Add changelog entry for version 0.10.2 #24

Workflow file for this run

.github/workflows/release.yml at ffed47b

	name: Release

	on:
	push:
	tags:
	- 'v*'

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	contents: write

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-go@v7
	with:
	go-version-file: 'go.mod'

	- name: Build binaries
	run: \|
	mkdir -p dist
	LDFLAGS="-s -w -X main.version=${{ github.ref_name }}"
	GOOS=linux GOARCH=amd64 go build -ldflags "$LDFLAGS" -o dist/zt-linux-amd64 ./cmd/zt
	GOOS=linux GOARCH=arm64 go build -ldflags "$LDFLAGS" -o dist/zt-linux-arm64 ./cmd/zt
	GOOS=darwin GOARCH=amd64 go build -ldflags "$LDFLAGS" -o dist/zt-darwin-amd64 ./cmd/zt
	GOOS=darwin GOARCH=arm64 go build -ldflags "$LDFLAGS" -o dist/zt-darwin-arm64 ./cmd/zt
	GOOS=windows GOARCH=amd64 go build -ldflags "$LDFLAGS" -o dist/zt-windows-amd64.exe ./cmd/zt

	- name: Generate checksums
	run: \|
	cd dist
	sha256sum zt-linux-amd64 > zt-linux-amd64.sha256
	sha256sum zt-linux-arm64 > zt-linux-arm64.sha256
	sha256sum zt-darwin-amd64 > zt-darwin-amd64.sha256
	sha256sum zt-darwin-arm64 > zt-darwin-arm64.sha256
	sha256sum zt-windows-amd64.exe > zt-windows-amd64.exe.sha256
	# combined checksums file
	sha256sum zt-* > checksums.txt

	- name: Upload to release
	uses: softprops/action-gh-release@v3
	with:
	files: \|
	dist/zt-linux-amd64
	dist/zt-linux-arm64
	dist/zt-darwin-amd64
	dist/zt-darwin-arm64
	dist/zt-windows-amd64.exe
	dist/zt-linux-amd64.sha256
	dist/zt-linux-arm64.sha256
	dist/zt-darwin-amd64.sha256
	dist/zt-darwin-arm64.sha256
	dist/zt-windows-amd64.exe.sha256
	dist/checksums.txt

	- name: Update Scoop bucket
	run: \|
	VERSION="${GITHUB_REF_NAME#v}"
	HASH=$(awk '{print $1}' dist/zt-windows-amd64.exe.sha256)
	URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/zt-windows-amd64.exe#/zt.exe"

	if [[ ! "$HASH" =~ ^[a-fA-F0-9]{64}$ ]]; then
	echo "error: could not read a valid sha256 from dist/zt-windows-amd64.exe.sha256 (got: '$HASH')" >&2
	exit 1
	fi

	# This job runs with the tag as a detached HEAD (that's what
	# built the release binaries), but the bucket lives on main —
	# switch there before editing it.
	git fetch origin main
	git checkout -B main origin/main

	# Every field the manifest pins to a specific release —
	# version, url, hash — must be bumped together. Missing the
	# url here once already shipped a bucket that reported the
	# new version but downloaded the previous release's binary
	# and failed its own hash check.
	jq --arg version "$VERSION" --arg url "$URL" --arg hash "$HASH" \
	'.version = $version \| .architecture["64bit"].url = $url \| .architecture["64bit"].hash = $hash' \
	bucket/zt.json > bucket/zt.json.tmp
	mv bucket/zt.json.tmp bucket/zt.json

	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	if git diff --quiet -- bucket/zt.json; then
	echo "bucket/zt.json already up to date, nothing to commit"
	else
	git add bucket/zt.json
	git commit -m "chore(scoop): bump bucket to ${GITHUB_REF_NAME}"
	git push origin main
	fi

	- name: Publish to WinGet
	id: winget
	uses: vedantmgoyal9/winget-releaser@v2
	with:
	identifier: casablanque-code.zt # pkg name at microsoft/winget-pkgs
	token: ${{ secrets.WINGET_TOKEN }}

	- name: Update Homebrew tap
	run: \|
	hash() { awk '{print $1}' "dist/$1.sha256"; }

	for f in zt-linux-amd64 zt-linux-arm64 zt-darwin-amd64 zt-darwin-arm64; do
	h=$(hash "$f")
	if [[ ! "$h" =~ ^[a-fA-F0-9]{64}$ ]]; then
	echo "error: could not read a valid sha256 for $f (got: '$h')" >&2
	exit 1
	fi
	done

	# Regenerated wholesale rather than patched field-by-field — a
	# partial update (bump version/hash but forget one of four
	# platform URLs) is exactly the bug that already broke the
	# Scoop bucket once. A fresh file each release can't drift.
	cat > Formula/zt.rb <<EOF
	class Zt < Formula
	desc "Zero Trust tunnel manager for Cloudflare"
	homepage "https://github.com/${GITHUB_REPOSITORY}"
	version "${GITHUB_REF_NAME#v}"
	license "MIT"

	on_macos do
	if Hardware::CPU.arm?
	url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/zt-darwin-arm64"
	sha256 "$(hash zt-darwin-arm64)"
	else
	url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/zt-darwin-amd64"
	sha256 "$(hash zt-darwin-amd64)"
	end
	end

	on_linux do
	if Hardware::CPU.arm?
	url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/zt-linux-arm64"
	sha256 "$(hash zt-linux-arm64)"
	else
	url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/zt-linux-amd64"
	sha256 "$(hash zt-linux-amd64)"
	end
	end

	def install
	bin.install Dir["zt-*"].first => "zt"
	end

	test do
	assert_match version.to_s, shell_output("#{bin}/zt version")
	end
	end
	EOF

	if git diff --quiet -- Formula/zt.rb; then
	echo "Formula/zt.rb already up to date, nothing to commit"
	else
	git add Formula/zt.rb
	git commit -m "chore(homebrew): bump formula to ${GITHUB_REF_NAME}"
	git push origin main
	fi

	- name: Check publish results
	if: always() && steps.winget.outcome == 'failure'
	run: \|
	echo "::error::WinGet publish failed — see the 'Publish to WinGet' step above. If casablanque-code.zt hasn't been submitted to microsoft/winget-pkgs yet, winget-releaser can't create the first entry; submit an initial manifest manually with wingetcreate, then this step will start succeeding on future releases."
	exit 1

Navigation Menu

Uh oh!

Add changelog entry for version 0.10.2 #24

Workflow file

Add changelog entry for version 0.10.2 #24

Uh oh!

Workflow file for this run