ci: add build workflow (#9)

Signed-off-by: Mogyuchi <[email protected]>

.github/files/build/Dockerfile

@@ -0,0 +1,14 @@
+# syntax=docker/dockerfile:1.6.0@sha256:ac85f380a63b13dfcefa89046420e1781752bab202122f8f50032edf31be0021
+
+FROM --platform=$BUILDPLATFORM busybox:1.36.1-uclibc@sha256:e8d8e7858e1c9d9e24e804e8fea4ca2febeec0ad10e83664526a9f657afe3730 AS env
+ARG TARGETPLATFORM
+RUN --mount=type=bind,source=artifact,target=artifact \
+    if [ "$TARGETPLATFORM" = 'linux/amd64' ]; then\
+      cp artifact/x86_64-unknown-linux-musl/binary .\
+    ;elif [ "$TARGETPLATFORM" = 'linux/arm64' ]; then\
+      cp artifact/aarch64-unknown-linux-musl/binary .\
+    ;fi
+
+FROM scratch as runner
+COPY --from=env --chmod=755 binary .
+ENTRYPOINT ["./binary"]

.github/workflows/build.yml

@@ -0,0 +1,139 @@
+name: build
+on:
+  push:
+    branches: [main]
+    tags: [v*.*.*]
+  pull_request:
+  workflow_call:
+    inputs:
+      tag-name:
+        required: true
+        type: string
+    outputs:
+      image_tags:
+        value: ${{ jobs.docker.outputs.image_tags }}
+      image_url:
+        value: https://ghcr.io/${{ github.repository }}
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  BINARY_NAME: ${{ github.event.repository.name }}
+
+jobs:
+  build:
+    if: ${{ !( github.workflow == 'build' && startsWith(github.event.head_commit.message, 'release:') && github.event.head_commit.author.name == 'github-actions[bot]' ) }}
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [aarch64-unknown-linux-gnu, aarch64-unknown-linux-musl]
+        use-cross: [true]
+        include:
+          - target: x86_64-unknown-linux-gnu
+            use-cross: false
+          - target: x86_64-unknown-linux-musl
+            use-cross: false
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: macos-latest
+            target: x86_64-apple-darwin
+    runs-on: ${{ matrix.os || 'ubuntu-latest'}}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    defaults:
+      run:
+        shell: bash -xe {0}
+    steps:
+      - name: Install musl tools
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          sudo apt-get install -y musl-tools --no-install-recommends
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          target: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1
+        with:
+          key: ${{ matrix.target }}
+      - name: Install cross
+        if: ${{ !matrix.os && matrix.use-cross }}
+        uses: taiki-e/install-action@26a2a392a921ac4a120a3a72545b2fa9dcdc290c # v2.22.6
+        with:
+          tool: cross
+      - run: mkdir dist
+      - run: ${{ (!matrix.os && matrix.use-cross) && 'cross' || 'cargo' }} rustc --locked --release --target=${{ matrix.target }} -- --emit=link=dist/binary
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
+        with:
+          name: ${{ matrix.target }}
+          path: |
+            dist/binary
+            dist/binary.exe
+      - name: Upload to release
+        if: ${{ inputs.tag-name }}
+        working-directory: dist/
+        run: |
+          if [ -e binary.exe ]; then
+            filename="${{ env.BINARY_NAME }}-${{ inputs.tag-name }}-${{ matrix.target }}.exe"
+            mv binary.exe "$filename"
+            gh release upload ${{ inputs.tag-name }} "$filename"#${{ matrix.target }} --clobber
+          else
+            filename="${{ env.BINARY_NAME }}-${{ inputs.tag-name }}-${{ matrix.target }}"
+            mv binary "$filename"
+            gh release upload ${{ inputs.tag-name }} "$filename"#${{ matrix.target }} --clobber
+          fi
+  docker:
+    needs: build
+    permissions:
+      packages: write
+    runs-on: 'ubuntu-latest'
+    outputs:
+      image_tags: ${{ steps.meta.outputs.tags }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          sparse-checkout: |
+            .github/files/build/Dockerfile
+          sparse-checkout-cone-mode: false
+      - name: Download build artifact
+        uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4 # v4.0.0
+        with:
+          path: artifact
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9dc751fe249ad99385a2583ee0d084c400eee04e # v5.4.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}},value=${{ inputs.tag-name }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.tag-name }}
+            type=semver,pattern={{major}},value=${{ inputs.tag-name }},enable=${{ !(startsWith(github.ref, 'refs/tags/v0.') || startsWith(inputs.tag-name, 'v0.')) }}
+            type=edge
+            type=ref,event=branch
+      - name: Build and push Docker image
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
+        with:
+          context: .
+          file: .github/files/build/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release-please.yml

@@ -6,6 +6,7 @@ name: release-please
 
 jobs:
   release-please:
+    if: github.repository_owner == '4m-mazi'
     permissions:
       contents: write
       pull-requests: write
@@ -19,3 +20,38 @@ jobs:
         with:
           config-file: .github/files/release-please/release-please-config.json
           manifest-file: .github/files/release-please/.release-please-manifest.json
+
+  docker-publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    permissions:
+      contents: write
+      packages: write
+    uses: ./.github/workflows/build.yml
+    with:
+      tag-name: ${{ needs.release-please.outputs.tag_name }}
+
+  follow_up-pr:
+    needs: [release-please, docker-publish]
+    if: ${{ needs.release-please.outputs.release_created }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create published label
+        run: |
+          gh label create 'autorelease: published' --color=EDEDED || true
+      - name: Get PR number
+        id: pr-number
+        run: |
+          echo "pr_number=$(printf '${{ github.event.head_commit.message }}' | head -n1 | sed -nE 's/.+\(#([0-9]+)\)$/\1/p')" >> "$GITHUB_OUTPUT"
+      - name: Add comment to PR
+        run: |
+          printf ':robot: Successfully published to ${{ needs.docker-publish.outputs.image_url }} :truck:\n```\n${{ join(needs.docker-publish.outputs.image_tags, '\n') }}\n```' \
+          | gh pr comment ${{ steps.pr-number.outputs.pr_number }} --body-file=-
+      - name: Change labels on PR
+        run: |
+          gh pr edit ${{ steps.pr-number.outputs.pr_number }} \
+          --remove-label='autorelease: tagged' \
+          --add-label='autorelease: published'