Skip to content

Commit 7fb367c

Browse files
MattJacksonMattJackson
committed
Add release workflow: build, sign, and publish plugin tarballs on version tags
Mirrors busbarAI's release.yml store-plugins job pattern (5-target matrix, busbar-plugin-pack pack/sign, BUSBAR_SIGN_KEY-or-unsigned fallback, gh release upload, build-provenance attestation) scoped to this repo's own plugin and its own GitHub Release.
1 parent 66267c5 commit 7fb367c

1 file changed

Lines changed: 149 additions & 0 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# Release: on a version tag (e.g. v1.0.0), build the store-postgres plugin cdylib for all 5
2+
# supported targets, pack + sign each into a loadable busbar plugin tarball, and publish them to
3+
# THIS repo's own GitHub Release.
4+
#
5+
# This mirrors busbarAI/.github/workflows/release.yml's `store-plugins` job — same 5-target
6+
# matrix, same busbar-plugin-pack pack/sign step (built from a sibling busbar checkout), same
7+
# BUSBAR_SIGN_KEY-or-`--allow-unsigned` fallback, same `gh release upload` + build-provenance
8+
# attestation — just scoped to this one plugin instead of building sqlite/postgres/redis together
9+
# in one monorepo job.
10+
#
11+
# This plugin's own version (the `v*` tag pushed here) is NOT tied to busbar's version number —
12+
# it is independently versioned starting at 0.5.0 (see README), separate from whichever busbar
13+
# branch it happens to build against via BUSBAR_REF below.
14+
name: release
15+
16+
on:
17+
push:
18+
tags:
19+
- "v*"
20+
21+
permissions:
22+
contents: write # create the Release + upload assets
23+
id-token: write # OIDC identity for keyless Sigstore signing (provenance)
24+
attestations: write # record the build-provenance attestation
25+
26+
env:
27+
# Which busbar branch to check out as the sibling path dependency — same BUSBAR_REF convention
28+
# ci.yml / plugin-ci.yml already established. Update to `main` once busbar 1.5.0 actually ships;
29+
# until then the plugin ABI surface this crate depends on only exists on 1.5.0-dev.
30+
BUSBAR_REF: 1.5.0-dev
31+
32+
jobs:
33+
# Create the Release first so the parallel per-target upload jobs have something to attach to
34+
# (uploading from a matrix without a pre-existing release races -> "release not found").
35+
create-release:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v7
39+
- name: Create GitHub Release
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: |
43+
gh release create "${GITHUB_REF_NAME}" \
44+
--repo "${GITHUB_REPOSITORY}" \
45+
--title "busbar-store-postgres ${GITHUB_REF_NAME}" \
46+
--verify-tag --generate-notes \
47+
|| gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}"
48+
49+
# One signed .tar.gz per target: {cdylib + manifest.json}, packed by busbar-plugin-pack and
50+
# signed with the busbar release PRIVATE key (BUSBAR_SIGN_KEY secret) so it verifies as
51+
# first-party against the PUBLIC key embedded in busbar's own release binaries. If that secret
52+
# isn't provisioned on this repo, falls back to an UNSIGNED tarball (loadable only under
53+
# plugins.trust.allow_unsigned) rather than blocking the release — same seam busbarAI's own
54+
# release.yml documents (TODO(release-keys)).
55+
store-plugin:
56+
needs: create-release
57+
name: store-plugin (${{ matrix.target }})
58+
runs-on: ${{ matrix.os }}
59+
strategy:
60+
fail-fast: false
61+
matrix:
62+
include:
63+
- target: x86_64-unknown-linux-gnu
64+
os: ubuntu-latest
65+
libext: so
66+
libprefix: lib
67+
- target: aarch64-unknown-linux-gnu
68+
os: ubuntu-24.04-arm
69+
libext: so
70+
libprefix: lib
71+
- target: x86_64-apple-darwin
72+
os: macos-latest
73+
libext: dylib
74+
libprefix: lib
75+
- target: aarch64-apple-darwin
76+
os: macos-latest
77+
libext: dylib
78+
libprefix: lib
79+
- target: x86_64-pc-windows-msvc
80+
os: windows-latest
81+
libext: dll
82+
libprefix: ""
83+
steps:
84+
- name: Checkout store-postgres
85+
uses: actions/checkout@v7
86+
with:
87+
path: store-postgres
88+
89+
- name: Checkout busbar (sibling path dependency)
90+
uses: actions/checkout@v7
91+
with:
92+
repository: GetBusbar/busbar
93+
ref: ${{ env.BUSBAR_REF }}
94+
path: busbarAI
95+
96+
- uses: dtolnay/rust-toolchain@stable
97+
with:
98+
targets: ${{ matrix.target }}
99+
- uses: Swatinem/rust-cache@v2
100+
101+
- name: Build the store-postgres plugin cdylib
102+
working-directory: store-postgres
103+
run: cargo build --release --target ${{ matrix.target }}
104+
shell: bash
105+
106+
- name: Build busbar-plugin-pack (from the sibling busbar checkout)
107+
working-directory: busbarAI
108+
run: cargo build --release --target ${{ matrix.target }} -p busbar-plugin-pack
109+
shell: bash
110+
111+
- name: Package + sign the plugin tarball
112+
env:
113+
BUSBAR_SIGN_KEY: ${{ secrets.BUSBAR_SIGN_KEY }}
114+
run: |
115+
set -euo pipefail
116+
ver="${GITHUB_REF_NAME#v}"
117+
target="${{ matrix.target }}"
118+
outdir="plugin-dist"; mkdir -p "$outdir"
119+
pack="busbarAI/target/${target}/release/busbar-plugin-pack"
120+
[ -x "$pack" ] || pack="busbarAI/target/${target}/release/busbar-plugin-pack.exe"
121+
unsigned_flag=""
122+
if [ -z "${BUSBAR_SIGN_KEY:-}" ]; then
123+
echo "::warning::BUSBAR_SIGN_KEY secret is not provisioned — packaging an UNSIGNED plugin tarball (loadable only under plugins.trust.allow_unsigned). See busbarAI's release.yml TODO(release-keys) seam."
124+
unsigned_flag="--allow-unsigned"
125+
fi
126+
lib="store-postgres/target/${target}/release/${{ matrix.libprefix }}busbar_store_postgres_plugin.${{ matrix.libext }}"
127+
"$pack" pack \
128+
--lib "$lib" \
129+
--name "busbar-store-postgres" --alias "postgres" --kind store \
130+
--version "$ver" --publisher busbar \
131+
--description "First-party signed kind:store plugin cdylib: the Postgres backend for busbar's durable governance store, exported over the store C ABI. Drop the built library into the plugins folder and set governance.store: postgres to share virtual keys, budgets, and usage across a fleet of busbar nodes." \
132+
--license Apache-2.0 \
133+
--out "${outdir}/busbar-store-postgres-${ver}-${target}.tar.gz" \
134+
$unsigned_flag
135+
ls -l "$outdir"
136+
shell: bash
137+
138+
- name: Attach plugin tarball to Release
139+
env:
140+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141+
run: gh release upload "${GITHUB_REF_NAME}" plugin-dist/*.tar.gz --repo "${GITHUB_REPOSITORY}" --clobber
142+
shell: bash
143+
144+
# Keyless (Sigstore/OIDC) build-provenance attestation binding this tarball's digest to this
145+
# workflow run + commit — `gh attestation verify <tarball> --repo ${{ github.repository }}`.
146+
- name: Attest plugin build provenance
147+
uses: actions/attest-build-provenance@v4
148+
with:
149+
subject-path: "plugin-dist/*.tar.gz"

0 commit comments

Comments
 (0)