From 80564552a15869043ddf1bd516d1e959e1844067 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Fri, 5 Jun 2026 10:12:53 -0700 Subject: [PATCH 1/3] Migrate CI to GitHub Actions --- .cirrus.yml | 68 ----------------------------------- .github/workflows/ci.yml | 51 ++++++++++++++++++++++++++ .github/workflows/release.yml | 49 +++++++++++++++++++++++++ .goreleaser.yml | 2 +- 4 files changed, 101 insertions(+), 69 deletions(-) delete mode 100644 .cirrus.yml create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/release.yml diff --git a/.cirrus.yml b/.cirrus.yml deleted file mode 100644 index d711971..0000000 --- a/.cirrus.yml +++ /dev/null @@ -1,68 +0,0 @@ -use_compute_credits: true - -macos_instance: - image: ghcr.io/cirruslabs/macos-runner:tahoe - -env: - PATH: "$PATH:$HOME/.cargo/bin" - -task: - name: Lint - install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y - rustfmt_script: cargo fmt --check - clippy_script: cargo clippy --all-targets --all-features -- -D warnings - -task: - alias: Test - matrix: - - name: Test on macOS Sequoia - macos_instance: - image: ghcr.io/cirruslabs/macos-runner:sequoia - - name: Test on macOS Tahoe - macos_instance: - image: ghcr.io/cirruslabs/macos-runner:tahoe - install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y - test_script: cargo test - -task: - name: Release (Dry Run) - only_if: $CIRRUS_TAG == '' - depends_on: - - Lint - - Test - install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y - install_script: brew install go - install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro - build_script: goreleaser build --snapshot - goreleaser_artifacts: - path: "dist/**" - -task: - name: Release - only_if: $CIRRUS_TAG != '' - depends_on: - - Lint - - Test - env: - GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!] - GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!] - SENTRY_ORG: cirrus-labs - SENTRY_PROJECT: persistent-workers - SENTRY_AUTH_TOKEN: ENCRYPTED[!c16a5cf7da5f856b4bc2f21fe8cb7aa2a6c981f851c094ed4d3025fd02ea59a58a86cee8b193a69a1fc20fa217e56ac3!] - install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y - install_script: brew install go getsentry/tools/sentry-cli - install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro - release_script: goreleaser - upload_sentry_debug_files_script: - - cd target/aarch64-apple-darwin/release/ - # Generate and upload symbols - - dsymutil softnet - - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.dSYM/ - # Bundle and upload sources - - sentry-cli debug-files bundle-sources softnet.dSYM/ - - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.src.zip - create_sentry_release_script: - - export SENTRY_RELEASE="softnet@$CIRRUS_TAG" - - sentry-cli releases new $SENTRY_RELEASE - - sentry-cli releases set-commits $SENTRY_RELEASE --auto - - sentry-cli releases finalize $SENTRY_RELEASE diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..ad56f6c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,51 @@ +name: CI + +on: + merge_group: + pull_request: + push: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + +jobs: + lint: + name: Lint + runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + timeout-minutes: 30 + steps: + - uses: actions/checkout@v6 + - name: Install Rust + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + - name: Install lint components + run: rustup component add clippy rustfmt + - name: Check formatting + run: cargo fmt --check + - name: Run Clippy + run: cargo clippy --all-targets --all-features -- -D warnings + + test: + name: Test on macOS ${{ matrix.macos }} + runs-on: ghcr.io/cirruslabs/macos-runner:${{ matrix.runner }} + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + include: + - macos: Sequoia + runner: sequoia + - macos: Tahoe + runner: tahoe + steps: + - uses: actions/checkout@v6 + - name: Install Rust + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + - name: Run tests + run: cargo test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..061f79d --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,49 @@ +name: Release + +on: + push: + tags: + - "*" + workflow_dispatch: + +permissions: + contents: write + +jobs: + release: + name: ${{ github.ref_type == 'tag' && 'Release' || 'Release (Dry Run)' }} + runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + timeout-minutes: 60 + env: + GITHUB_TOKEN: ${{ secrets.GH_PAT }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - name: Install Rust + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + - name: Install release targets + run: rustup target add aarch64-apple-darwin x86_64-apple-darwin + - name: Release + if: github.ref_type == 'tag' + uses: goreleaser/goreleaser-action@v7 + with: + distribution: goreleaser-pro + version: "~> v2" + args: release --clean + - name: Release dry run + if: github.ref_type != 'tag' + uses: goreleaser/goreleaser-action@v7 + with: + distribution: goreleaser-pro + version: "~> v2" + args: release --skip=publish --snapshot --clean + - name: Upload dry-run artifacts + if: github.ref_type != 'tag' + uses: actions/upload-artifact@v6 + with: + name: softnet-snapshot + path: dist/** diff --git a/.goreleaser.yml b/.goreleaser.yml index 9d90c75..8b9b094 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -26,7 +26,7 @@ brews: owner: cirruslabs name: homebrew-cli caveats: See the Github repository for more information - homepage: https://github.com/cirruslabs/softnet + homepage: https://github.com/openai/softnet description: Software networking with isolation for Tart skip_upload: auto custom_block: | From 93b1c97d9e259ebda93f72b7f22a074a23e6ca82 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:05:54 -0400 Subject: [PATCH 2/3] Publish Softnet releases to homebrew-tools --- .github/workflows/release.yml | 32 ++++++++++++++++++++++++++++---- .goreleaser.yml | 8 ++++++-- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 061f79d..399abda 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,26 +7,44 @@ on: workflow_dispatch: permissions: - contents: write + contents: read jobs: release: name: ${{ github.ref_type == 'tag' && 'Release' || 'Release (Dry Run)' }} runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + environment: publish timeout-minutes: 60 - env: - GITHUB_TOKEN: ${{ secrets.GH_PAT }} - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} steps: - uses: actions/checkout@v6 with: fetch-depth: 0 + persist-credentials: false - name: Install Rust run: | curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - name: Install release targets run: rustup target add aarch64-apple-darwin x86_64-apple-darwin + - name: Create release app token for this repo + if: github.ref_type == 'tag' + id: app-token + uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + permission-contents: write + - name: Create release app token for homebrew-tools + if: github.ref_type == 'tag' + id: tap-token + uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: openai + repositories: homebrew-tools + permission-contents: write + permission-pull-requests: write - name: Release if: github.ref_type == 'tag' uses: goreleaser/goreleaser-action@v7 @@ -34,6 +52,10 @@ jobs: distribution: goreleaser-pro version: "~> v2" args: release --clean + env: + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} + HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - name: Release dry run if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 @@ -41,6 +63,8 @@ jobs: distribution: goreleaser-pro version: "~> v2" args: release --skip=publish --snapshot --clean + env: + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - name: Upload dry-run artifacts if: github.ref_type != 'tag' uses: actions/upload-artifact@v6 diff --git a/.goreleaser.yml b/.goreleaser.yml index 8b9b094..53b873a 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -23,8 +23,12 @@ release: brews: - name: "{{ .ProjectName }}" repository: - owner: cirruslabs - name: homebrew-cli + owner: openai + name: homebrew-tools + token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}" + branch: "softnet-{{ .Version }}" + pull_request: + enabled: true caveats: See the Github repository for more information homepage: https://github.com/openai/softnet description: Software networking with isolation for Tart From 6c2553c3ff940108042179b6922b4960d422bbd6 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:21:32 -0400 Subject: [PATCH 3/3] Isolate Softnet release secrets --- .github/workflows/release.yml | 27 +++++++++++++++++++-------- .goreleaser.yml | 1 + 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 399abda..d0a17a0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,8 @@ permissions: jobs: release: - name: ${{ github.ref_type == 'tag' && 'Release' || 'Release (Dry Run)' }} + name: Release + if: github.event_name == 'push' && github.ref_type == 'tag' runs-on: ghcr.io/cirruslabs/macos-runner:tahoe environment: publish timeout-minutes: 60 @@ -27,7 +28,6 @@ jobs: - name: Install release targets run: rustup target add aarch64-apple-darwin x86_64-apple-darwin - name: Create release app token for this repo - if: github.ref_type == 'tag' id: app-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 with: @@ -35,7 +35,6 @@ jobs: private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} permission-contents: write - name: Create release app token for homebrew-tools - if: github.ref_type == 'tag' id: tap-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 with: @@ -46,7 +45,6 @@ jobs: permission-contents: write permission-pull-requests: write - name: Release - if: github.ref_type == 'tag' uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro @@ -56,17 +54,30 @@ jobs: GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + + snapshot: + name: Release (Dry Run) + if: github.event_name == 'workflow_dispatch' + runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + timeout-minutes: 60 + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + persist-credentials: false + - name: Install Rust + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + - name: Install release targets + run: rustup target add aarch64-apple-darwin x86_64-apple-darwin - name: Release dry run - if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro version: "~> v2" args: release --skip=publish --snapshot --clean - env: - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - name: Upload dry-run artifacts - if: github.ref_type != 'tag' uses: actions/upload-artifact@v6 with: name: softnet-snapshot diff --git a/.goreleaser.yml b/.goreleaser.yml index 53b873a..8feb1b6 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -29,6 +29,7 @@ brews: branch: "softnet-{{ .Version }}" pull_request: enabled: true + directory: Formula caveats: See the Github repository for more information homepage: https://github.com/openai/softnet description: Software networking with isolation for Tart