mail/.github/workflows/release.yml at main · mail-os/mail · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Release

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: write

jobs:
  release:
    name: Build & Release (all platforms)
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      with:
        submodules: recursive
        fetch-depth: 0

    - name: Setup project dependencies with Pantry
      uses: pantry-pm/pantry/packages/action@v0.11.28

    # Pantry provides the pinned native toolchain. The hoisted Bun install
    # provides each workspace's JavaScript dependencies and release builders.
    - name: Install workspace dependencies
      run: bun install --frozen-lockfile

    - name: Build webmail frontend
      # The zig binaries @embedFile packages/zig/src/api/webmail_dist/* (generated,
      # not committed), so render it before compiling or every target fails FileNotFound.
      run: |
        cd packages/webmail
        bun run build

    - name: Cross-compile every platform
      # build.zig vendors sqlite3.c + links only libc when cross-compiling, so one
      # Linux box produces linux & macOS (x86_64 + arm64) binaries into
      # packages/zig/zig-out/cross/<triple>/ — no macOS/ARM runners needed.
      run: |
        cd packages/zig
        zig build -Dall-targets -Doptimize=ReleaseFast

    - name: Release via Pantry action
      # The Pantry action auto-discovers packages/zig/zig-out/cross/<triple>/,
      # packages each platform, extracts the changelog, and creates the GitHub
      # release — the whole release flow lives in the action.
      uses: pantry-pm/pantry/packages/action@v0.11.28
      with:
        install: 'false'
        release: 'true'
        release-files: 'auto'
        release-tag: ${{ github.ref_name }}
        release-token: ${{ secrets.GITHUB_TOKEN }}
        # "auto" runs logsmith over previous-tag → this-tag rather than trying to
        # find this tag's heading inside CHANGELOG.md. The changelog logsmith
        # writes during the version bump has no per-version heading to extract,
        # so section extraction would come up empty and silently fall through to
        # the generic notes below.
        release-changelog: auto
        release-notes: |
          ## mail ${{ github.ref_name }}

          Prebuilt binaries for linux & macOS (x86_64 + arm64) are attached below.

          Install via pantry:

          ```sh
          pantry install github.com/mail-os/mail
          ```

    - name: Publish the typed management client
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
      run: |
        set -euo pipefail
        # v0.2.0 burned 20 minutes of cross-compiling before dying here with
        # ENEEDAUTH. Check the secret first so the failure names its own cause.
        if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
          echo "::error::NPM_TOKEN is not set: the GitHub release was published, but @stacksjs/mail was not."
          exit 1
        fi
        npm config set //registry.npmjs.org/:_authToken "$NODE_AUTH_TOKEN"
        cd packages/ts
        npm publish --access public