release-cd.yml

name: Continuous Deployment (Release)

on:
  push:
    tags:
      # Run on stable releases
      - "v*.*.*"
      # Run on release candidates
      - "v*.*.*-rc*"

defaults:
  run:
    shell: bash

permissions:
  contents: write
  discussions: write

env:
  BINARY_NAME: rustic
  BINARY_NIGHTLY_DIR: rustic

jobs:
  publish:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Publishing ${{ matrix.job.target }}
    runs-on: ${{ matrix.job.os }}
    strategy:
      fail-fast: false # so we upload the artifacts even if one of the jobs fails
      matrix:
        rust: [stable]
        job:
          - os: windows-latest
            os-name: windows
            target: x86_64-pc-windows-msvc
            architecture: x86_64
            binary-postfix: ".exe"
            use-cross: false
          # FIXME: `aws-lc-sys` doesn't cross compile
          # - os: windows-latest
          #   os-name: windows
          #   target: x86_64-pc-windows-gnu
          #   architecture: x86_64
          #   binary-postfix: ".exe"
          #   use-cross: false
          - os: macos-13
            os-name: macos
            target: x86_64-apple-darwin
            architecture: x86_64
            binary-postfix: ""
            use-cross: false
          - os: macos-latest
            os-name: macos
            target: aarch64-apple-darwin
            architecture: arm64
            binary-postfix: ""
            use-cross: true
          - os: ubuntu-latest
            os-name: linux
            target: x86_64-unknown-linux-gnu
            architecture: x86_64
            binary-postfix: ""
            use-cross: false
          - os: ubuntu-latest
            os-name: linux
            target: x86_64-unknown-linux-musl
            architecture: x86_64
            binary-postfix: ""
            use-cross: false
          - os: ubuntu-latest
            os-name: linux
            target: aarch64-unknown-linux-gnu
            architecture: arm64
            binary-postfix: ""
            use-cross: true
          - os: ubuntu-latest
            os-name: linux
            target: aarch64-unknown-linux-musl
            architecture: arm64
            binary-postfix: ""
            use-cross: true
          - os: ubuntu-latest
            os-name: linux
            target: i686-unknown-linux-gnu
            architecture: i686
            binary-postfix: ""
            use-cross: true
          # FIXME: `aws-lc-sys` doesn't cross compile
          # - os: ubuntu-latest
          #   os-name: netbsd
          #   target: x86_64-unknown-netbsd
          #   architecture: x86_64
          #   binary-postfix: ""
          #   use-cross: true
          # FIXME: `aws-lc-sys` doesn't cross compile
          # - os: ubuntu-latest
          #   os-name: linux
          #   target: armv7-unknown-linux-gnueabihf
          #   architecture: armv7
          #   binary-postfix: ""
          #   use-cross: true
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0 # fetch all history so that git describe works
      - name: Create binary artifact
        uses: rustic-rs/create-binary-artifact-action@main # dev
        with:
          toolchain: ${{ matrix.rust }}
          target: ${{ matrix.job.target }}
          use-cross: ${{ matrix.job.use-cross }}
          binary-postfix: ${{ matrix.job.binary-postfix }}
          os: ${{ runner.os }}
          binary-name: ${{ env.BINARY_NAME }}
          package-secondary-name: ${{ matrix.job.target}}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          gpg-release-private-key: ${{ secrets.GPG_RELEASE_PRIVATE_KEY }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
          rsign-release-private-key: ${{ secrets.RSIGN_RELEASE_PRIVATE_KEY }}
          rsign-passphrase: ${{ secrets.RSIGN_PASSPHRASE }}
          github-ref: ${{ github.ref }}
          sign-release: true
          hash-release: true
          use-project-version: true
          use-tag-version: true # IMPORTANT: this is being used to make sure the tag that is built is in the archive filename, so automation can download the correct version

  create-release:
    name: Creating release with artifacts
    needs: publish
    runs-on: ubuntu-latest
    steps:
      # Need to clone the repo again for the CHANGELOG.md
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0 # fetch all history so that git describe works

      - name: Download all workflow run artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4

      - name: Creating Release
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2
        with:
          discussion_category_name: "Announcements"
          draft: true
          body_path: ${{ github.workspace }}/CHANGELOG.md
          fail_on_unmatched_files: true
          files: |
            binary-*/${{ env.BINARY_NAME }}-*.tar.gz*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  result:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Result (Release CD)
    runs-on: ubuntu-latest
    needs:
      - publish
      - create-release
    steps:
      - name: Mark the job as successful
        run: exit 0
        if: success()
      - name: Mark the job as unsuccessful
        run: exit 1
        if: "!success()"