name: package-and-upload
description: >-
Write the third-party licensing kit into `bundle/`, gate the result
against `resources/third-party.json`, then tar/zip `bundle/` into a
platform-specific archive, compute its SHA256, stage everything
under `artefacts/`, and upload as a GHA artifact for the
release-publish job to collect.
The licensing steps live here rather than in each build workflow on
purpose: this action is the single choke point every lane goes
through on its way to producing an archive, so a new lane cannot be
added that ships an unaudited pack, and a lane cannot be edited to
skip the gate without also losing its upload.
inputs:
artifact-name:
description: >-
Archive basename without extension, e.g. `notcurses-macos-arm64`
or `notcurses-linux-x86_64-musl`. Also used as the
actions/upload-artifact name.
required: true
platform:
description: >-
`macos`, `linux` or `windows` — which set of basename patterns in
resources/third-party.json describes this pack. Both Linux lanes
pass `linux`: glibc and musl packs have the same file inventory
because neither bundles a libc.
required: true
format:
description: '`tar.gz` (Unix) or `zip` (Windows).'
required: true
shell:
description: >-
Shell to use for the packaging script. Defaults to `bash`. The
Windows lane sets this to `msys2 {0}` so the `zip` utility
installed via pacman is on PATH (Git Bash's PATH doesn't
include it).
required: false
default: bash
retention-days:
description: How long the GHA artifact survives.
required: false
default: '14'
runs:
using: composite
steps:
# Order is load-bearing: the kit is written INTO bundle/ first, so
# the audit that follows sees exactly the file set the archive will
# contain — including THIRD-PARTY.md and LICENSES/ themselves,
# which the manifest accounts for under the notcurses-native
# component. Auditing before generation would leave the two
# documents unchecked, which is the one part of a licensing kit
# nobody would notice going stale.
- name: Write third-party licensing kit into the bundle
shell: ${{ inputs.shell }}
run: bash scripts/ci/emit-third-party-kit.sh '${{ inputs.platform }}' bundle
# Release gate. Fails the lane if the pack contains a file no
# manifest component describes (we would be redistributing a
# binary whose licence nobody vetted) or is missing a component
# the manifest promises is there (the pack is broken, or the
# manifest has started lying). See the header of the script.
- name: Audit bundle against the third-party manifest (release gate)
shell: ${{ inputs.shell }}
run: bash scripts/ci/audit-third-party.sh '${{ inputs.platform }}' bundle
- name: Package archive (tar.gz)
if: inputs.format == 'tar.gz'
shell: ${{ inputs.shell }}
run: |
set -euxo pipefail
artifact='${{ inputs.artifact-name }}.tar.gz'
tar -czf "$artifact" -C bundle .
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$artifact" | tee "${artifact}.sha256"
else
# macOS doesn't ship sha256sum; shasum -a 256 is equivalent.
shasum -a 256 "$artifact" | tee "${artifact}.sha256"
fi
mkdir -p artefacts
mv "$artifact" "${artifact}.sha256" artefacts/
- name: Package archive (zip)
if: inputs.format == 'zip'
shell: ${{ inputs.shell }}
run: |
set -euxo pipefail
artifact='${{ inputs.artifact-name }}.zip'
(cd bundle && zip -r "../$artifact" .)
sha256sum "$artifact" | tee "${artifact}.sha256"
mkdir -p artefacts
mv "$artifact" "${artifact}.sha256" artefacts/
- uses: actions/upload-artifact@v6
with:
name: ${{ inputs.artifact-name }}
path: artefacts/
retention-days: ${{ inputs.retention-days }}