Stop an expired tap token from killing the whole release #23
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.26" | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Verify dependencies | |
| run: go mod verify | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Build | |
| run: go build -o modelslab ./cmd/modelslab/ | |
| - name: Unit Tests | |
| run: go test ./internal/... -v -count=1 | |
| - name: Integration Tests (no auth) | |
| run: go test ./tests/ -v -count=1 -timeout 120s | |
| # The npm and PyPI packagers consume goreleaser's output. Nothing else in CI | |
| # exercises them, so without this a packaging break is only discovered by a | |
| # tag push — i.e. by a broken release. | |
| packaging: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.26" | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: "~> v2" | |
| args: build --snapshot --clean | |
| - name: Collect binaries | |
| run: | | |
| set -euo pipefail | |
| jq -r '.[] | select(.type == "Binary") | "\(.goos)_\(.goarch)\t\(.path)"' \ | |
| dist/artifacts.json | | |
| while IFS=$'\t' read -r target path; do | |
| mkdir -p "artifacts/$target" | |
| cp "$path" "artifacts/$target/" | |
| done | |
| test "$(find artifacts -type f | wc -l)" -eq 6 | |
| - name: Build npm packages | |
| run: node packaging/npm/build.mjs v0.0.0 artifacts dist/npm | |
| - name: Install and run the npm package | |
| run: | | |
| set -euo pipefail | |
| mkdir -p /tmp/npmcheck && cd /tmp/npmcheck && npm init -y >/dev/null | |
| npm install --no-audit --no-fund \ | |
| "$GITHUB_WORKSPACE/dist/npm/@modelslab/cli-linux-x64" \ | |
| "$GITHUB_WORKSPACE/dist/npm/modelslab-cli" | |
| # The real check: the shim resolves the binary and the binary runs. | |
| ./node_modules/.bin/modelslab --version | |
| # Dry-runs publish.sh against a stubbed npm, from the repo root with a | |
| # relative dist dir — the shape CI and the release both use. v0.1.3 died | |
| # here on a `node -p require('dist/npm/...')` that resolves fine with an | |
| # absolute path and not at all with a relative one, so local testing with | |
| # absolute paths never saw it. | |
| - name: Dry-run the npm publisher | |
| run: | | |
| set -euo pipefail | |
| mkdir -p /tmp/stub | |
| cat > /tmp/stub/npm <<'STUB' | |
| #!/usr/bin/env bash | |
| case "$1" in | |
| view) exit 1 ;; | |
| publish) echo "would publish $2"; exit 0 ;; | |
| *) exit 0 ;; | |
| esac | |
| STUB | |
| chmod +x /tmp/stub/npm | |
| output=$(PATH="/tmp/stub:$PATH" bash packaging/npm/publish.sh dist/npm) | |
| echo "$output" | |
| # Seven packages, and the unscoped entry must come last. | |
| test "$(grep -c '^publish ' <<<"$output")" -eq 7 | |
| test "$(grep '^publish ' <<<"$output" | tail -1)" = "publish modelslab-cli@0.0.0" | |
| - name: Build PyPI wheels | |
| run: python3 packaging/pypi/build.py v0.0.0 artifacts dist/pypi | |
| - name: Install and run the wheel | |
| run: | | |
| set -euo pipefail | |
| python3 -m pip install --quiet twine | |
| python3 -m twine check dist/pypi/*.whl | |
| python3 -m pip install --quiet \ | |
| dist/pypi/modelslab_cli-0.0.0-py3-none-manylinux2014_x86_64.whl | |
| # Catches the executable-bit bug: twine check passes a wheel whose | |
| # binary unpacks 0644, and only running it fails. | |
| modelslab --version | |
| build-matrix: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| strategy: | |
| matrix: | |
| goos: [darwin, linux, windows] | |
| goarch: [amd64, arm64] | |
| exclude: | |
| - goos: windows | |
| goarch: arm64 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.26" | |
| - name: Build | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: "0" | |
| run: | | |
| ext="" | |
| if [ "${{ matrix.goos }}" = "windows" ]; then ext=".exe"; fi | |
| go build -ldflags="-s -w" -o "modelslab-${{ matrix.goos }}-${{ matrix.goarch }}${ext}" ./cmd/modelslab/ | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: modelslab-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: modelslab-* |