Add support for Linux ARM

.github/workflows/build.yml

@@ -2,11 +2,28 @@ name: Build
 
 on:
   push:
+    branches:
+      - master
+      - main
+  pull_request:
   workflow_dispatch:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    defaults:
+      run:
+        shell: bash
+    permissions:
+      contents: read
+      packages: read
     strategy:
       matrix:
         os: [ macos-latest, windows-latest, ubuntu-latest ]
@@ -15,12 +32,16 @@ jobs:
             cli_assembly_id: linux-amd64
             cli_assembly_format: tar.gz
             cli_assembly_arch: x86-64-v3
+          - os: ubuntu-24.04-arm
+            cli_assembly_id: linux-aarch64
+            cli_assembly_format: tar.gz
+            cli_assembly_arch: armv8-a
           - os: windows-latest
             cli_assembly_id: windows-amd64
             cli_assembly_format: zip
             cli_assembly_arch: x86-64-v3
             gu_executable_ext: .cmd
-          - os: macos-13
+          - os: macos-15-intel
             cli_assembly_id: macos-amd64
             cli_assembly_format: tar.gz
             cli_assembly_arch: x86-64-v3
@@ -29,35 +50,52 @@ jobs:
             cli_assembly_format: tar.gz
             cli_assembly_arch: armv8-a
     steps:
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
         if: ${{ runner.os == 'Windows'}}
       - run: ldd --version
         if: ${{ runner.os == 'Linux'}}
-      - uses: actions/checkout@v6
-      - uses: actions/cache@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-m2
-      - uses: Project-Env/project-env-github-action@v1.5.0
-      - uses: repolevedavaj/install-nsis@v1.1.0
+      - uses: Project-Env/project-env-github-action@8958dac5824fd73ced04459e76f49654b95044a6 # v1.5.0
+        if: ${{ matrix.cli_assembly_id != 'linux-aarch64' }}
+      - uses: graalvm/setup-graalvm@54b4f5a65c1a84b2fdfdc2078fe43df32819e4b1 # v1
+        if: ${{ matrix.cli_assembly_id == 'linux-aarch64' }}
+        with:
+          java-version: '21'
+          distribution: 'graalvm-community'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5
+        if: ${{ matrix.cli_assembly_id == 'linux-aarch64' }}
+        with:
+          maven-version: 3.9.9
+      - uses: repolevedavaj/install-nsis@a55ed92772254d1e51d880f85ce9b5719f907801 # v1.1.0
         with:
           nsis-version: 3.08
         if: ${{ runner.os == 'Windows'}}
-      - run: mvn -B -s etc/m2/settings.xml verify -Pnative-image -Psonar "-Dcli.assembly.id=${{ matrix.cli_assembly_id }}" "-Dcli.assembly.format=${{ matrix.cli_assembly_format }}" "-Dcli.binary.arch=${{ matrix.cli_assembly_arch }}"
-        if: ${{ runner.os == 'Linux' && github.actor != 'dependabot[bot]' }}
+      - run: mvn -B -s etc/m2/settings.xml verify -Pnative-image -Psonar "-Dcli.assembly.id=${CLI_ASSEMBLY_ID}" "-Dcli.assembly.format=${CLI_ASSEMBLY_FORMAT}" "-Dcli.binary.arch=${CLI_BINARY_ARCH}"
+        if: ${{ matrix.cli_assembly_id == 'linux-amd64' && github.actor != 'dependabot[bot]' }}
         env:
+          CLI_ASSEMBLY_ID: ${{ matrix.cli_assembly_id }}
+          CLI_ASSEMBLY_FORMAT: ${{ matrix.cli_assembly_format }}
+          CLI_BINARY_ARCH: ${{ matrix.cli_assembly_arch }}
           GITHUB_USER: ${{ github.actor }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      - run: mvn -B -s etc/m2/settings.xml verify -Pnative-image "-Dcli.assembly.id=${{ matrix.cli_assembly_id }}" "-Dcli.assembly.format=${{ matrix.cli_assembly_format }}" "-Dcli.binary.arch=${{ matrix.cli_assembly_arch }}"
-        if: ${{ runner.os != 'Linux' || github.actor == 'dependabot[bot]' }}
+      - run: mvn -B -s etc/m2/settings.xml verify -Pnative-image "-Dcli.assembly.id=${CLI_ASSEMBLY_ID}" "-Dcli.assembly.format=${CLI_ASSEMBLY_FORMAT}" "-Dcli.binary.arch=${CLI_BINARY_ARCH}"
+        if: ${{ matrix.cli_assembly_id != 'linux-amd64' || github.actor == 'dependabot[bot]' }}
         env:
+          CLI_ASSEMBLY_ID: ${{ matrix.cli_assembly_id }}
+          CLI_ASSEMBLY_FORMAT: ${{ matrix.cli_assembly_format }}
+          CLI_BINARY_ARCH: ${{ matrix.cli_assembly_arch }}
           GITHUB_USER: ${{ github.actor }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Sign and notarize executable
@@ -74,19 +112,19 @@ jobs:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
           APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         if: ${{ github.actor != 'dependabot[bot]' }}
         with:
           name: cli-dev-${{ matrix.cli_assembly_id }}.${{ matrix.cli_assembly_format }}
           path: code/cli/target/cli-dev-${{ matrix.cli_assembly_id }}.${{ matrix.cli_assembly_format }}
-      - uses: repolevedavaj/create-cli-app-nsis-installer@main
+      - uses: repolevedavaj/create-cli-app-nsis-installer@5b86acc28eceb315ac12fb2dc7eca3907f47ca99 # main
         if: ${{ runner.os == 'Windows'}}
         with:
           package-identifier: ProjectEnv.ProjectEnvCli
           package-name: Project-Env Cli
           package-version: dev
           source-directory: code/cli/target/cli-dev-windows-amd64
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         if: ${{ runner.os == 'Windows' && github.actor != 'dependabot[bot]' }}
         with:
           name: cli-dev-${{ matrix.cli_assembly_id }}-setup.exe

.github/workflows/homebrew-releaser.yml

@@ -1,26 +1,102 @@
 name: Publish to Homebrew
+
 on:
   release:
     types: [published]
   workflow_dispatch:
     inputs:
       tag_name:
-        description: "Tag name of the release"
+        description: "Tag name of the release (e.g. v3.27.0)"
         required: true
+
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-      - id: revision
-        run: echo "revision=$(echo ${{ github.event.release.tag_name || github.event.inputs.tag_name }} | cut -c2-)" >> $GITHUB_OUTPUT
-      - uses: mislav/bump-homebrew-formula-action@v3
-        with:
-          formula-name: project-env-cli
-          formula-path: Casks/project-env-cli.rb
-          homebrew-tap: Project-Env/homebrew-tap
-          base-branch: main
-          tag-name: ${{ github.event.release.tag_name || github.event.inputs.tag_name }}
-          download-url: https://github.com/Project-Env/project-env-cli/releases/download/v${{ steps.revision.outputs.revision }}/cli-${{ steps.revision.outputs.revision }}-macos-aarch64.tar.gz
-          commit-message: bump {{formulaName}} to {{version}}
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Resolve version
+        id: version
         env:
-          COMMITTER_TOKEN: ${{ secrets.HOMEBREW_RELEASER_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          INPUT_TAG: ${{ github.event.inputs.tag_name }}
+        run: |
+          TAG="${RELEASE_TAG:-$INPUT_TAG}"
+          VERSION="${TAG#v}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Download release assets
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_RELEASER_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          VARIANTS="macos-amd64 macos-aarch64 linux-amd64 linux-aarch64"
+          for VARIANT in $VARIANTS; do
+            gh release download "v${VERSION}" \
+              --repo Project-Env/project-env-cli \
+              --pattern "cli-${VERSION}-${VARIANT}.tar.gz" \
+              --dir assets
+          done
+
+      - name: Compute checksums
+        id: checksums
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          for VARIANT in macos-amd64 macos-aarch64 linux-amd64 linux-aarch64; do
+            KEY=$(echo "$VARIANT" | tr '-' '_' | tr '[:lower:]' '[:upper:]')
+            SHA=$(sha256sum "assets/cli-${VERSION}-${VARIANT}.tar.gz" | cut -d ' ' -f 1)
+            echo "sha256_${KEY}=${SHA}" >> "$GITHUB_OUTPUT"
+          done
+
+      - name: Generate cask and formula from templates
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          SHA256_MACOS_AARCH64: ${{ steps.checksums.outputs.sha256_MACOS_AARCH64 }}
+          SHA256_MACOS_AMD64: ${{ steps.checksums.outputs.sha256_MACOS_AMD64 }}
+          SHA256_LINUX_AARCH64: ${{ steps.checksums.outputs.sha256_LINUX_AARCH64 }}
+          SHA256_LINUX_AMD64: ${{ steps.checksums.outputs.sha256_LINUX_AMD64 }}
+        run: |
+          mkdir -p output/Casks output/Formula
+
+          sed \
+            -e "s/{{VERSION}}/${VERSION}/g" \
+            -e "s/{{SHA256_MACOS_AARCH64}}/${SHA256_MACOS_AARCH64}/g" \
+            -e "s/{{SHA256_MACOS_AMD64}}/${SHA256_MACOS_AMD64}/g" \
+            etc/homebrew/cask.rb.template > output/Casks/project-env-cli.rb
+
+          sed \
+            -e "s/{{VERSION}}/${VERSION}/g" \
+            -e "s/{{SHA256_MACOS_AARCH64}}/${SHA256_MACOS_AARCH64}/g" \
+            -e "s/{{SHA256_MACOS_AMD64}}/${SHA256_MACOS_AMD64}/g" \
+            -e "s/{{SHA256_LINUX_AARCH64}}/${SHA256_LINUX_AARCH64}/g" \
+            -e "s/{{SHA256_LINUX_AMD64}}/${SHA256_LINUX_AMD64}/g" \
+            etc/homebrew/formula.rb.template > output/Formula/project-env-cli.rb
+
+      - name: Push to homebrew-tap
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_RELEASER_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          git clone "https://x-access-token:${GH_TOKEN}@github.com/Project-Env/homebrew-tap.git" homebrew-tap
+
+          mkdir -p homebrew-tap/Casks homebrew-tap/Formula
+          cp output/Casks/project-env-cli.rb homebrew-tap/Casks/project-env-cli.rb
+          cp output/Formula/project-env-cli.rb homebrew-tap/Formula/project-env-cli.rb
+
+          cd homebrew-tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/project-env-cli.rb Formula/project-env-cli.rb
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "bump project-env-cli to ${VERSION}"
+            git push origin main
+          fi

.github/workflows/release-drafter.yml

@@ -7,13 +7,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
       pull-requests: write
     steps:
-      - uses: release-drafter/release-drafter@v6.1.0
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}