From bf70b7c6d2f729f429c776b9d16f6bd188e43d1c Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:16 +0900 Subject: [PATCH 1/7] fix(ci): skip tag creation when a release was cut recently --- .github/workflows/tag.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml index 5a15f77..bfa3f4a 100644 --- a/.github/workflows/tag.yaml +++ b/.github/workflows/tag.yaml @@ -17,9 +17,9 @@ jobs: runs-on: ubuntu-latest outputs: new-tag: ${{ steps.ccv.outputs.new-tag }} - new-tag-version: ${{steps.ccv.outputs.new-tag-version}} - new-tag-version-type: ${{steps.ccv.outputs.new-tag-version-type}} - recently-tagged: ${{steps.recent-tag.outputs.recently-tagged}} + new-tag-version: ${{ steps.ccv.outputs.new-tag-version }} + new-tag-version-type: ${{ steps.ccv.outputs.new-tag-version-type }} + recently-tagged: ${{ steps.recent-tag.outputs.recently-tagged }} steps: - uses: actions/checkout@v6 with: @@ -47,6 +47,7 @@ jobs: fi - name: Bump tag if necessary id: ccv + if: github.event_name != 'schedule' || steps.recent-tag.outputs.recently-tagged != 'true' uses: smlx/ccv@7318e2f25a52dcd550e75384b84983973251a1f8 # v0.10.0 release: needs: tag @@ -55,7 +56,7 @@ jobs: tag_name: ${{ needs.tag.outputs.new-tag-version }} secrets: publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }} - if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major' && needs.tag.outputs.recently-tagged != 'true' + if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major' permissions: contents: write id-token: write From 23c7edd49443e2741e718cffa536fae404c39e91 Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:23 +0900 Subject: [PATCH 2/7] ci: publish releases as drafts for immutable releases --- .github/workflows/release.yaml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index efe20c8..3a2300a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -20,10 +20,17 @@ permissions: contents: write jobs: release: - uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.3.0 + # https://github.com/bazel-contrib/.github/blob/master/.github/workflows/release_ruleset.yaml + uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0 with: release_files: rules_tensorrt_rtx-*.tar.gz prerelease: false + # Open the release as a draft to support immutable GitHub releases. + # Attestations will be uploaded to the draft in publish.yaml. + # See: + # https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases. + # https://github.com/bazel-contrib/publish-to-bcr#immutable-releases + draft: true tag_name: ${{ inputs.tag_name || github.ref_name }} bazel_test_command: "bazel build //..." publish: @@ -33,3 +40,11 @@ jobs: tag_name: ${{ inputs.tag_name || github.ref_name }} secrets: publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }} + finalize: + # Publish the draft release + needs: publish + runs-on: ubuntu-latest + steps: + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + with: + tag_name: ${{ inputs.tag_name || github.ref_name }} From a75398123787513ee8f1ecc7af95bf070ca14452 Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:44 +0900 Subject: [PATCH 3/7] chore: drop workspace instructions from release notes --- .github/workflows/release_prep.sh | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh index 2cec6e1..30cf2f9 100755 --- a/.github/workflows/release_prep.sh +++ b/.github/workflows/release_prep.sh @@ -16,25 +16,11 @@ git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}') cat << EOF -## Using Bzlmod with Bazel 6 or greater +## Bzlmod -1. (Bazel 6 only) Enable with \`common --enable_bzlmod\` in \`.bazelrc\`. -2. Add to your \`MODULE.bazel\` file: +Add to your \`MODULE.bazel\` file: \`\`\`starlark bazel_dep(name = "rules_tensorrt_rtx", version = "${TAG:1}") \`\`\` - -## Using WORKSPACE - -Paste this snippet into your \`WORKSPACE.bazel\` file: - -\`\`\`starlark -load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") -http_archive( - name = "rules_tensorrt_rtx", - sha256 = "${SHA}", - strip_prefix = "${PREFIX}", - url = "https://github.com/wep21/rules_tensorrt_rtx/releases/download/${TAG}/${ARCHIVE}", -) EOF From 89e82b4d1f4aab7b720030c317ff171b96909c20 Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:44 +0900 Subject: [PATCH 4/7] chore: exclude examples from release archive --- .gitattributes | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..36806b9 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,6 @@ +################################# +# Configuration for 'git archive' +# See https://git-scm.com/docs/git-archive#ATTRIBUTES + +# Don't include examples in the distribution artifact, to reduce size. +examples export-ignore From 05a2836fc274bc301a9467451dc94aa5dc2f0c11 Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:58 +0900 Subject: [PATCH 5/7] ci: verify pr titles follow conventional commits --- .github/workflows/conventional-commits.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/conventional-commits.yaml diff --git a/.github/workflows/conventional-commits.yaml b/.github/workflows/conventional-commits.yaml new file mode 100644 index 0000000..5ee66f4 --- /dev/null +++ b/.github/workflows/conventional-commits.yaml @@ -0,0 +1,20 @@ +# This helps the tag.yaml action to automatically create new releases +# +# tag.yaml requires all commits to follow the conventional commit pattern so that it can +# automatically derive the next release version based on the commit history +name: Verify PR title/description +on: + pull_request_target: + types: + - opened + - edited + - synchronize +permissions: + pull-requests: read +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 0471cd1e7b4c1a4c10b67238c9af0085a825be08 Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:07:58 +0900 Subject: [PATCH 6/7] ci: pin actions/checkout to v7 --- .github/workflows/buildifier.yaml | 2 +- .github/workflows/ci.yaml | 2 +- .github/workflows/tag.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml index ac548ca..49f92ea 100644 --- a/.github/workflows/buildifier.yaml +++ b/.github/workflows/buildifier.yaml @@ -12,6 +12,6 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: buildifier run: bazel run --enable_bzlmod //.github/workflows:buildifier.check diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3f86c73..f5f780c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -29,7 +29,7 @@ jobs: pre-commit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: pre-commit/action@v3.0.1 # For branch protection settings, this job provides a "stable" name that can be used to gate PR merges # on "all matrix jobs were successful". diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml index bfa3f4a..0aa7422 100644 --- a/.github/workflows/tag.yaml +++ b/.github/workflows/tag.yaml @@ -21,7 +21,7 @@ jobs: new-tag-version-type: ${{ steps.ccv.outputs.new-tag-version-type }} recently-tagged: ${{ steps.recent-tag.outputs.recently-tagged }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Need enough history to find the prior release tag fetch-depth: 0 From 8d2bee68713881dbd7eb7b644958d835ae91346e Mon Sep 17 00:00:00 2001 From: wep21 Date: Mon, 19 Oct 2026 16:10:02 +0900 Subject: [PATCH 7/7] ci: build root and examples with setup-bazel --- .bazelignore | 1 + .github/workflows/ci.bazelrc | 15 --------------- .github/workflows/ci.yaml | 31 ++++++++++++++++++++----------- 3 files changed, 21 insertions(+), 26 deletions(-) create mode 100644 .bazelignore delete mode 100644 .github/workflows/ci.bazelrc diff --git a/.bazelignore b/.bazelignore new file mode 100644 index 0000000..d838da9 --- /dev/null +++ b/.bazelignore @@ -0,0 +1 @@ +examples/ diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc deleted file mode 100644 index 3b4aad2..0000000 --- a/.github/workflows/ci.bazelrc +++ /dev/null @@ -1,15 +0,0 @@ -# This file contains Bazel settings to apply on CI only. -# It is referenced with a --bazelrc option in the call to bazel in ci.yaml - -# Debug where options came from -build --announce_rc -# This directory is configured in GitHub actions to be persisted between runs. -# We do not enable the repository cache to cache downloaded external artifacts -# as these are generally faster to download again than to fetch them from the -# GitHub actions cache. -build --disk_cache=~/.cache/bazel -# Don't rely on test logs being easily accessible from the test runner, -# though it makes the log noisier. -test --test_output=errors -# Allows tests to run bazelisk-in-bazel, since this is the cache folder used -test --test_env=XDG_CACHE_HOME diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f5f780c..ce5cae1 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -15,17 +15,26 @@ concurrency: cancel-in-progress: ${{ github.ref_name != 'main' }} jobs: test: - uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v7 - with: - folders: | - [ - ".", - ] - exclude: | - [ - {"folder": ".", "bzlmodEnabled": false} - ] - bazel_test_command: "bazel build //..." + runs-on: ubuntu-latest + strategy: + matrix: + bazel: ["7.x", "8.x", "9.x"] + folder: + - . + - examples + defaults: + run: + working-directory: ${{ matrix.folder }} + env: + USE_BAZEL_VERSION: ${{ matrix.bazel }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1 + with: + bazelisk-cache: true + disk-cache: ${{ github.workflow }} + repository-cache: true + - run: bazel build //... pre-commit: runs-on: ubuntu-latest steps: