build: switch to cross & create attestations

.github/workflows/release.yaml

@@ -1,11 +1,18 @@
 name: squishy release
-
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
 on:
   push:
     tags:
       - "v*.*.*"
+  workflow_dispatch:
+
 permissions:
+  attestations: write
   contents: write
+  id-token: write
 
 jobs:
   publish-binaries:
@@ -15,56 +22,79 @@ jobs:
       fail-fast: false
       matrix:
         build:
-          - {
-              NAME: x86_64-linux,
-              TOOLCHAIN: stable,
-              TARGET: x86_64-unknown-linux-musl,
-            }
           - {
               NAME: aarch64-linux,
-              TOOLCHAIN: stable,
               TARGET: aarch64-unknown-linux-musl,
             }
+          - {
+              NAME: loongarch64-linux,
+              TARGET: loongarch64-unknown-linux-musl
+            }
+          - {
+              NAME: riscv64-linux,
+              TARGET: riscv64gc-unknown-linux-musl
+            }
+          - {
+              NAME: x86_64-linux,
+              TARGET: x86_64-unknown-linux-musl,
+            }
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
       - name: Set the release version
         shell: bash
         run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
+
       - name: Install dependencies
         shell: bash
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            --allow-unauthenticated musl-tools b3sum
+          sudo apt update -y
+          sudo apt install b3sum findutils file -y
+
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: ${{ matrix.build.TOOLCHAIN }}
-          target: ${{ matrix.build.TARGET }}
-          override: true
+          targets: ${{ matrix.build.TARGET }}
+
+      - name: Install Cross
+        shell: bash
+        run: |
+          cargo install cross --git "https://github.com/cross-rs/cross" --jobs="$(($(nproc)+1))"
+          hash -r &>/dev/null
+          command -v cross &>/dev/null || { echo "cross command not found" >&2; exit 1; }
+
       - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          use-cross: true
-          command: build
-          args: --release --locked --target ${{ matrix.build.TARGET }}
+        env:
+          RUSTFLAGS: "-C target-feature=+crt-static \
+                      -C default-linker-libraries=yes \
+                      -C link-self-contained=yes \
+                      -C opt-level=3 \
+                      -C debuginfo=none \
+                      -C strip=symbols \
+                      -C link-arg=-Wl,-S \
+                      -C link-arg=-Wl,--build-id=none \
+                      -C link-arg=-Wl,--discard-all \
+                      -C link-arg=-Wl,--strip-all"
+        run: cross +nightly build --release --locked --target "${{ matrix.build.TARGET }}" --jobs="$(($(nproc)+1))" --verbose          
+
       - name: Prepare release assets
+        env:
+          ARTIFACT: "release/squishy-${{ matrix.build.NAME }}"
+          ARCHIVE: "squishy-${{ matrix.build.NAME }}.tar.gz"
         shell: bash
         run: |
           mkdir -p release
           cp {LICENSE,README.md} release/
-          cp "target/${{ matrix.build.TARGET }}/release/squishy" release/
-      - name: Create release artifacts
-        shell: bash
-        run: |
-            cp release/squishy squishy-${{ matrix.build.NAME }}
-            b3sum squishy-${{ matrix.build.NAME }} \
-              > squishy-${{ matrix.build.NAME }}.b3sum
-            tar -czvf squishy-${{ matrix.build.NAME }}.tar.gz \
-              release/
-            b3sum squishy-${{ matrix.build.NAME }}.tar.gz \
-              > squishy-${{ matrix.build.NAME }}.tar.gz.b3sum
+          cp "target/${{ matrix.build.TARGET }}/release/squishy" "${ARTIFACT}"
+          b3sum "${ARTIFACT}" > "${ARTIFACT}.b3sum"
+          cp "${ARTIFACT}" .
+          cp "${ARTIFACT}.b3sum" .
+          tar -czvf "${ARCHIVE}" release/
+          b3sum "${ARCHIVE}" > "${ARCHIVE}.b3sum"
+          bash -c 'realpath "${ARTIFACT}" ; realpath "${ARCHIVE}"' | xargs -I "{}" bash -c \
+           'printf "\nFile: $(basename {})\n  Type: $(file -b {})\n  B3sum: $(b3sum {} | cut -d" " -f1)\n  SHA256sum: $(sha256sum {} | cut -d" " -f1)\n  Size: $(du -bh {} | cut -f1)\n"'
+
       - name: Publish to GitHub
         uses: svenstaro/upload-release-action@v2
         with:
@@ -74,3 +104,11 @@ jobs:
           overwrite: true
           tag: ${{ github.ref }}
           release_name: "squishy v${{ env.RELEASE_VERSION }}"
+
+      - name: Attest Build Provenance
+        uses: actions/attest-build-provenance@v2.4.0
+        with:
+          subject-name: "squishy-v${{ env.RELEASE_VERSION }}-${{ matrix.build.NAME }}"
+          subject-path: |
+            squishy-${{ matrix.build.NAME }}*
+          show-summary: true