diff --git a/.github/workflows/dotslash-config.json b/.github/workflows/dotslash-config.json index 054570e9..66b5884a 100644 --- a/.github/workflows/dotslash-config.json +++ b/.github/workflows/dotslash-config.json @@ -1,28 +1,33 @@ { - "outputs": { - "pks": { - "platforms": { - "macos-x86_64": { - "regex": "^pks-mac", - "path": "pks", - "format": "tar.gz" - }, - "macos-aarch64": { - "regex": "^pks-mac", - "path": "pks", - "format": "tar.gz" - }, - "linux-x86_64": { - "regex": "^x86_64-unknown-linux", - "path": "pks", - "format": "tar.gz" - }, - "linux-aarch64": { - "regex": "^aarch64-unknown-linux", - "path": "pks", - "format": "tar.gz" - } + "outputs": { + "pks": { + "platforms": { + "macos-aarch64": { + "name": "pks-aarch64-apple-darwin.tar.xz", + "path": "pks-aarch64-apple-darwin/pks", + "format": "tar.xz" + }, + "macos-x86_64": { + "name": "pks-x86_64-apple-darwin.tar.xz", + "path": "pks-x86_64-apple-darwin/pks", + "format": "tar.xz" + }, + "linux-aarch64": { + "name": "pks-aarch64-unknown-linux-gnu.tar.xz", + "path": "pks-aarch64-unknown-linux-gnu/pks", + "format": "tar.xz" + }, + "linux-x86_64": { + "name": "pks-x86_64-unknown-linux-gnu.tar.xz", + "path": "pks-x86_64-unknown-linux-gnu/pks", + "format": "tar.xz" + }, + "windows-x86_64": { + "name": "pks-x86_64-pc-windows-msvc.zip", + "path": "pks.exe", + "format": "zip" } } } - } \ No newline at end of file + } +} diff --git a/.github/workflows/publish-dotslash.yml b/.github/workflows/publish-dotslash.yml new file mode 100644 index 00000000..34ff12d2 --- /dev/null +++ b/.github/workflows/publish-dotslash.yml @@ -0,0 +1,35 @@ +# Adds a DotSlash `pks` file to each GitHub Release. release.yml (generated by +# dist) calls this after the release is published, via `post-announce-jobs` in +# dist-workspace.toml. It can't be a separate `on: release` workflow: dist +# creates the release with GITHUB_TOKEN, and events from GITHUB_TOKEN don't +# trigger other workflows. +# +# The action uploads without --clobber, so re-running this job after the `pks` +# asset is on the release fails. Delete it first: +# gh release delete-asset pks --yes +name: Publish DotSlash file + +on: + workflow_call: + inputs: + plan: + required: true + type: string + +permissions: {} + +jobs: + publish-dotslash: + name: Generate and upload the DotSlash file + runs-on: ubuntu-latest + permissions: + contents: write # `gh release upload` adds the DotSlash file to the release + steps: + # Reads .github/workflows/dotslash-config.json through the API at the + # released commit, so there's no checkout. + - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + config: .github/workflows/dotslash-config.json + tag: ${{ fromJson(inputs.plan).announcement_tag }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 78ccf1a5..adc94a2d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -302,3 +302,14 @@ jobs: with: persist-credentials: false submodules: recursive + + custom-publish-dotslash: + needs: + - plan + - announce + uses: ./.github/workflows/publish-dotslash.yml + with: + plan: ${{ needs.plan.outputs.val }} + secrets: inherit + permissions: + "contents": "write" diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 19c0fdd4..49e74d90 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -31,3 +31,13 @@ rules: # This repo configures no custom container runners, so matrix.container is # always null and no image is ever pulled. - release.yml + secrets-inherit: + ignore: + # dist calls every custom job (`post-announce-jobs` in dist-workspace.toml) + # with `secrets: inherit`. The only one is publish-dotslash.yml in this + # repo, which uses nothing but GITHUB_TOKEN. + - release.yml + self-repository: + ignore: + # dist calls custom jobs as `./.github/workflows/.yml`. + - release.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ccec804..1e58b32b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,12 +1,6 @@ # Changelog - - -## Unreleased +## 0.5.0 ### Breaking Changes @@ -67,6 +61,44 @@ files are grandfathering: pks check --ignore-recorded-violations ``` +### Fixes + +#### Recorded violations in strict packs match their `package_todo.yml` entries + +`package_todo.yml` has no field for `strict`, so a recorded violation in a pack +with a strict checker never matched its entry. `check` reported it as a new +violation and reported its todo entry as stale. Neither happens now, and +`--ignore-recorded-violations` no longer prints a spurious stale-todo line for +those entries. + +#### Removed stray debug output from the privacy checker + +A leftover `dbg!` wrote two lines to stderr for every reference checked against +a pack's `private_constants`, in release builds too. + +### Performance + +#### `pks check` compiles the inflector's regexes once + +Constant-name inflection compiled its regexes on every call, roughly 50k times +per run on a large codebase. They're now compiled once, which cut total CPU time +for `pks check` by about 45% on a large application. + +### Distribution + +#### Releases are built by cargo-dist + +This is the first release built by cargo-dist. Each release now publishes +`pks-.tar.xz` archives for macOS and Linux, a `.zip` for Windows, and +`pks-installer.sh` and `pks-installer.ps1` installer scripts. The old asset names +(`pks-mac.tar.gz`, `x86_64-unknown-linux-gnu.tar.gz` and +`aarch64-unknown-linux-gnu.tar.gz`) are no longer published, so anything that +downloads release assets by name needs updating. + +The dotslash `pks` file is still published under the same name. It now points +at the new archives, and it covers Windows as well as macOS and Linux. See +[INSTALLATION.md](https://github.com/rubyatscale/pks/blob/v0.5.0/INSTALLATION.md). + ### Internal #### Replaced `serde_yaml` with `yaml_serde` diff --git a/Cargo.toml b/Cargo.toml index e5dcb8d6..2fc0835d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,7 @@ [package] name = "pks" -version = "0.4.0" +version = "0.5.0" edition = "2021" description = "Welcome! Please see https://github.com/rubyatscale/pks for more information!" license = "MIT" diff --git a/INSTALLATION.md b/INSTALLATION.md index e39b5958..8bb2784d 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -1,12 +1,34 @@ # Installation -## Option 1: -- Install [dotslash](https://dotslash-cli.com/docs/installation/) -- Download the latest packs release dotslash `pks` file. Example: https://github.com/rubyatscale/pks/releases/tag/v0.2.21/pks -- Save the `pks` file to your ruby project's bin/ directory. You'll then have a `bin/pks` file in your project. -- Use `bin/pks` to execute the CLI. -## Option 2: +## Option 1: dotslash + +- Install [dotslash](https://dotslash-cli.com/docs/installation/). +- Download the `pks` DotSlash file from a release, for example https://github.com/rubyatscale/pks/releases/latest/download/pks, and save it to your Ruby project's `bin/` directory. +- Run `bin/pks`. + +The file pins that release's binaries by hash, so everyone working on the project runs the same version. It covers macOS, Linux (x86_64 and aarch64), and Windows (x86_64). + +## Option 2: Prebuilt binary + +From v0.5.0, every release publishes prebuilt binaries for macOS, Linux, and Windows, along with installer scripts that put `pks` in `$CARGO_HOME/bin` (usually `~/.cargo/bin`). + +macOS and Linux: + +```sh +curl --proto '=https' --tlsv1.2 -LsSf https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.sh | sh +``` + +Windows (PowerShell): + +```powershell +powershell -ExecutionPolicy Bypass -c "irm https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.ps1 | iex" +``` + +To pin a version, replace `latest/download` with `download/v0.5.0` (or whichever version you want). You can also download a `pks-.tar.xz` archive, or the `.zip` on Windows, straight from the [releases page](https://github.com/rubyatscale/pks/releases). + +## Option 3: Build from source + - Install Rust: https://www.rust-lang.org/tools/install - - Note: If `which cargo` returns a path, skip this step! - - TLDR: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`, and you're done! -- `cargo install pks` (it's like `gem install`) +- `cargo install --git https://github.com/rubyatscale/pks` + +Note that `cargo install pks` installs the crates.io `pks` crate, which is the original [alexevanczuk/packs](https://github.com/alexevanczuk/packs) at 0.2.40, not this repository. diff --git a/dist-workspace.toml b/dist-workspace.toml index 138620e8..8e26eec0 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -24,6 +24,11 @@ install-path = "CARGO_HOME" install-updater = false # Link build artifacts to the process which created it github-attestations = true +# Add a DotSlash `pks` file to each release once it's published +post-announce-jobs = ["./publish-dotslash"] + +[dist.github-custom-job-permissions] +"publish-dotslash" = { contents = "write" } # Pin the GitHub Actions that dist generates into release.yml to exact commits # rather than floating tags, so a compromised or retagged upstream release can't