Skip to content

fix(ci): build ferrflow from source instead of downloading from releases #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BryanFRD merged 1 commit into from
Apr 1, 2026
Merged

fix(ci): build ferrflow from source instead of downloading from releases #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .ferrflow
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
"$schema": "https://ferrflow.com/schema/ferrflow.json",
"workspace": {
"tagTemplate": "v{version}",
"floatingTags": ["major"],
"hooks": {
"postBump": "node scripts/sync-optional-deps.js"
}
Expand Down
11 changes: 8 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,11 +109,16 @@ jobs:
with:
fetch-depth: 0
token: ${{ secrets.FERRFLOW_TOKEN }}
- uses: dtolnay/rust-toolchain@nightly
- uses: Swatinem/rust-cache@v2
- name: Configure git
run: git remote set-url origin https://x-access-token:${{ secrets.FERRFLOW_TOKEN }}@github.com/${{ github.repository }}
- uses: FerrFlow-Org/ferrflow@v2
with:
dry_run: ${{ inputs.dry_run }}
- name: Build ferrflow
run: cargo build --release

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cargo build --release will build all workspace members (including ferrflow-wasm) and extra bins, which adds time and increases the chance of unrelated build breakage in the release workflow. Consider restricting the build to the CLI binary needed here (e.g., build the ferrflow package/bin only) to keep this job focused and faster.

Suggested change
run: cargo build --release
run: cargo build --release --package ferrflow --bin ferrflow

Copilot uses AI. Check for mistakes.
env:
FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
- name: Run ferrflow release
run: ./target/release/ferrflow ${{ inputs.dry_run == 'true' && '--dry-run' || '' }} release

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inputs.dry_run == 'true' expression is likely incorrect for a boolean workflow_dispatch input, and inputs may be undefined on non-dispatch runs (push to main). This can cause the step to always skip --dry-run or even fail expression evaluation on push. Prefer checking github.event_name == 'workflow_dispatch' && inputs.dry_run (or github.event.inputs.dry_run) and pass --dry-run based on that boolean directly.

Suggested change
run: ./target/release/ferrflow ${{ inputs.dry_run == 'true' && '--dry-run' || '' }} release
run: ./target/release/ferrflow ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run && '--dry-run' || '' }} release

Copilot uses AI. Check for mistakes.
env:
FERRFLOW_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
GITHUB_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
Comment on lines +119 to 124

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FERRFLOW_HMAC_SECRET is read via option_env! (compile-time), so setting it during cargo build --release bakes the secret into the produced binary and (with Swatinem/rust-cache) into the GitHub Actions cache. To avoid leaking a long-lived secret into cached artifacts, don’t provide this secret at compile time; instead disable telemetry in CI (e.g. set FERRFLOW_ANONYMOUS_TELEMETRY=false) or change the code to read the secret at runtime via std::env::var.

Suggested change
FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
- name: Run ferrflow release
run: ./target/release/ferrflow ${{ inputs.dry_run == 'true' && '--dry-run' || '' }} release
env:
FERRFLOW_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
GITHUB_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
FERRFLOW_ANONYMOUS_TELEMETRY: "false"
- name: Run ferrflow release
run: ./target/release/ferrflow ${{ inputs.dry_run == 'true' && '--dry-run' || '' }} release
env:
FERRFLOW_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
GITHUB_TOKEN: ${{ secrets.FERRFLOW_TOKEN }}
FERRFLOW_ANONYMOUS_TELEMETRY: "false"

Copilot uses AI. Check for mistakes.
Expand Down
29 changes: 0 additions & 29 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,35 +201,6 @@ jobs:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: bash npm/scripts/publish-wasm.sh "${{ steps.version.outputs.value }}"

update-major-tag:
name: Update major version tag
needs: release
runs-on: ubuntu-latest
concurrency:
group: update-major-tag
cancel-in-progress: false
permissions:
contents: write
steps:
- name: Resolve tag
id: tag
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo "name=${{ inputs.tag }}" >> $GITHUB_OUTPUT
else
echo "name=${{ github.ref_name }}" >> $GITHUB_OUTPUT
fi
- uses: actions/checkout@v6
with:
ref: ${{ steps.tag.outputs.name }}
- name: Move major version tag
run: |
MAJOR="v$(echo "${TAG#v}" | cut -d. -f1)"
git tag -f "$MAJOR"
git push origin "refs/tags/$MAJOR" --force
env:
TAG: ${{ steps.tag.outputs.name }}

publish-docker:
name: Publish Docker
needs: release
Expand Down
Loading