feat: onboarding upload-rust-binary-action

.github/workflows/actions_release.yml

@@ -0,0 +1,22 @@
+name: Release GitHub Actions
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag for the release"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
+    with:
+      tag: "${{ github.event.inputs.tag }}"

.github/workflows/auto_cherry_pick.yml

@@ -0,0 +1,37 @@
+name: Auto Cherry-Pick from Upstream
+
+on:
+  workflow_run:
+    workflows: [ "Release GitHub Actions" ]
+    types:
+      - completed
+
+  workflow_dispatch:
+    inputs:
+      base_branch:
+        description: "Base branch to create the PR against"
+        required: true
+        default: "main"
+      mode:
+        description: "Run mode: cherry-pick or verify"
+        required: false
+        default: "cherry-pick"
+
+  pull_request:
+    types: [ opened, synchronize, labeled ]
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write
+
+jobs:
+  cherry-pick:
+    if: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required')
+    uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
+    with:
+      original-owner: "taiki-e"
+      repo-name: "upload-rust-binary-action"
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode || 'cherry-pick' }}

.github/workflows/ci.yml

@@ -0,0 +1,214 @@
+name: CI
+
+permissions: {}
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+  CARGO_NET_RETRY: 10
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  RUSTFLAGS: -D warnings
+  RUSTUP_MAX_RETRIES: 10
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  # TODO: test container
+  test:
+    if: github.actor != 'dependabot[bot]'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+          - os: ubuntu-24.04-arm
+          - os: ubuntu-24.04
+            target: aarch64-unknown-linux-gnu
+            package: test-crate
+          - os: ubuntu-24.04
+            target: aarch64-unknown-linux-gnu
+            build-tool: cargo
+            package: test-crate,test-crate
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu.2.17
+            build-tool: cargo-zigbuild
+          - os: macos-latest
+            checksums: sha256,sha512,sha1,md5
+          - os: macos-latest
+            checksums: |
+              sha256
+              sha512
+              sha1
+              md5
+            target: x86_64-apple-darwin
+            workspace: true
+          - os: macos-latest
+            checksums: sha256 sha512 sha1 md5
+            target: aarch64-apple-darwin
+          - os: macos-latest
+            checksums: sha256, sha512, sha1, md5
+            target: universal-apple-darwin
+          - os: macos-latest
+            checksums: sha256,sha512,sha1,md5
+            target: universal-apple-darwin
+            build-tool: cargo
+          - os: windows-latest
+          - os: windows-latest
+            target: x86_64-pc-windows-gnu
+          - os: windows-latest
+            target: aarch64-pc-windows-msvc
+          - os: windows-11-arm
+    runs-on: ${{ matrix.os || 'ubuntu-24.04' }}
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: rust@stable
+          fallback: none
+      - uses: step-security/setup-cross-toolchain-action@main # main post release
+        with:
+          target: ${{ matrix.target }}
+          runner: none
+        if: matrix.target != '' && matrix.build-tool == 'cargo'
+      - run: cargo new --bin test-crate
+      - uses: ./
+        id: upload-rust-binary-action
+        with:
+          dry-run: true
+          bin: test-crate
+          target: ${{ matrix.target }}
+          build-tool: ${{ matrix.build-tool }}
+          no-default-features: true
+          all-features: true
+          package: ${{ matrix.package }}
+          workspace: ${{ matrix.workspace || 'false' }}
+          checksum: ${{ matrix.checksums || 'b2,sha256,sha512,sha1,md5' }}
+          tar: all
+          tar-xz: all
+          zip: all
+          manifest-path: test-crate/Cargo.toml
+          codesign: '-'
+          codesign-prefix: 'com.example.'
+          codesign-options: 'runtime'
+      - name: Check action outputs
+        run: |
+          printf 'outputs.archive should not be empty\n'
+          test -n "${OUTPUT_ARCHIVE}"
+
+          printf 'outputs.zip should be a file\n'
+          test -f "${OUTPUT_ZIP}"
+
+          printf 'outputs.tar should be a file\n'
+          test -f "${OUTPUT_TAR}"
+
+          printf 'outputs.tar-xz should be a file\n'
+          test -f "${OUTPUT_TAR_XZ}"
+
+          printf 'outputs.sha256 should be a file\n'
+          test -f "${OUTPUT_SHA256}"
+
+          printf 'outputs.sha512 should be a file\n'
+          test -f "${OUTPUT_SHA512}"
+
+          printf 'outputs.sha1 should be a file\n'
+          test -f "${OUTPUT_SHA1}"
+
+          printf 'outputs.md5 should be a file\n'
+          test -f "${OUTPUT_MD5}"
+        env:
+          OUTPUT_ARCHIVE: ${{ steps.upload-rust-binary-action.outputs.archive }}
+          OUTPUT_ZIP: ${{ steps.upload-rust-binary-action.outputs.zip }}
+          OUTPUT_TAR: ${{ steps.upload-rust-binary-action.outputs.tar }}
+          OUTPUT_TAR_XZ: ${{ steps.upload-rust-binary-action.outputs.tar-xz }}
+          OUTPUT_SHA256: ${{ steps.upload-rust-binary-action.outputs.sha256 }}
+          OUTPUT_SHA512: ${{ steps.upload-rust-binary-action.outputs.sha512 }}
+          OUTPUT_SHA1: ${{ steps.upload-rust-binary-action.outputs.sha1 }}
+          OUTPUT_MD5: ${{ steps.upload-rust-binary-action.outputs.md5 }}
+      - name: Check b2 output
+        if: ${{ contains(matrix.checksums || 'b2,sha256,sha512,sha1,md5', 'b2') }}
+        run: |
+          printf 'outputs.b2 should not be empty\n'
+          test -n "${OUTPUT_B2}"
+        env:
+          OUTPUT_B2: ${{ steps.upload-rust-binary-action.outputs.b2 }}
+
+  test-dependabot:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: rust@stable
+          fallback: none
+      - run: cargo new --bin test-crate
+      - uses: ./
+        id: upload-rust-binary-action
+        with:
+          dry-run: true
+          bin: test-crate
+          workspace: 'false'
+          checksum: 'b2,sha256,sha512,sha1,md5'
+          tar: all
+          tar-xz: all
+          zip: all
+          manifest-path: test-crate/Cargo.toml
+          codesign: '-'
+          codesign-prefix: 'com.example.'
+          codesign-options: 'runtime'
+      - name: Check action outputs
+        run: |
+          printf 'outputs.archive should not be empty\n'
+          test -n "${OUTPUT_ARCHIVE}"
+
+          printf 'outputs.zip should be a file\n'
+          test -f "${OUTPUT_ZIP}"
+
+          printf 'outputs.tar should be a file\n'
+          test -f "${OUTPUT_TAR}"
+
+          printf 'outputs.tar-xz should be a file\n'
+          test -f "${OUTPUT_TAR_XZ}"
+
+          printf 'outputs.sha256 should be a file\n'
+          test -f "${OUTPUT_SHA256}"
+
+          printf 'outputs.sha512 should be a file\n'
+          test -f "${OUTPUT_SHA512}"
+
+          printf 'outputs.sha1 should be a file\n'
+          test -f "${OUTPUT_SHA1}"
+
+          printf 'outputs.md5 should be a file\n'
+          test -f "${OUTPUT_MD5}"
+        env:
+          OUTPUT_ARCHIVE: ${{ steps.upload-rust-binary-action.outputs.archive }}
+          OUTPUT_ZIP: ${{ steps.upload-rust-binary-action.outputs.zip }}
+          OUTPUT_TAR: ${{ steps.upload-rust-binary-action.outputs.tar }}
+          OUTPUT_TAR_XZ: ${{ steps.upload-rust-binary-action.outputs.tar-xz }}
+          OUTPUT_SHA256: ${{ steps.upload-rust-binary-action.outputs.sha256 }}
+          OUTPUT_SHA512: ${{ steps.upload-rust-binary-action.outputs.sha512 }}
+          OUTPUT_SHA1: ${{ steps.upload-rust-binary-action.outputs.sha1 }}
+          OUTPUT_MD5: ${{ steps.upload-rust-binary-action.outputs.md5 }}
+      - name: Check b2 output
+        run: |
+          printf 'outputs.b2 should not be empty\n'
+          test -n "${OUTPUT_B2}"
+        env:
+          OUTPUT_B2: ${{ steps.upload-rust-binary-action.outputs.b2 }}

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 StepSecurity
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.