docs(changelog): record the dependency refresh in the four pending re… #97
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: engine-release | |
| # Full cross-platform release matrix. Builds binaries for all supported | |
| # platforms and attaches them to the GitHub Release created by the tag push. | |
| # | |
| # The release is published atomically: `ensure-release` creates it as a | |
| # **draft**, the matrix and `checksums` attach every artifact, and only then | |
| # does `publish` flip it to a published release. This matters because | |
| # `engine/install.sh` resolves "latest" by listing `/releases` (unauthenticated) | |
| # and taking the highest `engine-v*` tag. Draft releases are omitted from that | |
| # listing, so the new version becomes resolvable only once its binaries exist. | |
| # Creating the release up front (as this workflow used to) made the tag | |
| # resolvable for the ~15-25 min the matrix was still building, so any | |
| # concurrent `install.sh` — a user's, or another PR's smoke job — resolved | |
| # `engine-v<new>` and 404'd on the not-yet-uploaded archive. | |
| # | |
| # scripts/release.sh remains as a local-build hotfix fallback. | |
| on: | |
| push: | |
| tags: ["engine-v*"] | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| # Limit parallelism — DuckDB C++ compilation is extremely memory-intensive | |
| # and OOMs the GitHub Actions runner (~7GB RAM) at default parallelism | |
| CARGO_BUILD_JOBS: 4 | |
| defaults: | |
| run: | |
| working-directory: engine | |
| jobs: | |
| build: | |
| name: Build ${{ matrix.target }} | |
| needs: ensure-release | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: macos-14 | |
| target: aarch64-apple-darwin | |
| archive: rocky-aarch64-apple-darwin.tar.gz | |
| lsp_archive: rocky-lsp-aarch64-apple-darwin.tar.gz | |
| ext: tar.gz | |
| - runner: macos-14 | |
| target: x86_64-apple-darwin | |
| archive: rocky-x86_64-apple-darwin.tar.gz | |
| lsp_archive: rocky-lsp-x86_64-apple-darwin.tar.gz | |
| ext: tar.gz | |
| - runner: ubuntu-24.04 | |
| target: x86_64-unknown-linux-gnu | |
| archive: rocky-x86_64-unknown-linux-gnu.tar.gz | |
| lsp_archive: rocky-lsp-x86_64-unknown-linux-gnu.tar.gz | |
| ext: tar.gz | |
| zigbuild: true | |
| - runner: ubuntu-24.04 | |
| target: aarch64-unknown-linux-gnu | |
| archive: rocky-aarch64-unknown-linux-gnu.tar.gz | |
| lsp_archive: rocky-lsp-aarch64-unknown-linux-gnu.tar.gz | |
| ext: tar.gz | |
| zigbuild: true | |
| cross: true | |
| - runner: windows-2022 | |
| target: x86_64-pc-windows-msvc | |
| archive: rocky-x86_64-pc-windows-msvc.zip | |
| lsp_archive: rocky-lsp-x86_64-pc-windows-msvc.zip | |
| ext: zip | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 | |
| with: | |
| workspaces: engine | |
| key: release-${{ matrix.target }} | |
| # Windows: install NASM. `aws-lc-sys` (transitive dep of `jsonwebtoken` | |
| # via the `aws_lc_rs` feature flag enabled in the workspace toml) | |
| # builds AWS-LC's optimized crypto kernels from `.asm` sources on | |
| # Windows and panics with "NASM command not found" without it. The | |
| # macOS / Linux toolchains fall back to a YASM-equivalent assembler | |
| # that ships with the runner image. | |
| - name: Install NASM (Windows only) | |
| if: runner.os == 'Windows' | |
| uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1 | |
| # Linux: free disk space and add swap (DuckDB C++ is memory-hungry) | |
| - name: Free disk space and add swap | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc | |
| sudo fallocate -l 4G /mnt/swapfile && sudo chmod 600 /mnt/swapfile && sudo mkswap /mnt/swapfile && sudo swapon /mnt/swapfile || true | |
| # Linux: install zig + cargo-zigbuild for portable glibc builds | |
| - name: Install zig | |
| if: matrix.zigbuild | |
| uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 | |
| with: | |
| version: 0.14.1 | |
| - name: Install cargo-zigbuild | |
| if: matrix.zigbuild | |
| # Prebuilt binary — avoids ~35s of `cargo install cargo-zigbuild | |
| # --locked` (compiles from source) per Linux target. | |
| uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 | |
| with: | |
| tool: cargo-zigbuild | |
| # Linux cross-compile: install the cross-compilation toolchain | |
| - name: Install cross-compilation toolchain | |
| if: matrix.cross | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu | |
| # Linux: build with cargo-zigbuild (portable glibc). Build both | |
| # binaries in the same invocation so the workspace compile cache | |
| # is shared and we don't pay rocky-core / rocky-compiler twice. | |
| - name: Build release binaries (zigbuild) | |
| if: matrix.zigbuild | |
| run: cargo zigbuild --release --bin rocky --bin rocky-lsp --target ${{ matrix.target }} | |
| # macOS / Windows: build with plain cargo | |
| - name: Build release binaries (cargo) | |
| if: ${{ !matrix.zigbuild }} | |
| run: cargo build --release --bin rocky --bin rocky-lsp --target ${{ matrix.target }} | |
| # Unix: package each binary as its own .tar.gz. Split archives so | |
| # consumers who only need the LSP don't download the full CLI. | |
| - name: Package binaries (tar.gz) | |
| if: matrix.ext == 'tar.gz' | |
| run: | | |
| tar czf ${{ matrix.archive }} -C target/${{ matrix.target }}/release rocky | |
| tar czf ${{ matrix.lsp_archive }} -C target/${{ matrix.target }}/release rocky-lsp | |
| # Windows: same split, as .zip | |
| - name: Package binaries (zip) | |
| if: matrix.ext == 'zip' | |
| shell: pwsh | |
| run: | | |
| Compress-Archive -Path target/${{ matrix.target }}/release/rocky.exe -DestinationPath ${{ matrix.archive }} | |
| Compress-Archive -Path target/${{ matrix.target }}/release/rocky-lsp.exe -DestinationPath ${{ matrix.lsp_archive }} | |
| # Upload with `gh` rather than a release action: `gh release upload` | |
| # touches assets only, so it cannot disturb the draft state that | |
| # `publish` is responsible for clearing. (A release action that PATCHes | |
| # the release would publish it early and reintroduce the race this | |
| # workflow exists to avoid.) Same mechanism the `checksums` job uses. | |
| # `shell: bash` so the windows-2022 runner doesn't run this under pwsh; | |
| # paths are relative to the workflow-level `working-directory: engine`, | |
| # which is where the packaging steps above wrote the archives. | |
| - name: Attach to GitHub Release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload "${GITHUB_REF_NAME}" \ | |
| "${{ matrix.archive }}" \ | |
| "${{ matrix.lsp_archive }}" \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --clobber | |
| # Generate checksums.txt from all platform archives and attach to the release. | |
| # Runs after all build jobs so every archive is present before hashing. | |
| checksums: | |
| name: Generate checksums | |
| needs: [ensure-release, build] | |
| runs-on: ubuntu-24.04 | |
| # Override the workflow-level `working-directory: engine` — this job | |
| # operates at the repo root and needs no Cargo workspace. | |
| defaults: | |
| run: | |
| working-directory: ${{ github.workspace }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download release archives | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release download "${GITHUB_REF_NAME}" \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --pattern "rocky-*.tar.gz" \ | |
| --pattern "rocky-*.zip" \ | |
| --dir release-artifacts | |
| - name: Generate checksums.txt | |
| run: | | |
| cd release-artifacts | |
| # Require that at least one of each expected archive glob was | |
| # actually downloaded — otherwise `sha256sum rocky-*.tar.gz` would | |
| # happily write an empty checksums.txt (or a line for the literal | |
| # glob string) and we'd publish unverifiable artifacts. | |
| shopt -s nullglob | |
| targz=( rocky-*.tar.gz ) | |
| zips=( rocky-*.zip ) | |
| shopt -u nullglob | |
| if (( ${#targz[@]} == 0 || ${#zips[@]} == 0 )); then | |
| echo "ERROR: expected at least one rocky-*.tar.gz and one rocky-*.zip in release-artifacts/" >&2 | |
| ls -la | |
| exit 1 | |
| fi | |
| sha256sum "${targz[@]}" "${zips[@]}" > checksums.txt | |
| cat checksums.txt | |
| - name: Upload checksums to release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release upload "${GITHUB_REF_NAME}" release-artifacts/checksums.txt \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --clobber | |
| # Publish the draft, making the version resolvable by engine/install.sh. | |
| # Depends on `checksums` as well as `build` so checksums.txt is in place | |
| # before anyone can resolve the release — install.sh fetches it to verify | |
| # the download. | |
| # | |
| # `--latest` here rather than at creation: the engine binary owns the repo's | |
| # "Latest" badge, and asserting it at publish time also settles the ordering | |
| # when a coupled release pushes engine/sdk/dagster/vscode tags together. | |
| # | |
| # Fail-closed by design: if any platform build or the checksums job fails, | |
| # this job is skipped and the release stays an unpublished draft rather than | |
| # going live half-populated. That leftover draft is the intended outcome, not | |
| # a bug — re-run the failed jobs and this publishes it. | |
| publish: | |
| name: Publish release | |
| needs: [ensure-release, build, checksums] | |
| runs-on: ubuntu-24.04 | |
| # Override the workflow-level `working-directory: engine` — this job needs | |
| # no checkout, so that directory does not exist here. | |
| defaults: | |
| run: | |
| working-directory: ${{ github.workspace }} | |
| steps: | |
| - name: Publish the release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release edit "${GITHUB_REF_NAME}" \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --draft=false \ | |
| --latest | |
| echo "Published ${GITHUB_REF_NAME}" | |
| # Create the GitHub Release if it doesn't already exist (supports both | |
| # CI-only releases and the local scripts/release.sh workflow where the | |
| # release is created before the tag push). | |
| # | |
| # Created as a draft so it stays out of the public `/releases` listing until | |
| # `publish` runs — see the header comment. An existing release (the | |
| # scripts/release.sh path) is left exactly as it is: it already carries the | |
| # artifacts that path uploaded, so forcing it back to draft would briefly | |
| # retract something deliberately published. | |
| ensure-release: | |
| name: Ensure GitHub Release exists | |
| runs-on: ubuntu-24.04 | |
| # Run before build so artifacts have a release to attach to | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Create release if missing | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="${GITHUB_REF_NAME}" | |
| if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then | |
| echo "Release $TAG already exists (created by scripts/release.sh)" | |
| else | |
| echo "Creating draft release $TAG" | |
| gh release create "$TAG" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --generate-notes \ | |
| --draft \ | |
| --title "$TAG" | |
| fi |