219 lines
8.6 KiB
YAML
219 lines
8.6 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- target: x86_64-unknown-linux-gnu
|
|
# Build on Ubuntu 22.04 so the Linux release binary works on
|
|
# common LTS servers with glibc 2.35 instead of requiring the
|
|
# newer glibc shipped by ubuntu-latest.
|
|
os: ubuntu-22.04
|
|
name: obscura-x86_64-linux
|
|
- target: aarch64-unknown-linux-gnu
|
|
# Native build on GitHub's ARM runner.
|
|
os: ubuntu-22.04-arm
|
|
name: obscura-aarch64-linux
|
|
- target: aarch64-apple-darwin
|
|
os: macos-latest
|
|
name: obscura-aarch64-macos
|
|
- target: x86_64-apple-darwin
|
|
# Must run on a native Intel runner. obscura-js bakes a V8 startup
|
|
# snapshot at build time, and that snapshot is architecture specific.
|
|
# macos-latest is Apple Silicon, so building x86_64 there embeds an
|
|
# arm64 snapshot into the Intel binary and V8 crashes deserializing
|
|
# it at isolate init (issue #290). macos-15-intel is the last x86_64
|
|
# image (available until Aug 2027); there is no cross-build that
|
|
# produces a correct snapshot.
|
|
os: macos-15-intel
|
|
name: obscura-x86_64-macos
|
|
- target: x86_64-pc-windows-msvc
|
|
os: windows-latest
|
|
name: obscura-x86_64-windows
|
|
|
|
runs-on: ${{ matrix.os }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install stealth build dependencies (Linux)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y cmake clang libclang-dev llvm-dev
|
|
|
|
- name: Configure libclang (macOS)
|
|
if: runner.os == 'macOS'
|
|
shell: bash
|
|
run: |
|
|
# Use one coherent SDK. A hard-coded CommandLineTools include path can
|
|
# mix libc++ headers with the selected Xcode SDK and break BoringSSL.
|
|
XCODE_PATH="$(xcode-select -p)"
|
|
SDK_PATH="$(xcrun --show-sdk-path)"
|
|
echo "SDKROOT=$SDK_PATH" >> "$GITHUB_ENV"
|
|
echo "CXXFLAGS=-isystem $SDK_PATH/usr/include/c++/v1" >> "$GITHUB_ENV"
|
|
echo "LIBCLANG_PATH=$XCODE_PATH/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"
|
|
|
|
- name: Configure libclang (Windows)
|
|
if: runner.os == 'Windows'
|
|
shell: pwsh
|
|
run: |
|
|
"LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Append
|
|
|
|
- name: Build no-render release binary
|
|
run: cargo build --profile release-dist --target ${{ matrix.target }} -p obscura-cli --bins --no-default-features
|
|
|
|
- name: Stage no-render release binary
|
|
shell: bash
|
|
run: |
|
|
BIN_DIR=target/${{ matrix.target }}/release-dist
|
|
mkdir -p dist/no-render
|
|
if [ -f "$BIN_DIR/obscura.exe" ]; then
|
|
cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/no-render/
|
|
else
|
|
cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/no-render/
|
|
fi
|
|
|
|
- name: Build no-render stealth release binary
|
|
run: cargo build --profile release-dist --target ${{ matrix.target }} -p obscura-cli --bins --no-default-features --features stealth
|
|
|
|
- name: Stage no-render stealth release binary
|
|
shell: bash
|
|
run: |
|
|
BIN_DIR=target/${{ matrix.target }}/release-dist
|
|
mkdir -p dist/no-render-stealth
|
|
if [ -f "$BIN_DIR/obscura.exe" ]; then
|
|
cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/no-render-stealth/
|
|
else
|
|
cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/no-render-stealth/
|
|
fi
|
|
|
|
- name: Build render-enabled release binary
|
|
run: cargo build --profile release-dist --target ${{ matrix.target }} -p obscura-cli --bins --features render
|
|
|
|
- name: Stage default release binary
|
|
shell: bash
|
|
run: |
|
|
BIN_DIR=target/${{ matrix.target }}/release-dist
|
|
mkdir -p dist/default
|
|
if [ -f "$BIN_DIR/obscura.exe" ]; then
|
|
cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/default/
|
|
else
|
|
cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/default/
|
|
fi
|
|
|
|
- name: Build render-enabled stealth release binary
|
|
run: cargo build --profile release-dist --target ${{ matrix.target }} -p obscura-cli --bins --features render,stealth
|
|
|
|
- name: Stage stealth release binary
|
|
shell: bash
|
|
run: |
|
|
BIN_DIR=target/${{ matrix.target }}/release-dist
|
|
mkdir -p dist/stealth
|
|
if [ -f "$BIN_DIR/obscura.exe" ]; then
|
|
cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/stealth/
|
|
else
|
|
cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/stealth/
|
|
fi
|
|
|
|
- name: Smoke test release binaries (V8 snapshot)
|
|
# Run the V8 path once so a release never ships a binary that crashes at
|
|
# isolate init from a mismatched snapshot (issue #290). The data: URL
|
|
# keeps it offline. Every target here is native, so the runner can
|
|
# execute all variants it just built.
|
|
shell: bash
|
|
run: |
|
|
for VARIANT in default stealth no-render no-render-stealth; do
|
|
BIN=dist/$VARIANT/obscura
|
|
[ -f "$BIN.exe" ] && BIN="$BIN.exe"
|
|
"$BIN" fetch "data:text/html,<title>ok</title>" --eval "1+1"
|
|
done
|
|
for VARIANT in default stealth; do
|
|
BIN=dist/$VARIANT/obscura
|
|
[ -f "$BIN.exe" ] && BIN="$BIN.exe"
|
|
"$BIN" fetch "data:text/html,<style>body{margin:0;background:%23123456}</style>" --screenshot smoke.png
|
|
test -s smoke.png
|
|
rm smoke.png
|
|
done
|
|
for VARIANT in no-render no-render-stealth; do
|
|
BIN=dist/$VARIANT/obscura
|
|
[ -f "$BIN.exe" ] && BIN="$BIN.exe"
|
|
if "$BIN" fetch "data:text/html,<title>no-render</title>" --screenshot smoke.png; then
|
|
echo "$VARIANT unexpectedly supports screenshots" >&2
|
|
exit 1
|
|
fi
|
|
test ! -e smoke.png
|
|
done
|
|
|
|
- name: Package (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: |
|
|
tar czf ${{ matrix.name }}.tar.gz -C dist/default obscura obscura-worker
|
|
tar czf ${{ matrix.name }}-stealth.tar.gz -C dist/stealth obscura obscura-worker
|
|
tar czf ${{ matrix.name }}-no-render.tar.gz -C dist/no-render obscura obscura-worker
|
|
tar czf ${{ matrix.name }}-no-render-stealth.tar.gz -C dist/no-render-stealth obscura obscura-worker
|
|
|
|
- name: Package (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: |
|
|
cd dist/default
|
|
7z a ../../${{ matrix.name }}.zip obscura.exe obscura-worker.exe
|
|
cd ../stealth
|
|
7z a ../../${{ matrix.name }}-stealth.zip obscura.exe obscura-worker.exe
|
|
cd ../no-render
|
|
7z a ../../${{ matrix.name }}-no-render.zip obscura.exe obscura-worker.exe
|
|
cd ../no-render-stealth
|
|
7z a ../../${{ matrix.name }}-no-render-stealth.zip obscura.exe obscura-worker.exe
|
|
|
|
- name: Upload packaged binaries
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: release-${{ matrix.name }}
|
|
path: |
|
|
${{ matrix.name }}.tar.gz
|
|
${{ matrix.name }}-stealth.tar.gz
|
|
${{ matrix.name }}-no-render.tar.gz
|
|
${{ matrix.name }}-no-render-stealth.tar.gz
|
|
${{ matrix.name }}.zip
|
|
${{ matrix.name }}-stealth.zip
|
|
${{ matrix.name }}-no-render.zip
|
|
${{ matrix.name }}-no-render-stealth.zip
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
publish:
|
|
needs: build
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# This job never checks out or executes repository code. The write token is
|
|
# available only while collecting and publishing the completed artifacts.
|
|
- name: Download packaged binaries
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
pattern: release-*
|
|
path: dist
|
|
merge-multiple: true
|
|
|
|
- name: Publish GitHub release
|
|
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
|
|
with:
|
|
files: dist/*
|