build.yml

name: Binary Build
on:
  push:
    branches:
      - main  
  pull_request:
    branches:
      - main

jobs:
  metadata:
    name: Check if version changed
    runs-on: ubuntu-latest
    outputs:
      optimize-build: ${{ github.event_name == 'push' }}
      release: ${{ github.repository == 'Quantco/conda-deny' && steps.version-metadata.outputs.changed == 'true' }}
      version: ${{ steps.version-metadata.outputs.newVersion }}
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4
      - uses: Quantco/ui-actions/version-metadata@a0653e9fc0ee3c4be9f7cc88e509e40536e9f3c1
        id: version-metadata
        with:
          file: ./Cargo.toml
          token: ${{ secrets.GITHUB_TOKEN }}
          version-extraction-override: 'regex:version = "(.*)"'

  build:
    name: Build Binary (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    needs: [metadata]
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            cross: true
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            cross: true
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            cross: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            cross: true
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            cross: false
          - target: aarch64-apple-darwin
            os: macos-latest
            cross: false
          - target: x86_64-apple-darwin
            os: macos-13
            cross: false
    env:
      # These are some environment variables that configure the build so that the binary size is reduced.
      # Inspiration was taken from this blog: https://arusahni.net/blog/2020/03/optimizing-rust-binary-size.html
      # They only enable it on main and releases.

      # Enable Link Time Optimization (LTO) for our release builds. This increases link time but drastically reduces
      # binary size.
      CARGO_PROFILE_RELEASE_LTO: ${{ needs.metadata.outputs.optimize-build }}

      # Use a single code gen unit. This effectively disables parallel linking but ensures that everything is linked
      # together in a single unit which reduces the file-size at the cost of link time.
      # Default for a release build is 16
      CARGO_PROFILE_RELEASE_CODEGEN_UNITS: ${{ needs.metadata.outputs.optimize-build && 1 || 16 }}

      # Strip the binaries. This reduces the filesize of the final release.
      CARGO_PROFILE_RELEASE_STRIP: ${{ needs.metadata.outputs.optimize-build && 'symbols' || 'false' }}

      # Optimize the binary for size. This reduces the filesize at the cost of a slower binary.
      CARGO_PROFILE_OPT_LEVEL: ${{ needs.metadata.outputs.optimize-build && 's' || '0' }}
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84
        with:
          key: build-${{ matrix.target }}-${{ needs.metadata.outputs.optimize-build }}-${{ matrix.cross }}-${{ matrix.os }}

      - name: Install cross
        if: matrix.cross
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Build
        run: |
          ${{ matrix.cross && 'cross' || 'cargo' }} build --release --color always${{ endsWith(matrix.target, 'musl') && ' --no-default-features --features rustls-tls' || '' }} --target ${{ matrix.target }}
          mv target/${{ matrix.target }}/release/conda-deny${{ endsWith(matrix.target, 'windows-msvc') && '.exe' || '' }} conda-deny-${{ matrix.target }}${{ endsWith(matrix.target, 'windows-msvc') && '.exe' || '' }}

      - name: Upload Artifact
        uses: actions/upload-artifact@v4
        with:
          name: conda-deny-${{ matrix.target }}
          path: conda-deny-${{ matrix.target }}${{ endsWith(matrix.target, 'windows-msvc') && '.exe' || '' }}
          if-no-files-found: error

  release:
    name: Create Release
    needs: [metadata, build]
    if: ${{ needs.metadata.outputs.release == 'true' && github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.TAG_TOKEN }}
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: conda-deny-*
          merge-multiple: true
      - name: Push v${{ needs.metadata.outputs.version }} tag
        run: |
          git tag v${{ needs.metadata.outputs.version }}
          git push origin v${{ needs.metadata.outputs.version }}
      - name: Create Release
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
        with:
          generate_release_notes: true
          tag_name: v${{ needs.metadata.outputs.version }}
          draft: false
          files: conda-deny-*