This repository was archived by the owner on Aug 27, 2026. It is now read-only.
Coordinated engine release #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # MANUAL ONLY (workflow_dispatch). Per repo policy, no automatic triggers on | |
| # push/tags/PRs. Run this from the Actions tab and supply the tag to release. | |
| # Builds downloadable GitHub Release artifacts from the supplied tag. TokenZero | |
| # is not published to crates.io; install via the release binaries, Homebrew tap, | |
| # npm, or `cargo install --git`. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Version tag to release (e.g., v1.0.0). Must match the workspace version.' | |
| required: true | |
| type: string | |
| prerelease: | |
| description: 'Mark the GitHub Release as a prerelease.' | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| validate-tag: | |
| name: Validate release tag | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.tag }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - id: version | |
| name: Verify input tag matches workspace version | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ inputs.tag }}" | |
| TAG="${TAG#v}" | |
| VER="$(cargo metadata --no-deps --format-version 1 \ | |
| | python3 -c 'import json,sys; data=json.load(sys.stdin); print(next(pkg["version"] for pkg in data["packages"] if pkg["name"] == "tokenzero"))')" | |
| echo "input_tag=$TAG workspace_version=$VER" | |
| if [ "$TAG" != "$VER" ]; then | |
| echo "::error::tag v$TAG does not match workspace version $VER"; exit 1 | |
| fi | |
| echo "version=$VER" >> "$GITHUB_OUTPUT" | |
| release: | |
| name: Build + verify | |
| needs: validate-tag | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.tag }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Build (locked) | |
| run: cargo build --workspace --locked --release | |
| - name: Test (locked) | |
| run: cargo test --workspace --locked | |
| - name: Clippy (deny warnings) | |
| run: cargo clippy --workspace --all-targets --locked -- -D warnings | |
| - name: Package dry run | |
| run: cargo package --workspace --locked | |
| windows-release: | |
| name: Windows verify | |
| needs: validate-tag | |
| runs-on: windows-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.tag }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Windows verifier | |
| shell: pwsh | |
| run: .\scripts\rust_windows_verify.ps1 | |
| - name: Build release binary | |
| run: cargo build --workspace --locked --release | |
| - name: Windows global install rehearsal | |
| shell: pwsh | |
| run: | | |
| $tokenzero = (Resolve-Path target\release\tokenzero.exe).Path | |
| .\scripts\rust_windows_global_rehearsal.ps1 -TokenZeroExe $tokenzero -SkipBuild | |
| - name: npm wrapper smoke | |
| shell: pwsh | |
| run: | | |
| $env:TOKENZERO_BIN = (Resolve-Path target\release\tokenzero.exe).Path | |
| node package\npm\bin\tokenzero.js --version | |
| - name: npm package dry run | |
| working-directory: package/npm | |
| run: npm pack --dry-run | |
| build-artifacts: | |
| name: Build artifact (${{ matrix.target }}) | |
| needs: [release, windows-release] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| binary: tokenzero | |
| - os: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| binary: tokenzero.exe | |
| - os: macos-14 | |
| target: aarch64-apple-darwin | |
| binary: tokenzero | |
| - os: macos-14 | |
| target: x86_64-apple-darwin | |
| binary: tokenzero | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.tag }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Build release binary | |
| run: cargo build -p tokenzero --locked --release --target "${{ matrix.target }}" | |
| - name: Package Unix artifact | |
| if: ${{ runner.os != 'Windows' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| name="tokenzero-${{ inputs.tag }}-${{ matrix.target }}" | |
| mkdir -p "dist/$name" | |
| cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "dist/$name/" | |
| cp README.md LICENSE "dist/$name/" | |
| tar -C dist -czf "dist/$name.tar.gz" "$name" | |
| shasum -a 256 "dist/$name.tar.gz" > "dist/$name.tar.gz.sha256" | |
| - name: Package Windows artifact | |
| if: ${{ runner.os == 'Windows' }} | |
| shell: pwsh | |
| run: | | |
| $name = "tokenzero-${{ inputs.tag }}-${{ matrix.target }}" | |
| New-Item -ItemType Directory -Force -Path "dist\$name" | Out-Null | |
| Copy-Item -LiteralPath "target\${{ matrix.target }}\release\${{ matrix.binary }}" -Destination "dist\$name\" | |
| Copy-Item -LiteralPath README.md, LICENSE -Destination "dist\$name\" | |
| Compress-Archive -Path "dist\$name" -DestinationPath "dist\$name.zip" -Force | |
| $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath "dist\$name.zip").Hash.ToLowerInvariant() | |
| "$hash $name.zip" | Set-Content -NoNewline -Encoding utf8 -Path "dist\$name.zip.sha256" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: tokenzero-${{ inputs.tag }}-${{ matrix.target }} | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.tar.gz.sha256 | |
| dist/*.zip | |
| dist/*.zip.sha256 | |
| if-no-files-found: error | |
| github-release: | |
| name: Create GitHub Release | |
| needs: build-artifacts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Create release notes | |
| run: | | |
| cat > release-notes.md <<'EOF' | |
| TokenZero ${{ inputs.tag }} | |
| Download the archive for your platform, extract it, place `tokenzero` or `tokenzero.exe` on PATH, then run: | |
| ```bash | |
| tokenzero install --global --plan --mcp --shell --cli --json | |
| tokenzero install --global --apply --mcp --shell --cli --json | |
| tokenzero doctor --json | |
| ``` | |
| EOF | |
| - name: Create or update release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| TAG: ${{ inputs.tag }} | |
| PRERELEASE: ${{ inputs.prerelease }} | |
| run: | | |
| set -euo pipefail | |
| if gh release view "$TAG" >/dev/null 2>&1; then | |
| gh release edit "$TAG" --title "$TAG" --notes-file release-notes.md | |
| elif [ "$PRERELEASE" = "true" ]; then | |
| gh release create "$TAG" --verify-tag --title "$TAG" --notes-file release-notes.md --prerelease | |
| else | |
| gh release create "$TAG" --verify-tag --title "$TAG" --notes-file release-notes.md | |
| fi | |
| gh release upload "$TAG" dist/* --clobber | |
| - name: Release summary | |
| run: | | |
| { | |
| echo "## TokenZero ${{ inputs.tag }}" | |
| echo | |
| echo "- GitHub Release: created/updated" | |
| echo | |
| echo "### Assets" | |
| find dist -maxdepth 1 -type f -printf -- "- %f\n" | sort | |
| } >> "$GITHUB_STEP_SUMMARY" |