rust_binary_publish.yml

name: Publish Release as binary

on:
  workflow_call:
    outputs:
      released:
        description: Was the binary published
        value: "true"
    inputs:
      package:
        description: Name of the package
        type: string
      version:
        description: Version of the package
        type: string
      release_channel:
        description: Release channel of the package
        type: string
      launcher_app_name:
        description: Launcher app name
        type: string
        default: ""
      launcher_fallback_app_name:
        description: Launcher app fallback name
        type: string
        default: ""
      toolchain:
        description: Toolchain to use for making the build
        type: string
        default: "1.76"
      targets:
        description: Binaries Targets
        type: string
        default: "[]"
      additional_args:
        type: string
        default: ""
        description: Additional arguments to pass to the cargo command
      working_directory:
        type: string
        default: "."
        description: Working directory to run the cargo command
      sign_build:
        type: string
        default: "false"
        description: Should the binary bin be signed
      targets_config:
        type: string
        default: '{"x86_64-pc-windows-msvc":{"extension":".exe","runner":"windows-latest-16-cores-custom"},"x86_64-unknown-linux-gnu":{"extension":"","runner":"ubuntu-latest-16-cores"}}'

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: true
  CARGO_HTTP_USER_AGENT: "shipyard ${{ secrets.CARGO_PRIVATE_REGISTRY_TOKEN }}"

permissions:
  id-token: write
  contents: read

jobs:
  build_and_sign_binary:
    name: Release new version as binary
    runs-on: ${{ fromJson(inputs.targets_config)[matrix.target].runner }}
    strategy:
      matrix:
        target: ${{ fromJson(inputs.targets) }}
    steps:
      - name: Set start time as env variable
        id: start_time
        shell: bash
        run: echo "value=$(date +'%s')000" >> $GITHUB_OUTPUT
      - name: Checkout
        uses: actions/checkout@v4
      - name: Cache Dependencies
        uses: Swatinem/rust-cache@v2
        with:
          env-vars: ""
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{  inputs.toolchain }}
      - uses: ForesightMiningSoftwareCorporation/github/.github/actions/login-private-registry@v3.2.0
        with:
          private_key: ${{ secrets.CARGO_PRIVATE_REGISTRY_SSH_PRIVATE_KEY }}
          host: ${{ secrets.CARGO_PRIVATE_REGISTRY_HOST }}
          name: ${{ secrets.CARGO_PRIVATE_REGISTRY_NAME }}
          token: ${{ secrets.CARGO_PRIVATE_REGISTRY_TOKEN }}
          cos_username: ${{ secrets.CARGO_COS_PRIVATE_REGISTRY_USERNAME }}
          cos_password: ${{ secrets.CARGO_COS_PRIVATE_REGISTRY_PASSWORD }}
          cos_tenant: ${{ secrets.CARGO_COS_PRIVATE_REGISTRY_TENANT }}
          cos_subscription: ${{ secrets.CARGO_COS_PRIVATE_REGISTRY_SUBSCRIPTION }}
          additional_private_keys: |
            ${{ secrets.FSE_SSH_PRIVATE_KEY }}
            ${{ secrets.BEVY_CLIPMAP_SSH_PRIVATE_KEY }}
            ${{ secrets.DAG_TABLES_SSH_PRIVATE_KEY }}
      - name: Force Static Link on linux
        shell: bash
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: |
          echo RUSTFLAGS="-C target-feature=+crt-static" >> $GITHUB_ENV
      - name: Build Binary
        shell: bash
        working-directory: ${{ inputs.working_directory }}
        run: cargo build --profile release --target=${{ matrix.target }} --features ${{inputs.release_channel}} ${{ inputs.additional_args }}
        env:
          CARGO_TARGET_DIR: target
          LAUNCHER_APP_NAME: ${{ inputs.launcher_app_name }}
          LAUNCHER_APP_FALLBACK: ${{  inputs.launcher_fallback_app_name }}
      - name: Copy to bin artifact folder
        shell: bash
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        working-directory: ${{ inputs.working_directory }}
        run: |
          artifacts_dir=${{ runner.temp }}/bin_output/${{  inputs.package }}/${{ inputs.release_channel }}
          mkdir -p $artifacts_dir
          cp target/${{ matrix.target }}/release/${{  inputs.package }}${{ fromJson(inputs.targets_config)[matrix.target].extension }} $artifacts_dir/${{  inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain }}-v${{  inputs.version }}${{ fromJson(inputs.targets_config)[matrix.target].extension }}
          sha512sum $artifacts_dir/${{  inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain }}-v${{  inputs.version }}${{ fromJson(inputs.targets_config)[matrix.target].extension }} | awk '{ print $1 }' >> $artifacts_dir/${{  inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}-sha-512.txt
      - name: Copy to bin folder windows
        if: matrix.target == 'x86_64-pc-windows-msvc'
        shell: pwsh
        working-directory: ${{ inputs.working_directory }}
        run: |
          $Out = New-Item -Path "${{ runner.temp }}\bin_output\${{  inputs.package }}\${{ inputs.release_channel }}" -ItemType "directory"
          Copy-Item target\${{ matrix.target }}\release\${{  inputs.package }}${{ fromJson(inputs.targets_config)[matrix.target].extension }} $Out\${{   inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}${{ fromJson(inputs.targets_config)[matrix.target].extension }}
          $hash = Get-FileHash "$Out\${{   inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}${{ fromJson(inputs.targets_config)[matrix.target].extension }}" -Algorithm SHA512
          echo $hash.Hash >> "$Out\${{   inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}-sha512.txt"

      - name: Upload unsigned artifacts to Prod Azure Blob Upload
        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.1.0
        with:
          container_name: ${{ vars.ARTIFACTS_CONTAINER }}
          connection_string: ${{ secrets.ARTIFACTS_CONNECTION_STRING }}
          source_folder: ${{ runner.temp }}/bin_output
          delete_if_exists: true

      - name: Upload unsigned artifacts to Dev Azure Blob Upload
        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.1.0
        with:
          container_name: ${{ vars.DEV_ARTIFACTS_CONTAINER }}
          connection_string: ${{ secrets.DEV_ARTIFACTS_CONNECTION_STRING }}
          source_folder: ${{ runner.temp }}/bin_output
          delete_if_exists: true

      - name: Generate Expiry for SAS Url
        if: inputs.sign_build == 'true'
        shell: bash
        id: sas-expiry
        run: |
          echo "expiry=$(date -u -d "120 minutes" '+%Y-%m-%dT%H:%MZ')" >> $GITHUB_OUTPUT
      - name: Generate SAS Url for binary signing
        if: inputs.sign_build == 'true'
        shell: bash
        id: sas-url
        run: |
          sas=$(az storage blob generate-sas --connection-string "${{ secrets.ARTIFACTS_CONNECTION_STRING }}" --container-name ${{ vars.ARTIFACTS_CONTAINER }} --name ${{  inputs.package }}/${{ inputs.release_channel }}/${{  inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}${{ fromJson(inputs.targets_config)[matrix.target].extension }} --permissions r --expiry ${{ steps.sas-expiry.outputs.expiry }} --https-only --full-uri --output tsv)
          echo "sas=$sas" >> $GITHUB_OUTPUT

      - name: Retrieve signing secret from Vault
        if: inputs.sign_build == 'true'
        id: import-signing-secrets
        uses: hashicorp/vault-action@v3.0.0
        with:
          method: jwt
          url: ${{ vars.VAULT_ADDR }}
          path: github
          role: whirlpool-installer
          secrets: |
            kv-v2/data/whirlpool/signer APP_ID | WHIRLPOOL_SIGNER_APP_ID ;
            kv-v2/data/whirlpool/signer APP_PRIVATE_KEY | WHIRLPOOL_SIGNER_APP_PRIVATE_KEY ;
            kv-v2/data/whirlpool/signer APP_INSTALLATION_ID | WHIRLPOOL_SIGNER_APP_INSTALLATION_ID ;
            kv-v2/data/whirlpool/signer REPOSITORY | WHIRLPOOL_SIGNER_REPOSITORY ;

      - id: generate_token
        name: Generate token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ steps.import-signing-secrets.outputs.WHIRLPOOL_SIGNER_APP_ID }}
          private_key: ${{ steps.import-signing-secrets.outputs.WHIRLPOOL_SIGNER_APP_PRIVATE_KEY }}
          installation_retrieval_mode: id
          installation_retrieval_payload: ${{ steps.import-signing-secrets.outputs.WHIRLPOOL_SIGNER_APP_INSTALLATION_ID }}

      - name: Trigger signer workflow
        uses: ForesightMiningSoftwareCorporation/action-trigger-signer-workflow@main
        id: signer-workflow
        if: inputs.sign_build == 'true'
        with:
          token: ${{ steps.generate_token.outputs.token }}
          signer_repository: ${{ steps.import-signing-secrets.outputs.WHIRLPOOL_SIGNER_REPOSITORY }}
          sas_url: ${{ steps.sas-url.outputs.sas }}
          artifact_to_sign: "${{  inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}-signed${{ fromJson(inputs.targets_config)[matrix.target].extension }}"
          blob_dir: "${{  inputs.package }}/${{ inputs.release_channel }}"

      - name: Generate signed artifacts checksum windows
        if: inputs.sign_build == 'true'
        shell: pwsh
        run: |
          $hash = Get-FileHash "${{ runner.temp }}\signed_artifacts\${{  inputs.package }}\${{ inputs.release_channel }}\${{   inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}-signed${{ fromJson(inputs.targets_config)[matrix.target].extension }}" -Algorithm SHA512
          echo $hash.Hash >> "${{ runner.temp }}\signed_artifacts\${{  inputs.package }}\${{ inputs.release_channel }}\${{   inputs.package }}-${{ matrix.target }}-${{  inputs.toolchain}}-v${{  inputs.version }}-signed-sha512.txt"

      - name: Upload signed bin to github artifacts
        if: inputs.sign_build == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: release-binaries-signed-${{ inputs.package }}-${{ matrix.target }}
          path: ${{ runner.temp }}/signed_artifacts
          overwrite: true

      - name: Upload signed artifacts to Dev Azure Blob Upload
        if: inputs.sign_build == 'true' #&& inputs.release_channel == 'dev'
        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.1.0
        with:
          container_name: ${{ vars.DEV_ARTIFACTS_CONTAINER }}
          connection_string: ${{ secrets.DEV_ARTIFACTS_CONNECTION_STRING }}
          source_folder: ${{ runner.temp }}/signed_artifacts
          delete_if_exists: true

      - name: Upload signed artifacts to Prod Azure Blob Upload
        if: inputs.sign_build == 'true' #&& inputs.release_channel == 'prod'
        id: upload
        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.1.0
        with:
          container_name: ${{ vars.ARTIFACTS_CONTAINER }}
          connection_string: ${{ secrets.ARTIFACTS_CONNECTION_STRING }}
          source_folder: ${{ runner.temp }}/signed_artifacts
          delete_if_exists: true

      - name: Write outputs to file
        shell: bash
        if: always()
        working-directory: ${{ runner.temp }}
        run: |
          tee -a ${{ inputs.package }}-rust-binary-publish.json <<EOF
          {
            "name": "${{ inputs.package }}",
            "start_time": "${{ steps.start_time.outputs.value }}",
            "end_time": "$(date +'%s')000",
            "working_directory": "${{ inputs.working_directory }}",
            "type": "rust-binary-publish",
            "server_url": "${{ github.server_url }}",
            "repository": "${{ github.repository }}",
            "run_id": "${{ github.run_id }}",
            "run_attempt": "${{ github.run_attempt }}",
            "actor": "${{ github.actor }}",
            "event_name": "${{ github.event_name }}",
            "outputs": {
              "released": ${{ steps.upload.outcome == 'success' && true || false }},
              "version": "${{ inputs.version }}",
              "release_channel": "${{ inputs.release_channel }}",
              "sha": "${{ github.sha }}"
            }
          }
          EOF
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: fslabs__publishing__${{ github.run_id }}__${{ github.run_attempt }}__${{ inputs.package }}-rust-binary-publish
          path: ${{ runner.temp }}/${{ inputs.package }}-rust-binary-publish.json