codex/.github/workflows/release.yml at main · owngoal-dev/codex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# Tag vX.Y.Z → build the roothide and rootless packages and attach both, plus
# their digests, to a GitHub Release.
#
# The release is what owngoal-packages scans. It looks for the newest release
# that is neither a draft nor a prerelease and whose tag carries no
# alpha/beta/rc/preview/dev/nightly marker, then picks the asset whose name ends
# in the architecture it wants and verifies it against SHA256SUMS.

name: Release

on:
  push:
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deb:
    runs-on: macos-26
    # V8 is built from source for the Code Mode host; 0.152.1 needed more
    # than the 180 minutes earlier releases fit in. 360 is GitHub's ceiling.
    timeout-minutes: 360

    steps:
      - name: Check out codex
        uses: actions/checkout@v4

      - name: Select newest Xcode
        run: |
          latest="$(find /Applications -maxdepth 1 -type d -name 'Xcode*.app' -print | sort -V | tail -n1)"
          sudo xcode-select -s "$latest/Contents/Developer"
          xcodebuild -version
          xcrun --sdk iphoneos --show-sdk-version

      - name: Install packaging tools
        run: |
          brew install ldid dpkg
          ldid -h 2>&1 | head -n1 || true
          dpkg-deb --version | head -n1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.95.0"
          targets: aarch64-apple-ios

      - name: Set version from tag
        if: github.ref_type == 'tag'
        run: make set-version VERSION="${GITHUB_REF_NAME}"

      - name: Validate scripts, config, and patch set
        run: make check

      - name: Prepare patched source
        run: make source

      - name: Build packages
        run: make debs

      - name: Summarize
        run: |
          cd build/Packages
          {
            echo "### codex $(make -C "$GITHUB_WORKSPACE" --no-print-directory print-version)"
            echo
            echo "upstream: \`$(make -C "$GITHUB_WORKSPACE" --no-print-directory print-upstream)\`"
            echo
            echo '```'
            cat SHA256SUMS
            echo '```'
            echo
            dpkg-deb -I ./*iphoneos-arm64.deb | sed 's/^/    /'
          } >>"$GITHUB_STEP_SUMMARY"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: codex-debs
          path: |
            build/Packages/*.deb
            build/Packages/SHA256SUMS
          if-no-files-found: error

      - name: Create GitHub Release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ./scripts/release-notes.sh "${GITHUB_REF_NAME}" >/tmp/release-notes.md
          gh release create "${GITHUB_REF_NAME}" \
            --title "codex ${GITHUB_REF_NAME}" \
            --notes-file /tmp/release-notes.md \
            build/Packages/*.deb build/Packages/SHA256SUMS \
          || { gh release edit "${GITHUB_REF_NAME}" --notes-file /tmp/release-notes.md &&
               gh release upload "${GITHUB_REF_NAME}" \
                 build/Packages/*.deb build/Packages/SHA256SUMS --clobber; }