rootform/.github/workflows/installation-qualification.yml at dev · rootform-dev/rootform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: installation qualification

on:
  workflow_dispatch:
    inputs:
      version:
        description: Exact existing Rootform candidate version
        required: true
        type: string
      release_id:
        description: Exact existing draft candidate release ID
        required: true
        type: string
  workflow_call:
    inputs:
      version:
        required: true
        type: string
      release_id:
        required: true
        type: string

permissions:
  contents: write

jobs:
  native-installation:
    name: install ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: linux_amd64
            runner: ubuntu-24.04
          - target: linux_arm64
            runner: ubuntu-24.04-arm
          - target: darwin_amd64
            runner: macos-15-intel
          - target: darwin_arm64
            runner: macos-15
          - target: windows_amd64
            runner: windows-2025
    steps:
      - name: Check out distribution
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install exact Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Download exact existing draft candidate
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_ID: ${{ inputs.release_id }}
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          [[ "$RELEASE_ID" =~ ^[1-9][0-9]*$ ]]
          release="$(gh api "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID")"
          jq -e --arg version "v$ROOTFORM_VERSION" \
            '.draft == true and .prerelease == ($version | contains("-")) and .tag_name == $version and
             (.target_commitish | test("^[0-9a-f]{40}$"))' <<<"$release" >/dev/null
          mkdir -p build/release
          gh release download "v$ROOTFORM_VERSION" --repo "$GITHUB_REPOSITORY" --dir build/release
          bun scripts/generate-installation.ts \
            --version "$ROOTFORM_VERSION" \
            --release build/release \
            --output build/installers

      - name: Qualify native installer against localhost candidate
        shell: bash
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
          ROOTFORM_TARGET: ${{ matrix.target }}
        run: >-
          bun scripts/qualify-installation.ts
          --version "$ROOTFORM_VERSION"
          --release build/release
          --platform "$ROOTFORM_TARGET"
          --evidence "build/installation-evidence/$ROOTFORM_TARGET.json"

      - name: Upload installation evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-installation-${{ inputs.version }}-${{ matrix.target }}
          path: |
            build/installation-evidence/${{ matrix.target }}.json
            build/installation-evidence/${{ matrix.target }}-package.json
          if-no-files-found: warn
          retention-days: 30