From 0acbebf97ce7e55bbb0ee92be7a4759e22661d8e Mon Sep 17 00:00:00 2001 From: TX-RX Date: Wed, 8 Jul 2026 12:20:32 -0500 Subject: [PATCH] Modernize CI, add release automation, enable Dependabot Build workflow: - Bump actions/checkout, actions/cache, actions/setup-node to v4; pnpm/action-setup to v4. - Bump Node.js 18 -> 22, pnpm 8 -> 10. - Bump ubuntu-22.04 -> ubuntu-24.04 and macos-13 -> macos-14 (the older images are on GitHub's deprecation path). - Trigger on push to main, PRs to main, tag pushes matching v*, and workflow_dispatch (manual trigger from the Actions tab). - Drop the `cargo update` step in each build so builds are reproducible against the committed Cargo.lock. Dependency bumps should come via Dependabot PRs, not silently on every push. New release job in the same workflow: - Runs only on tag pushes (refs/tags/v*). - Depends on all three platform builds. - Downloads their artifacts and publishes a GitHub Release with auto-generated notes and all binaries attached. - Uses least-privilege permissions (contents: write only for release). Dependabot config: - Weekly updates for cargo, npm (client/), and github-actions. - Group minor+patch bumps to keep PR noise down; majors surface individually so they get real review. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/dependabot.yml | 29 ++++++++++ .github/workflows/build.yml | 104 ++++++++++++++++++++++++++---------- 2 files changed, 104 insertions(+), 29 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..e1cafccb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 +updates: + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + cargo-minor-patch: + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: /client + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + npm-minor-patch: + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4f54eb0d..a764b584 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,20 +1,27 @@ name: Build -on: [push, pull_request] +on: + push: + branches: [main] + tags: ['v*'] + pull_request: + branches: [main] + workflow_dispatch: + permissions: contents: read jobs: build-linux: name: Linux - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Rust Cache - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: | ~/.cargo/bin/ @@ -30,14 +37,14 @@ jobs: sudo apt install -y lld autogen libasound2-dev pkg-config make libssl-dev gcc g++ curl wget git libwebkit2gtk-4.1-dev - name: Install NodeJS - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: - node-version: 18 + node-version: 22 - name: Install pnpm - uses: pnpm/action-setup@v2 + uses: pnpm/action-setup@v4 with: - version: 8 + version: 10 - name: Build run: | @@ -45,7 +52,6 @@ jobs: pnpm i pnpm run build cd .. - cargo update cargo build --release - name: Bundle @@ -55,13 +61,13 @@ jobs: mkdir dist mv OneTagger-linux.tar.gz dist/ mv OneTagger-linux-cli.tar.gz dist/ - + - name: Upload Linux uses: actions/upload-artifact@v4 with: name: onetagger-linux path: dist/OneTagger-linux.tar.gz - + - name: Upload Linux CLI uses: actions/upload-artifact@v4 with: @@ -72,13 +78,13 @@ jobs: build-win: name: Windows runs-on: windows-2022 - + steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Rust Cache - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: | ~/.cargo/bin/ @@ -89,14 +95,14 @@ jobs: key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - name: Install NodeJS - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: - node-version: 18 + node-version: 22 - name: Install pnpm - uses: pnpm/action-setup@v2 + uses: pnpm/action-setup@v4 with: - version: 8 + version: 10 - name: Install Dependencies run: | @@ -109,9 +115,8 @@ jobs: pnpm i pnpm run build cd .. - cargo update cargo build --release - + - name: Bundle run: | mkdir dist @@ -125,9 +130,9 @@ jobs: uses: actions/upload-artifact@v4 with: name: onetagger-win - path: | + path: | dist/OneTagger-windows.exe - + - name: Upload Archive uses: actions/upload-artifact@v4 with: @@ -143,15 +148,15 @@ jobs: build-mac: name: Mac - runs-on: macos-13 + runs-on: macos-14 steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Rust Cache - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: | ~/.cargo/bin/ @@ -161,19 +166,29 @@ jobs: target/ key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} + - name: Install NodeJS + uses: actions/setup-node@v4 + with: + node-version: 22 + + - name: Install pnpm + uses: pnpm/action-setup@v4 + with: + version: 10 + - name: Install dependencies run: | - brew install rustup nodejs pnpm - rustup install stable + # macos-14 (Apple Silicon) runners come with rustc + cargo preinstalled, + # so we don't need `brew install rustup` (which no longer configures PATH + # the way it used to and was shadowing the preinstalled toolchain). cargo install cargo-bundle --version 0.6.1 --locked || true - + - name: Build run: | cd client pnpm i pnpm run build cd .. - cargo update cargo build --release cargo bundle --release @@ -206,3 +221,34 @@ jobs: name: onetagger-mac-cli path: dist/OneTagger-mac-cli.zip + + release: + name: Publish release + if: startsWith(github.ref, 'refs/tags/v') + needs: [build-linux, build-win, build-mac] + runs-on: ubuntu-24.04 + permissions: + contents: write + + steps: + - name: Download all artifacts + uses: actions/download-artifact@v4 + with: + path: dist + + - name: Create release and upload assets + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.ref_name }} + run: | + # Flatten one level: dist// → dist/ + shopt -s nullglob + for d in dist/*/; do + mv "$d"* dist/ 2>/dev/null || true + rmdir "$d" 2>/dev/null || true + done + gh release create "$TAG" \ + --repo "$GITHUB_REPOSITORY" \ + --title "$TAG" \ + --generate-notes \ + dist/*