chore: release version v0.1.0 #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| jobs: | |
| publish: | |
| name: Publish to Hex.pm | |
| runs-on: ubuntu-latest | |
| environment: hex-publish | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Elixir | |
| uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 | |
| with: | |
| elixir-version: "1.18" | |
| otp-version: "27" | |
| - name: Verify exact release tag | |
| run: | | |
| git fetch --no-tags origin main:refs/remotes/origin/main | |
| version="$(mix run --no-compile --no-deps-check --no-start \ | |
| -e 'IO.write(Mix.Project.config()[:version])')" | |
| test "${GITHUB_REF_NAME}" = "v${version}" | |
| test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "${GITHUB_REF_NAME}")" | |
| git merge-base --is-ancestor HEAD refs/remotes/origin/main | |
| - name: Restore dependencies cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 | |
| with: | |
| path: | | |
| deps | |
| _build | |
| key: ${{ runner.os }}-mix-publish-${{ hashFiles('**/mix.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mix-publish- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Run canonical quality gate | |
| run: mix check --no-retry | |
| - name: Verify clean release workspace | |
| run: test -z "$(git status --porcelain --untracked-files=all)" | |
| - name: Build validated Hex package | |
| run: | | |
| package_name="doc_shell-${GITHUB_REF_NAME#v}.tar" | |
| validated_dir="${RUNNER_TEMP}/validated" | |
| registry_dir="${RUNNER_TEMP}/registry" | |
| mkdir -p "${validated_dir}" "${registry_dir}" | |
| { | |
| echo "PACKAGE_NAME=${package_name}" | |
| echo "VALIDATED_PACKAGE=${validated_dir}/${package_name}" | |
| echo "REGISTRY_PACKAGE=${registry_dir}/${package_name}" | |
| } >> "${GITHUB_ENV}" | |
| mix hex.build --output "${validated_dir}/${package_name}" | |
| sha256sum "${validated_dir}/${package_name}" | |
| test -z "$(git status --porcelain --untracked-files=all)" | |
| - name: Publish package and documentation to Hex.pm | |
| env: | |
| HEX_API_KEY: ${{ secrets.HEX_API_KEY }} | |
| run: mix hex.publish --yes | |
| - name: Verify published registry bytes | |
| run: | | |
| curl --fail --location --retry 12 --retry-all-errors --retry-delay 5 \ | |
| --output "${REGISTRY_PACKAGE}" \ | |
| "https://repo.hex.pm/tarballs/${PACKAGE_NAME}" | |
| sha256sum "${VALIDATED_PACKAGE}" "${REGISTRY_PACKAGE}" | |
| cmp --silent "${VALIDATED_PACKAGE}" "${REGISTRY_PACKAGE}" | |
| - name: Attest registry package provenance | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: ${{ env.REGISTRY_PACKAGE }} |