Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 103 additions & 0 deletions .github/workflows/release-binaries.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
name: Release Binaries

on:
release:
types: [published]

env:
CARGO_TERM_COLOR: always

jobs:
build-and-upload:
name: Build and upload binaries
runs-on: ${{ matrix.os }}

strategy:
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
suffix: ""
- os: ubuntu-latest
target: x86_64-unknown-linux-musl
suffix: ""
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
suffix: ""
- os: windows-latest
target: x86_64-pc-windows-msvc
suffix: .exe
- os: macos-latest
target: x86_64-apple-darwin
suffix: ""
- os: macos-latest
target: aarch64-apple-darwin
suffix: ""

steps:
- name: Checkout repository
uses: actions/checkout@v5

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}

- name: Install cross-compilation tools
if: matrix.target == 'aarch64-unknown-linux-gnu'
run: |
sudo apt-get update
sudo apt-get install -y gcc-aarch64-linux-gnu

- name: Install musl tools
if: matrix.target == 'x86_64-unknown-linux-musl'
run: |
sudo apt-get update
sudo apt-get install -y musl-tools

- name: Configure cross-compilation
if: matrix.target == 'aarch64-unknown-linux-gnu'
run: |
echo 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc' >> $GITHUB_ENV

- name: Build binaries
run: cargo build --release --target ${{ matrix.target }}

- name: Create archive directory
run: mkdir -p artifacts

- name: Prepare binaries (Unix)
if: matrix.os != 'windows-latest'
run: |
cp target/${{ matrix.target }}/release/spongebob${{ matrix.suffix }} artifacts/
cp target/${{ matrix.target }}/release/goodboye${{ matrix.suffix }} artifacts/

- name: Prepare binaries (Windows)
if: matrix.os == 'windows-latest'
run: |
copy target\${{ matrix.target }}\release\spongebob${{ matrix.suffix }} artifacts\
copy target\${{ matrix.target }}\release\goodboye${{ matrix.suffix }} artifacts\

- name: Create tar.gz archive (Unix)
if: matrix.os != 'windows-latest'
run: |
cd artifacts
tar -czf ../spongebob-${{ github.ref_name }}-${{ matrix.target }}.tar.gz *

- name: Create zip archive (Windows)
if: matrix.os == 'windows-latest'
run: |
cd artifacts
7z a ../spongebob-${{ github.ref_name }}-${{ matrix.target }}.zip *

- name: Upload tar.gz to release (Unix)
if: matrix.os != 'windows-latest'
uses: softprops/action-gh-release@v2
with:
files: ./spongebob-${{ github.ref_name }}-${{ matrix.target }}.tar.gz

- name: Upload zip to release (Windows)
if: matrix.os == 'windows-latest'
uses: softprops/action-gh-release@v2
with:
files: ./spongebob-${{ github.ref_name }}-${{ matrix.target }}.zip
Comment on lines +12 to +103

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 7 months ago

The best way to fix this is to explicitly declare a minimal permissions block at the job level for build-and-upload in .github/workflows/release-binaries.yaml. Since this job only uploads binaries to releases, the smallest necessary permission is contents: write (needed by softprops/action-gh-release to upload release assets). If future jobs only need to read the repository, contents: read would suffice for those, but for this job, contents: write is required.
To implement this, add a permissions: section under build-and-upload at the same indentation level as name: (line 12). No new methods, imports, or special definitions are needed—just an update to the YAML structure.


Suggested changeset 1
.github/workflows/release-binaries.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml
--- a/.github/workflows/release-binaries.yaml
+++ b/.github/workflows/release-binaries.yaml
@@ -10,6 +10,8 @@
 jobs:
   build-and-upload:
     name: Build and upload binaries
+    permissions:
+      contents: write
     runs-on: ${{ matrix.os }}
     
     strategy:
EOF
@@ -10,6 +10,8 @@
jobs:
build-and-upload:
name: Build and upload binaries
permissions:
contents: write
runs-on: ${{ matrix.os }}

strategy:
Copilot is powered by AI and may make mistakes. Always verify output.
4 changes: 4 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ repository = "https://github.com/asasine/spongebob"
license = "MIT"
categories = ["command-line-utilities", "text-processing"]

[package.metadata.binstall]
pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-{ target }.{ archive-format }"
bin-dir = "{ bin }{ binary-ext }"

[dependencies]
anstyle = "1.0.7"
clap = { version = "4.5", features = ["derive", "unicode"] }
Expand Down
7 changes: 7 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,13 @@ You can copy to the clipboard with existing utilities:
- WSL: `spongebob foo | clip.exe`

# Installation

## Using cargo-binstall (recommended)
```bash
cargo binstall spongebob
```

## Using cargo install
```bash
cargo install spongebob
```
Expand Down