initial commit

.forgejo/workflows/ci.yml

@@ -0,0 +1,131 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+    tags: ['v*']
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  # Each crate root sets `#![warn(clippy::pedantic)]` and is clean under it;
+  # `-D warnings` keeps it so by turning any lint that ever fires into a
+  # failed job rather than a line in a log that nobody reads, a warning
+  # tolerated being a warning inherited. The lockfile is committed, so every
+  # cargo invocation below is `--locked`: it resolves exactly what the tree
+  # says or refuses to resolve at all, and a dependency that drifted would
+  # fail here rather than ship.
+  RUSTFLAGS: "-D warnings"
+
+jobs:
+  lint:
+    runs-on: lo-runner
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: cargo fmt
+        run: cargo fmt --all --check
+
+      - name: cargo clippy
+        run: cargo clippy --workspace --all-targets --locked --message-format=short
+
+      - name: cargo doc (no deps)
+        run: cargo doc --workspace --no-deps --document-private-items --locked
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+
+      - name: cargo audit
+        run: cargo audit
+
+  test:
+    runs-on: lo-runner
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: cargo test
+        run: cargo test --workspace --locked
+
+  build:
+    runs-on: lo-runner
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      # The workspace states its version once, in one place; a tag that
+      # disagrees with it publishes nothing, and says so. Two sources of
+      # truth for one number is one more than the calendar tolerates.
+      - name: The tag names the version
+        run: |
+          version=$(cargo pkgid -p loic | sed 's/.*[#@]//')
+          echo "workspace version $version, ref $GITHUB_REF"
+          case "$GITHUB_REF" in
+            refs/tags/v*)
+              tag=${GITHUB_REF#refs/tags/}
+              [ "$tag" = "v$version" ] || {
+                echo "::error::the tag says $tag and the workspace says $version; one of them is wrong and neither is publishing"
+                exit 1
+              } ;;
+          esac
+
+      - name: cargo build --release
+        run: cargo build --release --locked -p loic-cli -p loic-gui
+
+      # What crates.io would receive, rehearsed on every push rather than
+      # discovered on the tag, when it would be too late to be told.
+      - name: cargo publish --dry-run
+        run: cargo publish --dry-run --locked -p loic -p loid
+
+  publish:
+    needs: [lint, test, build]
+    runs-on: lo-runner
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      # One invocation: cargo publishes `loic`, waits for the index to admit
+      # it, then publishes `loid` against it — the order the dependency runs
+      # in, which is the only order that works.
+      - name: Publish loic and loid
+        run: cargo publish --locked -p loic -p loid
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+
+  release:
+    needs: [lint, test, build]
+    runs-on: lo-runner
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Build the oracle and the Observatory
+        run: cargo build --release --locked -p loic-cli -p loic-gui
+
+      # The artifacts are the two binaries, exactly as built, and their
+      # checksums: nothing repackaged, and nothing stripped that the release
+      # profile did not strip itself.
+      - name: Collect the binaries
+        run: |
+          set -eu
+          version=${GITHUB_REF#refs/tags/v}
+          target=$(rustc -vV | sed -n 's/^host: //p')
+          mkdir -p dist
+          cp target/release/loic-cli target/release/loic-gui dist/
+          (cd dist && sha256sum loic-cli loic-gui | tee SHA256SUMS)
+
+          cat > release-notes.md <<EOF
+          The Loic Calendar $version.
+
+          \`loic\` and \`loid\` are on crates.io at this version. Below are the two binaries: the oracle (\`loic-cli\`) and the Observatory (\`loic-gui\`), each a single binary, built for \`$target\` exactly as the release profile left them. Both need Linux with \`CLOCK_TAI\` and a kernel that has been told the TAI offset; the Observatory also needs Wayland and a GPU. On a kernel whose offset is zero they open, say why, and observe nothing, which is the correct number of observations to make through a clock that is lying. The Observatory's icon and desktop entry are an optional step in its README. Checksums are in \`SHA256SUMS\`.
+          EOF
+
+      - name: Attach them to the release
+        uses: https://code.forgejo.org/actions/forgejo-release@v2
+        with:
+          direction: upload
+          url: ${{ github.server_url }}
+          repo: ${{ github.repository }}
+          tag: ${{ github.ref_name }}
+          release-dir: dist
+          release-notes-file: release-notes.md
+          token: ${{ secrets.GITHUB_TOKEN }}
+          override: true
+          prerelease: ${{ contains(github.ref_name, '-') }}