fix(spur-core): bound array size before expansion and use checked ste… #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Release Please | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: {} | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| release-please: | |
| name: Release PR and tag | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| # A GitHub App token (not GITHUB_TOKEN) so the release PR triggers CI + E2E | |
| # and the tag push triggers release.yml. | |
| - name: Generate app token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.RELEASE_BOT_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Run release-please | |
| id: release | |
| uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| # The `simple` release type only bumps Cargo.toml + CHANGELOG.md. CI builds with | |
| # --locked, so Cargo.lock must be re-synced on the release PR or the build fails. | |
| - name: Resolve release PR branch | |
| id: pr | |
| if: ${{ steps.release.outputs.pr }} | |
| env: | |
| PR_JSON: ${{ steps.release.outputs.pr }} | |
| run: echo "branch=$(jq -r .headBranchName <<<"$PR_JSON")" >> "$GITHUB_OUTPUT" | |
| - name: Checkout release PR branch | |
| if: ${{ steps.release.outputs.pr }} | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ steps.pr.outputs.branch }} | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| if: ${{ steps.release.outputs.pr }} | |
| run: rustup show | |
| - name: Sync Cargo.lock with bumped workspace version | |
| if: ${{ steps.release.outputs.pr }} | |
| run: | | |
| cargo update --workspace | |
| if git diff --quiet -- Cargo.lock; then | |
| echo "Cargo.lock already in sync." | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add Cargo.lock | |
| git commit -m "chore: sync Cargo.lock" | |
| - name: Push Cargo.lock update | |
| if: ${{ steps.release.outputs.pr }} | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \ | |
| "HEAD:${{ steps.pr.outputs.branch }}" |