) - -## [1.4.0] - 2022-06-08 - -- Respect host cross-compilation setup. ([#16](https://github.com/taiki-e/upload-rust-binary-action/pull/16)) - -## [1.3.0] - 2022-05-01 - -- Update default runtime to node16. - -## [1.2.0] - 2021-12-30 - -- Skip the installation of `cross` if it is already installed. - - Previously, on Linux, if the target is different from the host and `cross` supports the target, `cross` was always installed. - -## [1.1.0] - 2021-09-29 - -- Add `features` input option. ([#7](https://github.com/taiki-e/upload-rust-binary-action/pull/7), thanks @ririsoft) - -- Fix strip error on non-x86 targets. ([#9](https://github.com/taiki-e/upload-rust-binary-action/pull/9)) - -## [1.0.2] - 2021-02-28 - -- Documentation improvements. - -## [1.0.1] - 2021-02-12 - -- Pass `--noprofile` and `--norc` options to bash. - -## [1.0.0] - 2021-02-03 - -Initial release - -[Unreleased]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.2...HEAD -[1.30.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.1...v1.30.2 -[1.30.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.30.0...v1.30.1 -[1.30.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.29.1...v1.30.0 -[1.29.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.29.0...v1.29.1 -[1.29.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.28.1...v1.29.0 -[1.28.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.28.0...v1.28.1 -[1.28.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.27.0...v1.28.0 -[1.27.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.26.0...v1.27.0 -[1.26.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.25.0...v1.26.0 -[1.25.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.24.0...v1.25.0 -[1.24.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.23.0...v1.24.0 -[1.23.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.22.1...v1.23.0 -[1.22.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.22.0...v1.22.1 -[1.22.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.21.1...v1.22.0 -[1.21.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.21.0...v1.21.1 -[1.21.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.20.0...v1.21.0 -[1.20.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.2...v1.20.0 -[1.19.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.1...v1.19.2 -[1.19.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.19.0...v1.19.1 -[1.19.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.18.0...v1.19.0 -[1.18.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.17.1...v1.18.0 -[1.17.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.17.0...v1.17.1 -[1.17.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.16.1...v1.17.0 -[1.16.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.16.0...v1.16.1 -[1.16.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.15.0...v1.16.0 -[1.15.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.14.0...v1.15.0 -[1.14.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.13.0...v1.14.0 -[1.13.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.12.1...v1.13.0 -[1.12.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.12.0...v1.12.1 -[1.12.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.11.1...v1.12.0 -[1.11.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.11.0...v1.11.1 -[1.11.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.10.0...v1.11.0 -[1.10.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.9.1...v1.10.0 -[1.9.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.9.0...v1.9.1 -[1.9.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.8.0...v1.9.0 -[1.8.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.2...v1.8.0 -[1.7.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.1...v1.7.2 -[1.7.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.7.0...v1.7.1 -[1.7.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.6.1...v1.7.0 -[1.6.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.6.0...v1.6.1 -[1.6.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.5.0...v1.6.0 -[1.5.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.4.0...v1.5.0 -[1.4.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.3.0...v1.4.0 -[1.3.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.2.0...v1.3.0 -[1.2.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.1.0...v1.2.0 -[1.1.0]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.2...v1.1.0 -[1.0.2]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.1...v1.0.2 -[1.0.1]: https://github.com/taiki-e/upload-rust-binary-action/compare/v1.0.0...v1.0.1 -[1.0.0]: https://github.com/taiki-e/upload-rust-binary-action/releases/tag/v1.0.0 diff --git a/LICENSE-APACHE b/LICENSE-APACHE deleted file mode 100644 index f433b1a..0000000 --- a/LICENSE-APACHE +++ /dev/null @@ -1,177 +0,0 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS diff --git a/LICENSE-MIT b/LICENSE-MIT deleted file mode 100644 index 31aa793..0000000 --- a/LICENSE-MIT +++ /dev/null @@ -1,23 +0,0 @@ -Permission is hereby granted, free of charge, to any -person obtaining a copy of this software and associated -documentation files (the "Software"), to deal in the -Software without restriction, including without -limitation the rights to use, copy, modify, merge, -publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software -is furnished to do so, subject to the following -conditions: - -The above copyright notice and this permission notice -shall be included in all copies or substantial portions -of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF -ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED -TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A -PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT -SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR -IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md index 7e7de5e..e2ef07c 100644 --- a/README.md +++ b/README.md @@ -19,12 +19,10 @@ GitHub Action for building and uploading Rust binary to GitHub Releases. - [setup-cross-toolchain-action](#setup-cross-toolchain-action) - [cargo-zigbuild](#cargo-zigbuild) - [Example workflow: Include additional files](#example-workflow-include-additional-files) - - [Other examples](#other-examples) - [Optimize Rust binary](#optimize-rust-binary) - [Supported events](#supported-events) - [Security](#security) - [Compatibility](#compatibility) -- [Related Projects](#related-projects) - [License](#license) ## Usage @@ -110,7 +108,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -122,7 +120,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -173,7 +171,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -194,7 +192,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -240,7 +238,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -252,7 +250,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: bin: ... @@ -288,7 +286,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -310,7 +308,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -355,7 +353,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -381,7 +379,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -413,7 +411,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -436,9 +434,9 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Install cross-compilation tools - uses: taiki-e/setup-cross-toolchain-action@v1 + uses: step-security/setup-cross-toolchain-action@v1 with: target: ${{ matrix.target }} runner: none # Skip installation of cross-testing related tools because we only do cross-compilation. @@ -475,7 +473,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) @@ -500,7 +498,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) @@ -532,7 +530,7 @@ jobs: permissions: contents: write # for taiki-e/create-gh-release-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: taiki-e/create-gh-release-action@v1 with: # (optional) Path to changelog. @@ -544,7 +542,7 @@ jobs: permissions: contents: write # for step-security/upload-rust-binary-action steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -619,7 +617,7 @@ If you want upload additional file *separately*, you can use the `asset` option. upload-assets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: step-security/upload-rust-binary-action@v1 with: # (required) Binary names (non-extension portion of filename) to build and upload (whitespace or comma separated list). @@ -638,11 +636,6 @@ LICENSE README.md ``` -### Other examples - -- [cargo-hack](https://github.com/taiki-e/cargo-hack/blob/202e6e59d491c9202ce148c9ef423853267226db/.github/workflows/release.yml#L47-L84) -- [tokio-console](https://github.com/tokio-rs/console/blob/9699300ec7901b71dce0d3555a7be2c86ec4e533/.github/workflows/release.yaml#L28-L43) - ### Optimize Rust binary You can optimize performance or size of Rust binaries by passing the profile options. @@ -748,22 +741,6 @@ To use this action in self-hosted runners or in containers, at least the followi Note that what this action installs for its setup (such as above tools) is considered an implementation detail if they are installed by this action's side, and there is no guarantee that they will be available in subsequent steps, because this action is not an action for installing those tools. -## Related Projects - -- [create-gh-release-action]: GitHub Action for creating GitHub Releases based on changelog. -- [setup-cross-toolchain-action]: GitHub Action for setup toolchains for cross compilation and cross testing for Rust. -- [install-action]: GitHub Action for installing development tools. -- [cache-cargo-install-action]: GitHub Action for `cargo install` with cache. -- [checkout-action]: GitHub Action for checking out a repository. (Simplified actions/checkout alternative that does not depend on Node.js.) - -[cache-cargo-install-action]: https://github.com/taiki-e/cache-cargo-install-action -[cargo-zigbuild]: https://github.com/rust-cross/cargo-zigbuild -[checkout-action]: https://github.com/taiki-e/checkout-action -[create-gh-release-action]: https://github.com/taiki-e/create-gh-release-action -[cross]: https://github.com/cross-rs/cross -[install-action]: https://github.com/taiki-e/install-action -[setup-cross-toolchain-action]: https://github.com/taiki-e/setup-cross-toolchain-action - ## License Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or diff --git a/action.yml b/action.yml index 5050f88..6ee5835 100644 --- a/action.yml +++ b/action.yml @@ -173,6 +173,50 @@ outputs: runs: using: composite steps: + - name: Subscription check + env: + REPO_PRIVATE: ${{ github.event.repository.private }} + run: | + # validate subscription status + UPSTREAM="taiki-e/upload-rust-binary-action" + ACTION_REPO="${GITHUB_ACTION_REPOSITORY:-}" + DOCS_URL="https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions" + + echo "" + echo -e "\033[1;36mStepSecurity Maintained Action\033[0m" + echo "Secure drop-in replacement for $UPSTREAM" + if [ "$REPO_PRIVATE" = "false" ]; then + echo -e "\033[32m✓ Free for public repositories\033[0m" + fi + echo -e "\033[36mLearn more:\033[0m $DOCS_URL" + echo "" + + if [ "$REPO_PRIVATE" != "false" ]; then + SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}" + + if [ "$SERVER_URL" != "https://github.com" ]; then + BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL") + else + BODY=$(printf '{"action":"%s"}' "$ACTION_REPO") + fi + + API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription" + + RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \ + -X POST \ + -H "Content-Type: application/json" \ + -d "$BODY" \ + "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$? + + if [ $CURL_EXIT_CODE -ne 0 ]; then + echo "Timeout or API not reachable. Continuing to next step." + elif [ "$RESPONSE" = "403" ]; then + echo -e "::error::\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m" + echo -e "::error::\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m" + exit 1 + fi + fi + shell: bash - id: upload-rust-binary-action run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh" shell: bash From a5419b31d46a82bf88bc6b7a4b5f35bf6159071d Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 15:28:03 +0530 Subject: [PATCH 3/6] tidy related changes removed --- .cspell.json | 52 --------- .github/.cspell/project-dictionary.txt | 3 - .github/.cspell/rust-dependencies.txt | 2 - .github/workflows/ci.yml | 7 -- .github/zizmor.yml | 6 -- .markdownlint-cli2.yaml | 11 -- .shellcheckrc | 38 ------- tools/.tidy-check-license-headers | 1 - tools/tidy.sh | 143 ------------------------- 9 files changed, 263 deletions(-) delete mode 100644 .cspell.json delete mode 100644 .github/.cspell/project-dictionary.txt delete mode 100644 .github/.cspell/rust-dependencies.txt delete mode 100644 .github/zizmor.yml delete mode 100644 .markdownlint-cli2.yaml delete mode 100644 .shellcheckrc delete mode 100644 tools/.tidy-check-license-headers delete mode 100755 tools/tidy.sh diff --git a/.cspell.json b/.cspell.json deleted file mode 100644 index 860713a..0000000 --- a/.cspell.json +++ /dev/null @@ -1,52 +0,0 @@ -{ - "version": "0.2", - "gitignoreRoot": ".", - "useGitignore": true, - "dictionaryDefinitions": [ - { - "name": "organization-dictionary", - "path": "https://raw.githubusercontent.com/taiki-e/github-actions/HEAD/.github/.cspell/organization-dictionary.txt", - "addWords": true - }, - { - "name": "project-dictionary", - "path": "./.github/.cspell/project-dictionary.txt", - "addWords": true - }, - { - "name": "rust-dependencies", - "path": "./.github/.cspell/rust-dependencies.txt", - "addWords": true - } - ], - "dictionaries": [ - "organization-dictionary", - "project-dictionary", - "rust-dependencies" - ], - "ignoreRegExpList": [ - // Copyright notice - "Copyright .*", - "SPDX-(File|Snippet)CopyrightText: .*", - // GHA actions/workflows - "uses: .+@[\\w_.-]+", - // GHA context (repo name, owner name, etc.) - "github.[\\w_.-]+ (=|!)= '[^']+'", - // GH username - "( |\\[)@[\\w_-]+", - // Git config username - "git config( --[^ ]+)? user.name .*", - // Username in TODO|FIXME comment - "(TODO|FIXME)\\([\\w_., -]+\\)", - // Cargo.toml authors - "authors *= *\\[[^\\]]*\\]", - "\"[^\"]* <[\\w_.+-]+@[\\w.-]+>\"" - ], - "languageSettings": [ - { - "languageId": ["*"], - "dictionaries": ["bash", "cpp-refined", "rust"] - } - ], - "ignorePaths": [] -} diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt deleted file mode 100644 index 3cfb7d5..0000000 --- a/.github/.cspell/project-dictionary.txt +++ /dev/null @@ -1,3 +0,0 @@ -codesign -coreutils -lipo diff --git a/.github/.cspell/rust-dependencies.txt b/.github/.cspell/rust-dependencies.txt deleted file mode 100644 index a500d2c..0000000 --- a/.github/.cspell/rust-dependencies.txt +++ /dev/null @@ -1,2 +0,0 @@ -# This file is @generated by tidy.sh. -# It is not intended for manual editing. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e43ea1a..250f614 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,15 +27,9 @@ concurrency: cancel-in-progress: true jobs: - tidy: - uses: taiki-e/github-actions/.github/workflows/tidy.yml@2026.8.8 - permissions: - security-events: write # for github/codeql-action/* - # TODO: test container test: if: github.actor != 'dependabot[bot]' - needs: tidy strategy: fail-fast: false matrix: @@ -155,7 +149,6 @@ jobs: test-dependabot: if: github.actor == 'dependabot[bot]' - needs: tidy runs-on: ubuntu-24.04 timeout-minutes: 60 steps: diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index ab5c01c..0000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,6 +0,0 @@ -# zizmor configuration -# https://docs.zizmor.sh/configuration/ - -rules: - anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant. - dependabot-cooldown: { config: { days: 14 } } diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml deleted file mode 100644 index 9f27f0b..0000000 --- a/.markdownlint-cli2.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# https://github.com/DavidAnson/markdownlint/blob/HEAD/doc/Rules.md -config: - line-length: false # MD013 - no-duplicate-heading: false # MD024 - no-blanks-blockquote: false # MD028 (this warns valid GFM alerts usage) - no-inline-html: false # MD033 - no-emphasis-as-heading: false # MD036 - -# https://github.com/DavidAnson/markdownlint-cli2#markdownlint-cli2jsonc -noBanner: true -noProgress: true diff --git a/.shellcheckrc b/.shellcheckrc deleted file mode 100644 index 54bdb7b..0000000 --- a/.shellcheckrc +++ /dev/null @@ -1,38 +0,0 @@ -# ShellCheck configuration -# https://github.com/koalaman/shellcheck/blob/HEAD/shellcheck.1.md#rc-files - -# See also: -# https://github.com/koalaman/shellcheck/wiki/Optional -# https://google.github.io/styleguide/shellguide.html - -# https://github.com/koalaman/shellcheck/wiki/Directive#external-sources -external-sources=true - -# https://github.com/koalaman/shellcheck/wiki/SC2249 -# enable=add-default-case - -# https://github.com/koalaman/shellcheck/wiki/SC2244 -enable=avoid-nullary-conditions - -# https://github.com/koalaman/shellcheck/wiki/SC2312 -# enable=check-extra-masked-returns - -# https://github.com/koalaman/shellcheck/wiki/SC2310 -# https://github.com/koalaman/shellcheck/wiki/SC2311 -# enable=check-set-e-suppressed - -# enable=check-unassigned-uppercase - -# https://github.com/koalaman/shellcheck/wiki/SC2230 -enable=deprecate-which - -# https://github.com/koalaman/shellcheck/wiki/SC2248 -enable=quote-safe-variables - -# https://github.com/koalaman/shellcheck/wiki/SC2292 -# https://google.github.io/styleguide/shellguide.html#s6.3-tests -enable=require-double-brackets - -# https://github.com/koalaman/shellcheck/wiki/SC2250 -# https://google.github.io/styleguide/shellguide.html#s5.6-variable-expansion -enable=require-variable-braces diff --git a/tools/.tidy-check-license-headers b/tools/.tidy-check-license-headers deleted file mode 100644 index 46c7417..0000000 --- a/tools/.tidy-check-license-headers +++ /dev/null @@ -1 +0,0 @@ -git ls-files diff --git a/tools/tidy.sh b/tools/tidy.sh deleted file mode 100755 index 2796be0..0000000 --- a/tools/tidy.sh +++ /dev/null @@ -1,143 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: Apache-2.0 OR MIT -set -CeEuo pipefail -IFS=$'\n\t' -trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT -cd -- "$(dirname -- "$0")"/.. - -# USAGE: -# GITHUB_TOKEN=$(gh auth token) ./tools/tidy.sh -# -# Note: This script requires the following tools: -# - docker or podman (or compatible CLI specified by TIDY_DOCKER_PATH. when both available and TIDY_DOCKER_PATH is not set, docker is preferred) -# -# This script is shared by projects under github.com/taiki-e, so there may also -# be checks for files not included in this repository, but they will be skipped -# if the corresponding files do not exist. -# It is not intended for manual editing. - -bail() { - if [[ -n "${GITHUB_ACTIONS:-}" ]]; then - printf '::error::%s\n' "$*" - else - printf >&2 'error: %s\n' "$*" - fi - exit 1 -} - -if [[ $# -gt 0 ]]; then - cat <"${tmp}"/dummy -code=0 -color='' -if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then - color=1 -fi -# Refs: -# - https://docs.docker.com/reference/cli/docker/container/run/ -# - https://docs.podman.io/en/latest/markdown/podman-run.1.html -# - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html -common_args=( - run --rm --init - --cap-drop=all - --security-opt=no-new-privileges - --read-only - --env GITHUB_ACTIONS - --env CI - --env CARGO_TERM_COLOR - --env REMOVE_UNUSED_WORDS - --env TIDY_COLOR_ALWAYS="${color}" - --env TIDY_CALLER="$0" - --env TIDY_EXPECTED_MARKDOWN_FILE_COUNT - --env TIDY_EXPECTED_RUST_FILE_COUNT - --env TIDY_EXPECTED_CLANG_FORMAT_FILE_COUNT - --env TIDY_EXPECTED_PRETTIER_FILE_COUNT - --env TIDY_EXPECTED_TOML_FILE_COUNT - --env TIDY_EXPECTED_SHELL_FILE_COUNT - --env TIDY_EXPECTED_DOCKER_FILE_COUNT -) -if [[ -n "${TIDY_DOCKER_PATH:-}" ]]; then - docker="${TIDY_DOCKER_PATH}" -elif type -P docker >/dev/null; then - docker='docker' -elif type -P podman >/dev/null; then - docker='podman' -else - bail 'this script requires docker or podman' -fi -rootless='' -if [[ "$("${docker}" --version)" == *'podman'* ]]; then - if [[ "$("${docker}" info)" == *'rootless: true'* ]]; then - rootless=1 - fi -elif [[ "$("${docker}" info -f '{{println .SecurityOptions}}')" == *'rootless'* ]]; then - rootless=1 -fi -if [[ -n "${rootless}" ]]; then - printf 'docker path: %s\n' "${docker} (rootless)" -else - printf 'docker path: %s\n' "${docker}" - common_args+=(--user "${user}") -fi - -# Map ignored files (e.g., .env) to dummy files. -while IFS= read -r path; do - if [[ -d "${path}" ]]; then - common_args+=( - --mount "type=bind,source=${tmp}/dummy-dir,target=${workdir}/${path},readonly" - ) - else - common_args+=( - --mount "type=bind,source=${tmp}/dummy,target=${workdir}/${path},readonly" - ) - fi -done < <(git status --porcelain --ignored | grep -E '^!!' | cut -d' ' -f2) - -docker_run() { - local script="$1" - shift - "${docker}" "${common_args[@]}" "$@" "${image}" /checks/"${script}" - code2="$?" - if [[ ${code} -eq 0 ]] && [[ ${code2} -ne 0 ]]; then - code="${code2}" - fi -} - -set +e -docker_run offline.sh \ - --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \ - --mount "type=bind,source=${workdir}/.git,target=${workdir}/.git,readonly" \ - --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \ - --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \ - --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \ - --network=none -# Some good audits requires access to GitHub API. -docker_run zizmor.sh \ - --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \ - --mount "type=bind,source=${tmp}/zizmor-cache,target=/.cache/zizmor" \ - --env GH_TOKEN --env GITHUB_TOKEN --env ZIZMOR_GITHUB_TOKEN -# We use remote dictionary. -docker_run cspell.sh \ - --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \ - --mount "type=bind,source=${workdir}/.github/.cspell/project-dictionary.txt,target=${workdir}/.github/.cspell/project-dictionary.txt" \ - --mount "type=bind,source=${workdir}/.github/.cspell/rust-dependencies.txt,target=${workdir}/.github/.cspell/rust-dependencies.txt" \ - --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" - -exit "${code}" From a20e704755b8e7ad016ff38eae21b29d6d942fb9 Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 15:58:35 +0530 Subject: [PATCH 4/6] readme updated --- README.md | 7 +------ action.yml | 2 +- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index e2ef07c..f9ff1de 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ # upload-rust-binary-action [![release](https://img.shields.io/github/release/step-security/upload-rust-binary-action?style=flat-square&logo=github)](https://github.com/step-security/upload-rust-binary-action/releases/latest) -[![github actions](https://img.shields.io/github/actions/workflow/status/step-security/upload-rust-binary-action/ci.yml?branch=main&style=flat-square&logo=github)](https://github.com/step-security/upload-rust-binary-action/actions) GitHub Action for building and uploading Rust binary to GitHub Releases. @@ -743,9 +742,5 @@ Note that what this action installs for its setup (such as above tools) is consi ## License -Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or -[MIT license](LICENSE-MIT) at your option. +Licensed under [MIT license](LICENSE) -Unless you explicitly state otherwise, any contribution intentionally submitted -for inclusion in the work by you, as defined in the Apache-2.0 license, shall -be dual licensed as above, without any additional terms or conditions. diff --git a/action.yml b/action.yml index 6ee5835..472f56a 100644 --- a/action.yml +++ b/action.yml @@ -115,7 +115,7 @@ inputs: required: false dry-run-intended: description: > - Suppress informational warnings for `dru-run` keeping the rest + Suppress informational warnings for `dry-run` keeping the rest required: false default: 'false' dry_run: From 02a6b5958a04e1c26d11dabf1965cc7fe7313baf Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 17:23:13 +0530 Subject: [PATCH 5/6] comments addressed --- .gitignore | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 .gitignore diff --git a/.gitignore b/.gitignore deleted file mode 100644 index e69de29..0000000 From 919ca50c51065e992b8a5a0b31809315d1d2ab44 Mon Sep 17 00:00:00 2001 From: Raj-StepSecurity Date: Mon, 10 Aug 2026 17:25:13 +0530 Subject: [PATCH 6/6] main branch replacement for setup-cross-toolchain-action --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 250f614..504de96 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -80,7 +80,7 @@ jobs: with: tool: rust@stable fallback: none - - uses: step-security/setup-cross-toolchain-action@release # replace post release + - uses: step-security/setup-cross-toolchain-action@main # main post release with: target: ${{ matrix.target }} runner: none