feat(cli): #260 S3 — @hyperpolymath/affinescript compiler shim (ADR-0… #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: PMPL-1.0-or-later | |
| # | |
| # Release (ADR-019 / #260 S2). On a `v*` tag: build the AffineScript | |
| # compiler for each supported platform, attach the raw per-platform | |
| # binaries plus a single `SHA256SUMS` manifest to the GitHub Release. | |
| # Releases are the CANONICAL distribution artifact; the thin Deno/JSR | |
| # shim `@hyperpolymath/affinescript` (#260 S3) downloads + checksum- | |
| # verifies the binary named for its host triple against SHA256SUMS. | |
| # | |
| # Asset contract (ADR-019; do not rename without amending the ADR + the | |
| # shim): `affinescript-<target>` raw executables + `SHA256SUMS` | |
| # (sha256sum format: "<hex> affinescript-<target>"). Targets: | |
| # linux-x64, macos-x64, macos-arm64. windows-x64 is a tracked | |
| # follow-up (native OCaml Windows CI is flaky; #260 S2 is bounded to | |
| # the three POSIX targets). | |
| # | |
| # Asset handling uses the runner-native `gh` CLI (GITHUB_TOKEN), so no | |
| # third-party action needs SHA-pinning beyond checkout + setup-ocaml. | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| jobs: | |
| prepare: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Create the release (idempotent) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| tag="${GITHUB_REF_NAME}" | |
| if gh release view "$tag" >/dev/null 2>&1; then | |
| echo "release $tag already exists; reusing" | |
| else | |
| gh release create "$tag" --generate-notes --verify-tag --title "$tag" | |
| fi | |
| build: | |
| needs: prepare | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| target: linux-x64 | |
| - os: macos-13 | |
| target: macos-x64 | |
| - os: macos-14 | |
| target: macos-arm64 | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up OCaml | |
| uses: ocaml/setup-ocaml@e32b06a3e831ff2fbc6f08cf35be2085e3918014 # v3 | |
| with: | |
| ocaml-compiler: "5.1" | |
| - name: Install dependencies | |
| run: opam install . --deps-only --yes | |
| - name: Build release | |
| run: opam exec -- dune build --release | |
| - name: Stage the binary | |
| run: | | |
| install -m 0755 _build/default/bin/main.exe \ | |
| "affinescript-${{ matrix.target }}" | |
| - name: Upload the binary to the release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release upload "${GITHUB_REF_NAME}" \ | |
| "affinescript-${{ matrix.target }}" --clobber | |
| checksums: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Collect binaries and publish SHA256SUMS | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| tag="${GITHUB_REF_NAME}" | |
| mkdir -p dl | |
| gh release download "$tag" --dir dl --pattern 'affinescript-*' | |
| ( cd dl && sha256sum affinescript-* | sort -k2 > SHA256SUMS ) | |
| cat dl/SHA256SUMS | |
| gh release upload "$tag" dl/SHA256SUMS --clobber |