Document use of +JMsingle true #265
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - v*.* | |
| tags: | |
| - v* | |
| env: | |
| ELIXIR_OPTS: "--warnings-as-errors" | |
| LANG: C.UTF-8 | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| create_draft_release: | |
| runs-on: ubuntu-22.04 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - name: Create draft release | |
| if: github.ref_type != 'branch' | |
| run: | | |
| gh release create \ | |
| --repo ${{ github.repository }} \ | |
| --title ${{ github.ref_name }} \ | |
| --notes '' \ | |
| --draft \ | |
| ${{ github.ref_name }} | |
| - uses: actions/checkout@v4 | |
| if: github.ref_type == 'branch' | |
| with: | |
| fetch-depth: 50 | |
| - name: Update ${{ github.ref_name }}-latest | |
| if: github.ref_type == 'branch' | |
| run: | | |
| ref_name=${{ github.ref_name }}-latest | |
| if ! gh release view $ref_name; then | |
| gh release create \ | |
| --latest=false \ | |
| --title $ref_name \ | |
| --notes "Automated release for latest ${{ github.ref_name }}." \ | |
| $ref_name | |
| fi | |
| git tag $ref_name --force | |
| git push origin $ref_name --force | |
| build: | |
| needs: create_draft_release | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| include: | |
| - otp: 25 | |
| otp_version: "25.3" | |
| - otp: 26 | |
| otp_version: "26.0" | |
| - otp: 27 | |
| otp_version: "27.0" | |
| build_docs: build_docs | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 50 | |
| - name: "Build Release" | |
| uses: ./.github/workflows/release_pre_built | |
| with: | |
| otp_version: ${{ matrix.otp_version }} | |
| otp: ${{ matrix.otp }} | |
| build_docs: ${{ matrix.build_docs }} | |
| - name: "Attest release .exe provenance" | |
| uses: actions/attest-build-provenance@v1 | |
| id: attest-exe-provenance | |
| with: | |
| subject-path: "elixir-otp-${{ matrix.otp }}.exe" | |
| - name: "Copy release .exe provenance" | |
| run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.exe.sigstore | |
| env: | |
| ATTESTATION: "${{ steps.attest-exe-provenance.outputs.bundle-path }}" | |
| - name: "Attest release .zip provenance" | |
| uses: actions/attest-build-provenance@v1 | |
| id: attest-zip-provenance | |
| with: | |
| subject-path: "elixir-otp-${{ matrix.otp }}.zip" | |
| - name: "Copy release .zip provenance" | |
| run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.zip.sigstore | |
| env: | |
| ATTESTATION: "${{ steps.attest-zip-provenance.outputs.bundle-path }}" | |
| - name: "Attest docs provenance" | |
| uses: actions/attest-build-provenance@v1 | |
| id: attest-docs-provenance | |
| if: ${{ matrix.build_docs }} | |
| with: | |
| subject-path: "Docs.zip" | |
| - name: "Copy docs provenance" | |
| if: ${{ matrix.build_docs }} | |
| run: cp "$ATTESTATION" Docs.zip.sigstore | |
| env: | |
| ATTESTATION: "${{ steps.attest-docs-provenance.outputs.bundle-path }}" | |
| - name: "Upload release artifacts" | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: elixir-otp-${{ matrix.otp }} | |
| path: elixir-otp-${{ matrix.otp }}* | |
| - name: "Upload doc artifacts" | |
| uses: actions/upload-artifact@v4 | |
| if: ${{ matrix.build_docs }} | |
| with: | |
| name: Docs | |
| path: Docs.zip* | |
| upload-release: | |
| needs: build | |
| runs-on: windows-2022 | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| - run: | | |
| mv elixir-otp-*/* . | |
| mv Docs/* . | |
| shell: bash | |
| - name: "Sign files with Trusted Signing" | |
| if: github.repository == 'elixir-lang/elixir' | |
| uses: azure/[email protected] | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| endpoint: https://eus.codesigning.azure.net/ | |
| trusted-signing-account-name: trusted-signing-elixir | |
| certificate-profile-name: Elixir | |
| files-folder: ${{ github.workspace }} | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| - name: Upload Pre-built | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| if [ "${{ github.ref_type }}" == "branch" ]; then | |
| tag=${{ github.ref_name }}-latest | |
| else | |
| tag="${{ github.ref_name }}" | |
| fi | |
| gh release upload \ | |
| --repo ${{ github.repository }} \ | |
| --clobber \ | |
| "$tag" \ | |
| elixir-otp-*.zip \ | |
| elixir-otp-*.zip.sha{1,256}sum \ | |
| elixir-otp-*.zip.sigstore \ | |
| elixir-otp-*.exe \ | |
| elixir-otp-*.exe.sha{1,256}sum \ | |
| elixir-otp-*.exe.sigstore \ | |
| Docs.zip \ | |
| Docs.zip.sha{1,256}sum \ | |
| Docs.zip.sigstore | |
| upload-builds-hex-pm: | |
| needs: build | |
| runs-on: ubuntu-22.04 | |
| concurrency: builds-hex-pm | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.HEX_AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.HEX_AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: ${{ secrets.HEX_AWS_REGION }} | |
| AWS_S3_BUCKET: ${{ secrets.HEX_AWS_S3_BUCKET }} | |
| FASTLY_REPO_SERVICE_ID: ${{ secrets.HEX_FASTLY_REPO_SERVICE_ID }} | |
| FASTLY_BUILDS_SERVICE_ID: ${{ secrets.HEX_FASTLY_BUILDS_SERVICE_ID }} | |
| FASTLY_KEY: ${{ secrets.HEX_FASTLY_KEY }} | |
| OTP_GENERIC_VERSION: "25" | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| - name: Init purge keys file | |
| run: | | |
| touch purge_keys.txt | |
| - name: Upload Precompiled to S3 | |
| run: | | |
| ref_name=${{ github.ref_name }} | |
| mv elixir-otp-*/* . | |
| for zip in $(find . -type f -name 'elixir-otp-*.zip' | sed 's/^\.\///'); do | |
| dest=${zip/elixir/${ref_name}} | |
| surrogate_key=${dest/.zip$/} | |
| aws s3 cp "${zip}" "s3://${AWS_S3_BUCKET}/builds/elixir/${dest}" \ | |
| --cache-control "public,max-age=3600" \ | |
| --metadata "{\"surrogate-key\":\"builds builds/elixir builds/elixir/${surrogate_key}\",\"surrogate-control\":\"public,max-age=604800\"}" | |
| echo "builds/elixir/${surrogate_key}" >> purge_keys.txt | |
| if [ "$zip" == "elixir-otp-${OTP_GENERIC_VERSION}.zip" ]; then | |
| aws s3 cp "${zip}" "s3://${AWS_S3_BUCKET}/builds/elixir/${ref_name}.zip" \ | |
| --cache-control "public,max-age=3600" \ | |
| --metadata "{\"surrogate-key\":\"builds builds/elixir builds/elixir/${ref_name}\",\"surrogate-control\":\"public,max-age=604800\"}" | |
| echo builds/elixir/${ref_name} >> purge_keys.txt | |
| fi | |
| done | |
| - name: Upload Docs to S3 | |
| working-directory: Docs | |
| run: | | |
| version=$(echo ${{ github.ref_name }} | sed -e 's/^v//g') | |
| unzip Docs.zip | |
| for f in doc/*; do | |
| if [ -d "$f" ]; then | |
| app=$(echo "$f" | sed s/"doc\/"//) | |
| tarball="${app}-${version}.tar.gz" | |
| surrogate_key="docs/${app}-${version}" | |
| tar -czf "${tarball}" -C "doc/${app}" . | |
| aws s3 cp "${tarball}" "s3://${AWS_S3_BUCKET}/docs/${tarball}" \ | |
| --cache-control "public,max-age=3600" \ | |
| --metadata "{\"surrogate-key\":\"${surrogate_key}\",\"surrogate-control\":\"public,max-age=604800\"}" | |
| echo "${surrogate_key}" >> ../purge_keys.txt | |
| fi | |
| done | |
| - name: Update builds txt | |
| run: | | |
| date="$(date -u '+%Y-%m-%dT%H:%M:%SZ')" | |
| ref_name=${{ github.ref_name }} | |
| aws s3 cp "s3://${AWS_S3_BUCKET}/builds/elixir/builds.txt" builds.txt || true | |
| touch builds.txt | |
| for sha256_file in $(find . -name 'elixir-otp-*.zip.sha256sum' | sed 's/^\.\///'); do | |
| otp_version=$(echo "${sha256_file}" | sed -r 's/^elixir-otp-([[:digit:]]+)\.zip\.sha256sum/otp-\1/') | |
| build_sha256=$(cut -d ' ' -f 1 "${sha256_file}") | |
| sed -i "/^${ref_name}-${otp_version} /d" builds.txt | |
| echo -e "${ref_name}-${otp_version} ${{ github.sha }} ${date} ${build_sha256} \n$(cat builds.txt)" > builds.txt | |
| if [ "${otp_version}" == "otp-${OTP_GENERIC_VERSION}" ]; then | |
| sed -i "/^${ref_name} /d" builds.txt | |
| echo -e "${ref_name} ${{ github.sha }} ${date} ${build_sha256} \n$(cat builds.txt)" > builds.txt | |
| fi | |
| done | |
| sort -u -k1,1 -o builds.txt builds.txt | |
| aws s3 cp builds.txt "s3://${AWS_S3_BUCKET}/builds/elixir/builds.txt" \ | |
| --cache-control "public,max-age=3600" \ | |
| --metadata '{"surrogate-key":"builds builds/elixir builds/elixir/txt","surrogate-control":"public,max-age=604800"}' | |
| echo 'builds/elixir/txt' >> purge_keys.txt | |
| - name: Flush cache | |
| if: github.repository == 'elixir-lang/elixir' | |
| run: | | |
| function purge_key() { | |
| curl \ | |
| -X POST \ | |
| -H "Fastly-Key: ${FASTLY_KEY}" \ | |
| -H "Accept: application/json" \ | |
| -H "Content-Length: 0" \ | |
| "https://api.fastly.com/service/$1/purge/$2" | |
| } | |
| function purge() { | |
| purge_key ${FASTLY_REPO_SERVICE_ID} $1 | |
| purge_key ${FASTLY_BUILDS_SERVICE_ID} $1 | |
| sleep 2 | |
| purge_key ${FASTLY_REPO_SERVICE_ID} $1 | |
| purge_key ${FASTLY_BUILDS_SERVICE_ID} $1 | |
| sleep 2 | |
| purge_key ${FASTLY_REPO_SERVICE_ID} $1 | |
| purge_key ${FASTLY_BUILDS_SERVICE_ID} $1 | |
| } | |
| for key in $(cat purge_keys.txt); do | |
| purge "${key}" | |
| done |