name: Build

on:

workflow_dispatch:

push:

tags: [v*]

branches: [main]

paths-ignore:

- '**.md'

pull_request:

branches: [main]

release:

types: [published]

jobs:

build-chisel:

name: Build Chisel

runs-on: ubuntu-22.04

outputs:

chisel_version: ${{ steps.build.outputs.CHISEL_VERSION }}

strategy:

fail-fast: false

matrix:

include:

- arch: 'amd64'

machine_arch: 'X86-64'

- arch: 'arm'

machine_arch: 'ARM'

- arch: 'arm64'

machine_arch: 'AArch64'

- arch: 'ppc64le'

machine_arch: 'PowerPC64'

- arch: 'riscv64'

machine_arch: 'RISC-V'

- arch: 's390x'

machine_arch: 'S/390'

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

fetch-depth: 0

# The checkout action in previous step overwrites annonated tag

# with lightweight tags breaking ``git describe``

# See https://github.com/actions/checkout/issues/882

# and https://github.com/actions/checkout/issues/290

# The following step is a workaround to restore the latest tag

# to it's original state.

- name: Restore (annonated) tag

run: git fetch --force origin ${GITHUB_REF}:${GITHUB_REF}

if: ${{ github.ref_type == 'tag' }}

- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

with:

go-version-file: 'go.mod'

- name: Build Chisel for linux/${{ matrix.arch }}

id: build

env:

GOOS: "linux"

GOARCH: ${{ matrix.arch }}

CGO_ENABLED: "0"

run: |

echo "Generating version file"

go generate ./cmd/

echo "Building for $GOOS $GOARCH"

go build -trimpath -ldflags='-s -w' ./cmd/chisel

# Get version via "chisel version" to ensure it matches that exactly

CHISEL_VERSION=$(GOOS=linux GOARCH=amd64 go run ./cmd/chisel version)

echo "Version: $CHISEL_VERSION"

# Version should not be "unknown"

[ "$CHISEL_VERSION" != "unknown" ] || exit 1

# Share variables with subsequent steps

echo "CHISEL_VERSION=${CHISEL_VERSION}" >>$GITHUB_OUTPUT

- name: Test if is executable

run: test -x ./chisel

- name: Test if binary has the right machine architecture

run: |

[ "$(readelf -h chisel | grep 'Machine:' | awk -F' ' '{print $NF}')" == "${{ matrix.machine_arch }}" ]

- name: Create archive

id: archive

env:

GOOS: "linux"

GOARCH: ${{ matrix.arch }}

CHISEL_VERSION: ${{ steps.build.outputs.CHISEL_VERSION }}

run: |

ARCHIVE_FILE=chisel_${CHISEL_VERSION}_${GOOS}_${GOARCH}.tar.gz

ARCHIVE_FILE_SHA384="${ARCHIVE_FILE}.sha384"

echo "Creating archive $ARCHIVE_FILE"

mkdir -p dist/

cp chisel LICENSE README.md dist/

find dist -printf "%P\n" | tar -czf $ARCHIVE_FILE --no-recursion -C dist -T -

sha384sum "${ARCHIVE_FILE}" > "${ARCHIVE_FILE_SHA384}"

# Share variables with subsequent steps

echo "ARCHIVE_FILE=${ARCHIVE_FILE}" >>$GITHUB_OUTPUT

echo "ARCHIVE_FILE_SHA384=${ARCHIVE_FILE_SHA384}" >>$GITHUB_OUTPUT

- name: Upload archive as Actions artifact

uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

with:

name: ${{ steps.archive.outputs.ARCHIVE_FILE }}

path: |

${{ steps.archive.outputs.ARCHIVE_FILE }}

${{ steps.archive.outputs.ARCHIVE_FILE_SHA384 }}

upload-release:

name: Upload to Release

if: ${{ github.event_name == 'release' }}

needs: build-chisel

runs-on: ubuntu-24.04

# This job only runs on release events (which can only be triggered by users

# with "write" access) and the only thing it does is to upload the artifacts

# to the release. It does not build anything.

# This job splits the privileged step below from the above job, allowing us to

# use the GITHUB_TOKEN safely, while also removing the need to have a bot account

# as a repo collaborator.

permissions:

contents: write # required for uploading artifacts to a release.

steps:

- name: Download all artifacts

uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

- name: Upload archives to release

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHISEL_VERSION: ${{ needs.build-chisel.outputs.chisel_version }}

run: |

for dir in chisel_*/; do

for file in "$dir"*; do

echo "Uploading $file to release $CHISEL_VERSION"

gh release upload "$CHISEL_VERSION" "$file" --repo "$GITHUB_REPOSITORY"

done

done