release-consumer.yml

name: release-consumer

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Published release tag to check, for example v1.2.3."
        required: true
        type: string

permissions:
  contents: read

jobs:
  consumer:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: dx-linux-x86_64
            key: linux_x86_64
            runner: ubuntu-latest
          - name: dx-linux-arm64
            key: linux_aarch64
            runner: ubuntu-24.04-arm
          - name: dx-macos-arm64
            key: macos_aarch64
            runner: macos-15
          - name: dx-windows-x86_64
            key: windows_x86_64
            runner: windows-latest
          - name: dx-windows-arm64
            key: windows_aarch64
            runner: windows-11-arm
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    env:
      MSYS2_ARG_CONV_EXCL: "//"
      GH_TOKEN: ${{ github.token }}
      TAG: ${{ inputs.tag || github.event.release.tag_name }}
      CELL: ${{ matrix.name }}
      KEY: ${{ matrix.key }}
    steps:
      - name: Write the quickstart consumer from the published source.json
        run: |
          set -euo pipefail
          version="${TAG#v}"
          mkdir "$RUNNER_TEMP/consumer"
          cd "$RUNNER_TEMP/consumer"
          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern source.json
          echo "9.2.0" > .bazelversion
          echo "# Empty on purpose." > BUILD.bazel
          echo "common --repo_env=DO_NOT_TRACK=1" > .bazelrc
          {
            echo "bazel_dep(name = \"rules_dx\", version = \"$version\")"
            echo 'archive_override('
            echo '    module_name = "rules_dx",'
            echo "    urls = [\"$(jq -r .url source.json)\"],"
            echo "    integrity = \"$(jq -r .integrity source.json)\","
            echo "    strip_prefix = \"$(jq -r .strip_prefix source.json)\","
            echo ')'
          } > MODULE.bazel
      - name: Run the prebuilt dx and check its version
        run: |
          set -euo pipefail
          cd "$RUNNER_TEMP/consumer"
          version="${TAG#v}"
          printed="$(bazel run @rules_dx//:dx -- --version)"
          echo "$printed"
          case "$printed" in
            *"$version"*) ;;
            *) echo "dx printed '$printed', want $version" >&2; exit 1 ;;
          esac
          files="$(bazel cquery --output=files @rules_dx//:dx)"
          echo "$files"
          case "$files" in
            *"dx_prebuilt/$KEY/dx"*) ;;
            *) echo "@rules_dx//:dx is not the dx_prebuilt/$KEY/dx download" >&2; exit 1 ;;
          esac
          {
            echo "### $CELL"
            echo "- version: $printed"
            echo "- dx: $files"
          } >> "$GITHUB_STEP_SUMMARY"

  bcr:
    needs: consumer
    if: vars.BCR_REGISTRY_FORK != ''
    permissions:
      contents: write
      id-token: write
      attestations: write
    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@1ae09341a6014e9bea052879c42392ac6b8b632c # v1.7.0
    with:
      tag_name: ${{ inputs.tag || github.event.release.tag_name }}
      registry_fork: ${{ vars.BCR_REGISTRY_FORK }}
      attest: true
    secrets:
      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}

  bcr-ledger:
    needs: bcr
    if: always() && needs.bcr.result != 'skipped'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    env:
      TAG: ${{ inputs.tag || github.event.release.tag_name }}
      RESULT: ${{ needs.bcr.result }}
      PR_URL: ${{ needs.bcr.outputs.pr_url }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.TAG }}
          persist-credentials: false
      - uses: ./.github/actions/setup-bazel
      - name: Record the BCR submission
        run: |
          set -euo pipefail
          version="${TAG#v}"
          status=0
          bazel run //deploy/release:bcr_ledger -- "rules_dx@$version" "$RESULT" "$PR_URL" > ledger.json || status=$?
          { echo '```json'; cat ledger.json; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
          exit "$status"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: bcr-ledger
          path: ledger.json