diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 4bc28cc..86681cb 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -27,7 +27,7 @@ jobs: contents: read issues: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: actions-rust-lang/audit@v1 diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 9e86318..002cec3 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -4,52 +4,36 @@ name: Release-plz # # This workflow is triggered manually only (Actions -> "Release-plz" -> "Run # workflow"). Select the branch to release from in the "Use workflow from" -# dropdown (e.g. `master` or `release/1.0`) and choose the command: -# - `release-pr` to prepare/refresh the release PR. -# - `release` to publish after the release PR has been merged. +# dropdown (e.g. the default branch or `release/1.x`) and click "Run workflow". +# Both jobs below run on every dispatch: # -# 1. `release-pr` opens/updates a release PR (branch prefix `release-plz-`) +# 1. The `release-pr` job opens/updates a release PR (branch prefix `release-plz-`) # with the version bump and changelog for the `rust-cktap` crate, targeting # the selected branch, authored by the `bitcoindevkit-release-plz` GitHub App. # The version bump is computed from that branch's Cargo.toml. Re-run it to # refresh the release PR after new commits land on the branch. -# 2. After the release PR is reviewed and merged, run the workflow again with -# `release` on the same branch: it publishes the crate to crates.io (via -# trusted publishing / OIDC, no token secret) and creates the -# `rust-cktap-vX.Y.Z` git tag and GitHub release. -# 3. The `release` job runs in the `release` GitHub environment, whose required -# reviewers are the @bitcoindevkit/rust-cktap-release team: publishing -# waits until a team member approves it in the Actions UI. +# 2. The `release` job checks whether the release PR has been merged. If so, it +# publishes the crate to crates.io (via trusted publishing / OIDC, no token +# secret) and creates the `rust-cktap-vX.Y.Z` git tag and GitHub release. +# The job runs in the `release` GitHub environment, whose required reviewers +# are the @bitcoindevkit/rust-cktap-release team: publishing waits until a +# team member approves it in the Actions UI. # # Notes: -# - To release from a `release/*` maintenance branch, cherry-pick both -# `release-plz.toml` and this workflow file onto that branch when cutting it -# (and keep the workflow in sync with `master` afterwards): the run uses the -# workflow file from the branch selected in the dropdown. # - release-plz supports only one open release PR per repository, so don't # prepare releases on two branches concurrently. on: workflow_dispatch: - inputs: - command: - description: >- - release-pr: prepare/refresh the release PR. - release: publish after the release PR is merged. - required: true - type: choice - options: - - release-pr - - release permissions: {} jobs: - # Create/update the PR with the new version and changelog. + # Create or update the PR with the new version and changelog. release-pr: - name: Create Rust Release PR + name: Create/Update Rust Release PR runs-on: ubuntu-latest - if: ${{ github.repository_owner == 'bitcoindevkit' && inputs.command == 'release-pr' }} + if: ${{ github.repository_owner == 'bitcoindevkit' }} permissions: contents: write # push the release PR branch pull-requests: write # open and update the release PR @@ -60,25 +44,26 @@ jobs: - name: Validate selected branch env: BRANCH: ${{ github.ref_name }} + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} run: | case "$BRANCH" in - master|release/*) ;; - *) echo "Refusing to release from '$BRANCH' (expected 'master' or 'release/*')"; exit 1 ;; + "$DEFAULT_BRANCH"|release/*) ;; + *) echo "Refusing to release from '$BRANCH' (expected '$DEFAULT_BRANCH' or 'release/*')"; exit 1 ;; esac - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: app-id: ${{ secrets.RELEASE_PLZ_APP_ID }} private-key: ${{ secrets.RELEASE_PLZ_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.ref_name }} fetch-depth: 0 persist-credentials: false - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable + uses: actions-rust-lang/setup-rust-toolchain@v2 - name: Install PCSC development libraries run: | sudo apt-get update @@ -90,12 +75,12 @@ jobs: env: GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} - # Publish to crates.io, tag, and create the GitHub release. Gated by the - # `release` environment (team approval). + # If the release PR was merged, publish to crates.io, tag, and create the + # GitHub release. Gated by the `release` environment (team approval). release: name: Publish Rust Release runs-on: ubuntu-latest - if: ${{ github.repository_owner == 'bitcoindevkit' && inputs.command == 'release' }} + if: ${{ github.repository_owner == 'bitcoindevkit' }} environment: release permissions: contents: write # push tags and create GitHub releases @@ -105,25 +90,26 @@ jobs: - name: Validate selected branch env: BRANCH: ${{ github.ref_name }} + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} run: | case "$BRANCH" in - master|release/*) ;; - *) echo "Refusing to release from '$BRANCH' (expected 'master' or 'release/*')"; exit 1 ;; + "$DEFAULT_BRANCH"|release/*) ;; + *) echo "Refusing to release from '$BRANCH' (expected '$DEFAULT_BRANCH' or 'release/*')"; exit 1 ;; esac - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: app-id: ${{ secrets.RELEASE_PLZ_APP_ID }} private-key: ${{ secrets.RELEASE_PLZ_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.ref_name }} fetch-depth: 0 persist-credentials: false - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable + uses: actions-rust-lang/setup-rust-toolchain@v2 - name: Install PCSC development libraries run: | sudo apt-get update diff --git a/.github/workflows/swift-release.yml b/.github/workflows/swift-release.yml index 0bd1689..8016a3b 100644 --- a/.github/workflows/swift-release.yml +++ b/.github/workflows/swift-release.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 721c6fc..450161a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -27,15 +27,14 @@ jobs: - --all-features steps: - name: checkout - uses: actions/checkout@v2 + uses: actions/checkout@v7 - name: Install Rust toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@v2 with: toolchain: ${{ matrix.rust.version }} override: true - profile: minimal - name: Rust Cache - uses: Swatinem/rust-cache@v2.2.1 + uses: Swatinem/rust-cache@v2 - name: Install PCSC development libraries run: | sudo apt-get update @@ -57,17 +56,16 @@ jobs: msrv: true steps: - name: checkout - uses: actions/checkout@v2 + uses: actions/checkout@v7 with: submodules: 'true' - name: Install Rust toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@v2 with: toolchain: ${{ matrix.rust.version }} override: true - profile: minimal - name: Rust Cache - uses: Swatinem/rust-cache@v2.2.1 + uses: Swatinem/rust-cache@v2 - name: Use MSRV Cargo.toml # Don't include "cli" in workspace if using MSRV if: ${{ matrix.rust.msrv }} run: cp Cargo.toml.MSRV Cargo.toml @@ -76,7 +74,7 @@ jobs: sudo apt-get update -y sudo apt-get install -y swig libpcsclite-dev - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.12' - name: Test @@ -93,13 +91,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@v7 - name: Install Rust toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@v2 with: toolchain: nightly - override: true - profile: minimal components: rustfmt - name: Check fmt run: cargo +nightly fmt --all @@ -108,18 +104,15 @@ jobs: name: Clippy check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v1 - - uses: actions-rs/toolchain@v1 + - uses: actions/checkout@v7 + - name: Install Rust toolchain + uses: actions-rust-lang/setup-rust-toolchain@v2 with: - toolchain: stable components: clippy - override: true - name: Rust Cache - uses: Swatinem/rust-cache@v2.2.1 + uses: Swatinem/rust-cache@v2 - name: Install libpcsclite-dev run: sudo apt install libpcsclite-dev - - uses: actions-rs/clippy-check@v1 - with: - token: ${{ secrets.GITHUB_TOKEN }} - args: --all-features --all-targets -- -D warnings + - name: Run clippy + run: cargo clippy --all-features --all-targets -- -D warnings diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bdbc814..0a2e23c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -114,30 +114,28 @@ Releases of the `rust-cktap` crate are automated with [release-plz](https://rele `rust-cktap` library crate is released this way; `cktap-cli` and `cktap-ffi` are excluded (they cannot be published to crates.io). -1. Commits must follow [conventional commits](https://www.conventionalcommits.org) - (e.g. `feat:`, `fix:`, `fix!:`) so the changelog is generated correctly. -2. To prepare a release, run the `Release-plz` workflow manually from the - Actions tab: select the branch to release from (`master` or a `release/*` - branch) in the "Run workflow" dropdown and choose the `release-pr` command. - The `bitcoindevkit-release-plz` GitHub App opens or updates a release PR - targeting that branch with the version bump and changelog. Re-run it to - refresh the PR after new commits land. -3. A maintainer reviews and merges the release PR. -4. Run the `Release-plz` workflow again with command `release` on the same - branch. The job waits for approval from a member of the - `@bitcoindevkit/rust-cktap-release` team (the `release` GitHub - environment). Once approved it publishes to crates.io via trusted publishing - and creates the `rust-cktap-vX.Y.Z` git tag and GitHub release. - -The plain `vX.Y.Z` tag namespace is reserved for Swift package releases -(see `.github/workflows/swift-release.yml`). - -To cut a maintenance release from a `release/*` branch (e.g. backporting a fix -to a prior major version), cherry-pick `release-plz.toml` and -`.github/workflows/release-plz.yml` onto the branch when creating it (the run -uses the workflow file from the branch selected in the dropdown), then select -that branch when running the workflow. Don't prepare releases on two branches -concurrently — release-plz supports only one open release PR per repository. +1. Commits must follow [conventional commits](https://www.conventionalcommits.org) + (e.g. `feat:`, `fix:`, `fix!:`) so the changelog is generated correctly. +2. Run the `Release-plz` workflow manually from the Actions tab: select the + branch to release from (the default branch or a `release/*` branch) in the + "Run workflow" dropdown and click "Run workflow". The workflow runs both the + `release-pr` and `release` jobs; the `bitcoindevkit-release-plz` GitHub App + opens or updates a release PR targeting that branch, while the `release` job + only publishes if the release PR has already been merged. Re-run it to refresh + the PR after new commits land. +3. A maintainer reviews and merges the release PR. +4. Run the `Release-plz` workflow again on the same branch. The `release` job + waits for approval from a member of the `@bitcoindevkit/rust-cktap-release` + team. Once approved it publishes to crates.io via trusted publishing and creates + the `rust-cktap-vX.Y.Z` git tag and GitHub release. + +The plain `vX.Y.Z` tag namespace is reserved for Swift package releases +(see `.github/workflows/swift-release.yml`). + +To cut a maintenance release from a `release/*` branch (e.g. backporting a fix +to a prior major version), select that branch when running the workflow. Don't +prepare releases on two branches concurrently — release-plz supports only one open +release PR per repository. Going further -------------