Add tag-triggered release CI: macOS universal bundle, Windows exe, Linux binary, SBOM, changelog, and PR test checks

[Copilot]

No CI existed to produce release artifacts or run tests automatically. This adds two workflows: a CI workflow that runs tests on PRs and pushes to main, and a release workflow that fires on v[0-9]* tag pushes and publishes a GitHub Release with platform binaries, a CycloneDX SBOM, and a git-cliff changelog.

Workflow jobs (ci.yml)

• test – Runs cargo test --all on every push to main and every PR targeting main. Installs the required X11/Wayland/GTK system headers so the crate compiles correctly on the Ubuntu runner.

Workflow jobs (release.yml)

• test – Runs cargo test --all before any platform build begins; all three build jobs depend on this job so a failing test aborts the release
• build-macos – Builds for both aarch64-apple-darwin and x86_64-apple-darwin, joins them with lipo, assembles a hand-crafted .app bundle (with Info.plist + icon), and packages it as log-dash-macos-universal.app.tar.gz
• build-windows – Builds log-dash.exe on windows-latest, packages as log-dash-windows-x86_64.zip
• build-linux – Installs required X11/Wayland/GTK headers on ubuntu-latest, builds the binary, packages as log-dash-linux-x86_64.tar.gz
• release – Runs after all builds; generates sbom.cdx.json (CycloneDX JSON via cargo-cyclonedx), generates CHANGELOG.md (via orhun/git-cliff-action), then publishes everything to the GitHub Release via softprops/action-gh-release

The release pipeline dependency chain is: test → build-macos / build-windows / build-linux → release

Supporting files

• cliff.toml – git-cliff config; groups conventional commits (feat, fix, etc.) and falls through to a catch-all Changes bucket for non-conventional commits
• Cargo.lock – committed (was erroneously gitignored; apps should lock); enables reproducible builds and cache keying in CI
• .gitignore – removed Cargo.lock exclusion

Security & supply-chain hardening

• All uses: action references in both ci.yml and release.yml are pinned to immutable commit SHAs, with the human-readable version tag kept as a trailing comment (e.g. actions/checkout@34e114876b… # v4). This prevents a compromised or silently-mutated mutable tag from altering what code runs in CI.

Windows version embedding

build.rs now sets FileVersion, ProductVersion, ProductName, and FileDescription in the Windows PE VERSIONINFO resource via winres, sourced from CARGO_PKG_VERSION at compile time. The version is visible in Windows Explorer → Properties → Details and tracks whatever version is declared in Cargo.toml.

Triggering a release

git tag v1.2.0
git push origin v1.2.0

Original prompt

Can we setup a ci that releases an app bundle for Mac, an executable for windows and whatever is best for Linux? I would like to trigger releases by pushing a tag and the release artifacts should contain a change report, sbom and the binaries.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[randomenterprisesolutions]

@copilot execute the tests as well and let them run on prs to main.

[Copilot]

@copilot execute the tests as well and let them run on prs to main.

Done in d20bf95. Added two things:

1. .github/workflows/ci.yml – runs cargo test --all on every push to main and every PR targeting main. It installs the required system headers (X11/Wayland/GTK) so the crate compiles correctly on the Ubuntu runner.

2. release.yml – added a test job at the front of the pipeline. All three platform build jobs now declare needs: test, so a failing test will abort the release before any platform binary is built or published.

[randomenterprisesolutions]

@copilot let's use commit hashes to pin the actions.
Is the version embedded in the binary for windows?

[Copilot]

@copilot let's use commit hashes to pin the actions.
Is the version embedded in the binary for windows?

Done in 663b4cb.

Action pinning – all uses: references in both ci.yml and release.yml are now pinned to immutable commit SHAs, with the human-readable version tag kept as a comment, e.g.:

uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

Windows version – it was not embedded before. build.rs now calls winres to write a VERSIONINFO resource into the PE binary with FileVersion, ProductVersion, ProductName, and FileDescription sourced from CARGO_PKG_VERSION at compile time. The version will show up in Windows Explorer → Properties → Details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/cache/git/refs/tags/v4
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/checkout/git/refs/tags/v4
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/download-artifact/git/refs/tags/v4
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/upload-artifact/git/refs/tags/v4
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)