chore(release): v0.25.0 #69
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release dig-node | |
| # On a version tag (v*), build the self-contained `dig-node` service binary for | |
| # every supported OS/arch and attach them to a GitHub Release. Mirrors the | |
| # tag-driven, per-OS matrix pattern of digstore's release workflow, but the artifact | |
| # here is the plain installable binary (no Tauri installer): users download it and | |
| # run `dig-node install`. | |
| # | |
| # DUAL ASSET NAMING — every per-OS/arch binary is published under TWO names so both | |
| # downstream consumers resolve it with NO change on their side: | |
| # | |
| # * `dig-node-<ver>-<os>-<arch>[.exe]` ← the CANONICAL name the dig-installer | |
| # thin-shim PREFERS (its dig-node Repo stem is `dig-node`; see | |
| # dig-installer/src/asset.rs::select_asset + release.rs::Repo::dig_node). | |
| # * `dig-companion-<ver>-<os>-<arch>[.exe]` ← the legacy name. apt.dig.net's | |
| # packaging resolves the Linux binary by this exact template | |
| # (`dig-companion-{ver}-linux-{x64,arm64}`, ARCHIVE_BIN_PATH="" = bare binary; | |
| # see apt.dig.net/packaging/config.sh::PKG_dig_node_ASSET_TEMPLATE) and the | |
| # installer keeps it as its pre-rename fallback (Repo::dig_node_legacy). | |
| # | |
| # The binary itself is identical; only the filename differs. The repo + Cargo binary | |
| # were renamed dig-companion → dig-node, so the build now emits `dig-node` and the | |
| # CANONICAL asset matches the produced binary; the legacy `dig-companion-*` asset is | |
| # still published (a copy of the same bytes) so apt.dig.net + the installer fallback | |
| # keep resolving byte-exact across the rename without editing the consumer repos. | |
| # | |
| # Per OS/arch (each emitted under both stems above): | |
| # * windows-x64 (x86_64-pc-windows-msvc, windows-latest) | |
| # * linux-x64 (x86_64-unknown-linux-gnu, ubuntu-latest) | |
| # * macos-arm64 (aarch64-apple-darwin, macos-14) | |
| # * macos-x64 (x86_64-apple-darwin, macos-14, cross-compiled — see below) | |
| # | |
| # NO linux-arm64 asset is published: the active Linux build graph pulls in | |
| # `openssl-sys` (via the Chia wallet SDK `datalayer-driver` + `native-tls`, NOT via | |
| # reqwest, which uses rustls here), so an aarch64-Linux cross-compile would also have | |
| # to cross-compile OpenSSL — fragile and slow. No consumer requests it today: the | |
| # dig-installer's Linux os_arch_tokens are x64-only and it REJECTS an `arm64`/ | |
| # `aarch64` token as a competing arch, and apt.dig.net treats arm64 as best-effort | |
| # (build-deb.sh resolves the asset, finds none, and SKIPS arm64 non-fatally). Revisit | |
| # if/when an arm64-Linux consumer appears (would need vendored/cross OpenSSL). | |
| # | |
| # A push to main also builds (no publish) so a broken build is caught before tagging. | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| branches: [main] | |
| paths: | |
| - "src/**" | |
| - "tests/**" | |
| - "build.rs" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".github/workflows/release.yml" | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" | |
| # ENOSPC guard (digstore CI lesson): the workspace now compiles the full P2P stack | |
| # (dig-nat/gossip/dht/pex/download) + wasmtime/cranelift (via digstore-host/-stage) + | |
| # the chia wallet SDK, whose debug symbols blow the runner disk. Strip debuginfo from | |
| # dev + test builds and keep it out of release binaries, so a full workspace | |
| # test/build fits the CI disk. | |
| CARGO_PROFILE_DEV_DEBUG: "0" | |
| CARGO_PROFILE_TEST_DEBUG: "0" | |
| CARGO_PROFILE_RELEASE_DEBUG: "0" | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Gate: fmt + clippy + tests on Linux, once. A tag that doesn't pass the gate | |
| # never produces release binaries. | |
| # --------------------------------------------------------------------------- | |
| check: | |
| name: fmt + clippy + test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust (stable + components) | |
| run: | | |
| rustup toolchain install stable --component rustfmt --component clippy | |
| rustup default stable | |
| rustc --version | |
| - uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ runner.os }}-companion-check-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-companion-check- | |
| - run: cargo fmt --all --check | |
| - run: cargo clippy --all-targets --locked -- -D warnings | |
| - run: cargo test --locked | |
| # --------------------------------------------------------------------------- | |
| # Build the binary per OS/arch. | |
| # --------------------------------------------------------------------------- | |
| build: | |
| name: build (${{ matrix.out_name }}) | |
| needs: check | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| bin: dig-node.exe | |
| out_name: windows-x64.exe | |
| - os: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| bin: dig-node | |
| out_name: linux-x64 | |
| # Both macOS arches build on the fast Apple-silicon macos-14 runner. | |
| # The Intel binary is CROSS-COMPILED there (host arm64 → target | |
| # x86_64-apple-darwin) rather than on a native macos-13 (Intel) | |
| # runner: that Intel runner pool is chronically backlogged, so the | |
| # macos-x64 job used to hang for hours (pending, never failing) and | |
| # the release never completed. Cross-compiling needs no extra | |
| # toolchain here — Apple's clang (Xcode on macos-14) targets both | |
| # arches, the build steps are already `--target`-parameterized, and | |
| # the only C/asm dependency in the macOS build graph is `ring` (via | |
| # rustls), which the Apple toolchain assembles for x86_64 natively. | |
| # `openssl-sys` is cfg-gated to non-Apple targets, so it is NOT in | |
| # the macOS graph at all (TLS on macOS resolves to native-tls → | |
| # Security.framework); there is no vendored-openssl cross-compile to | |
| # worry about. Artifact names are unchanged so the dig-installer | |
| # thin-shim + apt asset matchers still resolve them. | |
| - os: macos-14 # Apple silicon (arm64) | |
| target: aarch64-apple-darwin | |
| bin: dig-node | |
| out_name: macos-arm64 | |
| - os: macos-14 # Apple silicon — cross-compiles the Intel binary | |
| target: x86_64-apple-darwin | |
| bin: dig-node | |
| out_name: macos-x64 | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust + target | |
| shell: bash | |
| run: | | |
| rustup toolchain install stable | |
| rustup default stable | |
| rustup target add ${{ matrix.target }} | |
| rustc --version | |
| - uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ runner.os }}-companion-build-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-companion-build-${{ matrix.target }}- | |
| - name: Build release binary | |
| run: cargo build --release --locked --target ${{ matrix.target }} --bin dig-node | |
| - name: Stage artifact (dual-named) | |
| id: stage | |
| shell: bash | |
| run: | | |
| VER="${GITHUB_REF_NAME#v}" | |
| [ "$GITHUB_REF_TYPE" = "tag" ] || VER="g$(git rev-parse --short HEAD)" | |
| mkdir -p dist | |
| SRC="target/${{ matrix.target }}/release/${{ matrix.bin }}" | |
| test -f "$SRC" || { echo "binary not produced: $SRC"; exit 1; } | |
| # On Windows out_name already ends in .exe; on unix there is no extension. | |
| # Publish the SAME binary under both the canonical dig-node-* name (dig- | |
| # installer's preferred stem) and the legacy dig-companion-* name (apt's | |
| # template + the installer's pre-rename fallback). See the header comment. | |
| cp "$SRC" "dist/dig-node-${VER}-${{ matrix.out_name }}" | |
| cp "$SRC" "dist/dig-companion-${VER}-${{ matrix.out_name }}" | |
| echo "ver=$VER" >> "$GITHUB_OUTPUT" | |
| ls -la dist | |
| - name: Upload build artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dig-node-${{ matrix.out_name }} | |
| path: dist/* | |
| if-no-files-found: error | |
| # --------------------------------------------------------------------------- | |
| # One publish job after all builds, so there is no race to create the Release. | |
| # Only on a tag push. | |
| # --------------------------------------------------------------------------- | |
| publish: | |
| name: Publish GitHub Release | |
| needs: build | |
| if: github.ref_type == 'tag' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all build artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: Flatten | |
| run: | | |
| mkdir -p release | |
| find artifacts -type f -exec cp {} release/ \; | |
| ls -la release | |
| - name: Create / update the release and attach binaries | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: release/* | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true |