ci: add Rust release workflow targeting GitHub Release assets by jd · Pull Request #1297 · Mergifyio/mergify-cli

jd · 2026-04-23T13:27:24Z

Starts distributing the static Rust binary alongside the existing
PyPI wheel. Both pipelines run on every published GitHub Release
until the Phase 1.6 channel switch makes the binary the sole
install path.

What ships per release

Seven targets as GitHub Release assets, plus matching
.sha256 checksum files:

x86_64-unknown-linux-gnu (glibc)
x86_64-unknown-linux-musl (static)
aarch64-unknown-linux-gnu (glibc, ARM server)
aarch64-unknown-linux-musl (static, ARM server)
x86_64-apple-darwin (Intel macOS, signed + notarized)
aarch64-apple-darwin (Apple Silicon, signed + notarized)
x86_64-pc-windows-msvc (Windows)

Archives use the mergify-<tag>-<target>.tar.gz / .zip
naming convention. Linux and Windows builds go through
taiki-e/upload-rust-binary-action which handles
cross-compilation via cross automatically. macOS builds run
natively on Apple Silicon runners with an explicit pipeline
because of the signing + notarization steps.

macOS signing / notarization

The macOS job imports a Developer ID Application certificate into
a throwaway keychain, codesigns the binary with the hardened
runtime + timestamp, then submits it to Apple's notarytool
service. Stapling isn't possible on a bare Mach-O; online
Gatekeeper checks approve notarized binaries on first run.

Required GitHub Actions secrets (all six must be set before the
next release):

APPLE_CERTIFICATE base64 of the .p12 Developer ID cert
APPLE_CERTIFICATE_PASSWORD password set when exporting the .p12
APPLE_SIGNING_IDENTITY "Developer ID Application: Mergify SAS (TEAMID)"
APPLE_API_KEY base64 of the App Store Connect .p8 API key
APPLE_API_KEY_ID 10-char key ID from App Store Connect
APPLE_API_KEY_ISSUER issuer UUID from App Store Connect

Install story today

Users grab a binary from the releases page:
https://github.com/Mergifyio/mergify-cli/releases/latest.
A curl | sh installer script + Homebrew tap land in separate
follow-up PRs once we've seen the first binary release succeed.

Parallel with PyPI

release.yml (existing) keeps publishing to PyPI unchanged.
Both workflows key off the same release: published event.
The Phase 1.6 channel switch is the user-coordinated moment where
we stop publishing to PyPI and direct users to the binary.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Depends-On: #1296

jd · 2026-04-23T13:27:27Z

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	test: add port-inventory guard to catch un-ported Python commands	#1296
2	ci: add Rust release workflow targeting GitHub Release assets	#1297	👈
3	feat(rust): port config simulate to native Rust (Phase 1.3b)	#1298
4	feat(rust): port ci scopes-send to native Rust (Phase 1.4)	#1300
5	feat(rust): port queue pause and unpause to native Rust (Phase 1.5)	#1301
6	feat(rust): port ci git-refs and ci queue-info to native Rust (Phase 1.6)	#1302

mergify · 2026-04-23T13:27:40Z

jd · 2026-04-23T13:31:10Z

Revision history

#	Type	Changes	Reason	Date
1	initial	`2da50c7`		2026-04-23 13:31 UTC
2	content	`2da50c7 → a2cca7a`		2026-04-23 13:31 UTC
3	rebase	`a2cca7a → cb257f5`	2026-04-23 19:02 UTC
4	rebase	`cb257f5 → 44fc353`	2026-04-24 13:41 UTC
5	rebase	`bb064d0 → 9e9ef12`		2026-04-27 07:03 UTC
6	rebase	`9e9ef12 → 6def985`		2026-04-28 06:48 UTC
7	rebase	`6def985 → 573114b`		2026-04-28 14:09 UTC
8	rebase	`573114b → 2d9fb8c`		2026-04-29 07:02 UTC
9	rebase	`2d9fb8c → b8b332d`		2026-04-29 09:06 UTC
10	content	`b8b332d → 7d1a6b3`		2026-04-29 11:05 UTC

During the Rust port, any new click command added to the Python CLI risks being silently missed if the Rust dispatch isn't updated in parallel. This adds a CI-enforced inventory at the repo root plus a pytest that walks the click tree and compares against it. ## How it works ``PORT_STATUS.toml`` lists every click subcommand with an explicit ``status`` of either ``native`` (handled by Rust's dispatch) or ``shimmed`` (forwarded to Python by the py-shim crate). ``mergify_cli/tests/test_port_status.py`` walks ``mergify_cli.cli.cli`` and fires four assertions: - Every discovered click command has an entry. - Every entry corresponds to a live click command (no stale rows). - Every entry uses a valid ``status`` value. - No entry carries extra keys (catches typos like ``stats``). Forgetting to update the file when adding a new Python command becomes a CI failure at test-time rather than a "why is this missing from the binary?" bug report months later. ## Current baseline All 30 click subcommands are listed. Only ``config validate`` is ``native`` today (from Phase 1.3 in the same stack). The remaining 29 are ``shimmed`` — each subsequent port PR flips its entry from ``shimmed`` to ``native`` in the same commit that adds the Rust dispatch, keeping the file and the code in lockstep. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Change-Id: I4a71d672f4795dbb3e2e9523ea01b8d7fbbfbcbe

Starts distributing the static Rust binary alongside the existing PyPI wheel. Both pipelines run on every published GitHub Release until the Phase 1.6 channel switch makes the binary the sole install path. ## What ships per release Seven targets as GitHub Release assets, plus matching ``.sha256`` checksum files: - ``x86_64-unknown-linux-gnu`` (glibc) - ``x86_64-unknown-linux-musl`` (static) - ``aarch64-unknown-linux-gnu`` (glibc, ARM server) - ``aarch64-unknown-linux-musl`` (static, ARM server) - ``x86_64-apple-darwin`` (Intel macOS, signed + notarized) - ``aarch64-apple-darwin`` (Apple Silicon, signed + notarized) - ``x86_64-pc-windows-msvc`` (Windows) Archives use the ``mergify-<tag>-<target>.tar.gz`` / ``.zip`` naming convention. Linux and Windows builds go through ``taiki-e/upload-rust-binary-action`` which handles cross-compilation via ``cross`` automatically. macOS builds run natively on Apple Silicon runners with an explicit pipeline because of the signing + notarization steps. ## macOS signing / notarization The macOS job imports a Developer ID Application certificate into a throwaway keychain, codesigns the binary with the hardened runtime + timestamp, then submits it to Apple's notarytool service. Stapling isn't possible on a bare Mach-O; online Gatekeeper checks approve notarized binaries on first run. Required GitHub Actions secrets (all six must be set before the next release): APPLE_CERTIFICATE base64 of the .p12 Developer ID cert APPLE_CERTIFICATE_PASSWORD password set when exporting the .p12 APPLE_SIGNING_IDENTITY "Developer ID Application: Mergify SAS (TEAMID)" APPLE_API_KEY base64 of the App Store Connect .p8 API key APPLE_API_KEY_ID 10-char key ID from App Store Connect APPLE_API_KEY_ISSUER issuer UUID from App Store Connect ## Install story today Users grab a binary from the releases page: ``https://github.com/Mergifyio/mergify-cli/releases/latest``. A ``curl | sh`` installer script + Homebrew tap land in separate follow-up PRs once we've seen the first binary release succeed. ## Parallel with PyPI ``release.yml`` (existing) keeps publishing to PyPI unchanged. Both workflows key off the same ``release: published`` event. The Phase 1.6 channel switch is the user-coordinated moment where we stop publishing to PyPI and direct users to the binary. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Change-Id: I48adf3e4ebfb49a1ea4ba171862ec72ba1776d7f

Pull request has been modified.

mergify · 2026-04-29T12:55:57Z

mergify Bot had a problem deploying to Mergify Merge Protections April 23, 2026 13:27 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 2da50c7 to a2cca7a Compare April 23, 2026 13:31

mergify Bot had a problem deploying to Mergify Merge Protections April 23, 2026 13:31 Failure

mergify Bot requested a review from a team April 23, 2026 13:37

This was referenced Apr 23, 2026

feat(rust): port config simulate to native Rust (Phase 1.3b) #1298

Merged

feat(rust): port ci scopes-send to native Rust (Phase 1.4) #1300

Open

feat(rust): port queue pause and unpause to native Rust (Phase 1.5) #1301

Draft

jd force-pushed the devs/jd/worktree-rust-port/add-port-inventory-guard-catch-un-ported-python--4a71d672 branch from b887a4a to fddda52 Compare April 23, 2026 19:02

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from a2cca7a to cb257f5 Compare April 23, 2026 19:02

jd mentioned this pull request Apr 23, 2026

feat(rust): port ci git-refs and ci queue-info to native Rust (Phase 1.6) #1302

Draft

mergify Bot had a problem deploying to Mergify Merge Protections April 23, 2026 19:03 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from cb257f5 to 44fc353 Compare April 24, 2026 13:41

mergify Bot had a problem deploying to Mergify Merge Protections April 24, 2026 13:41 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 44fc353 to bb064d0 Compare April 27, 2026 06:18

mergify Bot had a problem deploying to Mergify Merge Protections April 27, 2026 06:18 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from bb064d0 to 9e9ef12 Compare April 27, 2026 07:03

jd mentioned this pull request Apr 27, 2026

ci(renovate): group cargo / github-actions updates and enable lockFileMaintenance #1307

Merged

mergify Bot had a problem deploying to Mergify Merge Protections April 27, 2026 07:03 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 9e9ef12 to 6def985 Compare April 28, 2026 06:48

mergify Bot had a problem deploying to Mergify Merge Protections April 28, 2026 06:48 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-port-inventory-guard-catch-un-ported-python--4a71d672 branch from e525b00 to cc28fea Compare April 28, 2026 14:09

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 6def985 to 573114b Compare April 28, 2026 14:09

mergify Bot had a problem deploying to Mergify Merge Protections April 28, 2026 14:12 Failure

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 573114b to 2d9fb8c Compare April 29, 2026 07:02

jd force-pushed the devs/jd/worktree-rust-port/add-port-inventory-guard-catch-un-ported-python--4a71d672 branch from cc28fea to 2521caa Compare April 29, 2026 07:02

mergify Bot had a problem deploying to Mergify Merge Protections April 29, 2026 07:04 Failure

jd marked this pull request as ready for review April 29, 2026 07:35

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from 2d9fb8c to b8b332d Compare April 29, 2026 09:06

jd force-pushed the devs/jd/worktree-rust-port/add-port-inventory-guard-catch-un-ported-python--4a71d672 branch from 2521caa to 631557e Compare April 29, 2026 09:06

mergify Bot had a problem deploying to Mergify Merge Protections April 29, 2026 09:07 Failure

kozlek previously approved these changes Apr 29, 2026

View reviewed changes

Comment thread .github/workflows/release-rust.yml Outdated

mergify Bot requested a review from a team April 29, 2026 09:49

mergify Bot added the review threads unresolved label Apr 29, 2026

jd force-pushed the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch from b8b332d to 7d1a6b3 Compare April 29, 2026 11:05

mergify Bot removed the review threads unresolved label Apr 29, 2026

mergify Bot deployed to Mergify Merge Protections April 29, 2026 11:06 Active

Base automatically changed from devs/jd/worktree-rust-port/add-port-inventory-guard-catch-un-ported-python--4a71d672 to main April 29, 2026 12:13

kozlek approved these changes Apr 29, 2026

View reviewed changes

mergify Bot requested a review from a team April 29, 2026 12:45

JulianMaurin approved these changes Apr 29, 2026

View reviewed changes

mergify Bot added a commit that referenced this pull request Apr 29, 2026

Merge of #1297

5ad49df

mergify Bot mentioned this pull request Apr 29, 2026

merge queue: embarking main (7fff439) and #1297 together #1317

Closed

38 tasks

mergify Bot added the queued label Apr 29, 2026

mergify Bot merged commit bd7a116 into main Apr 29, 2026
12 checks passed

mergify Bot deleted the devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4 branch April 29, 2026 13:03

mergify Bot removed the queued label Apr 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add Rust release workflow targeting GitHub Release assets#1297

ci: add Rust release workflow targeting GitHub Release assets#1297
mergify[bot] merged 2 commits intomainfrom
devs/jd/worktree-rust-port/add-rust-release-workflow-targeting-github--48adf3e4

jd commented Apr 23, 2026 •

edited

Loading

Uh oh!

jd commented Apr 23, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

jd commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

mergify Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

jd commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What ships per release

macOS signing / notarization

Install story today

Parallel with PyPI

Uh oh!

jd commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Protections

🟢 ⛓️ Depends-On Requirements

🟢 🤖 Continuous Integration

🟢 👀 Review Requirements

🟢 Enforce conventional commit

🟢 🔎 Reviews

🟢 📕 PR description

Uh oh!

jd commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Revision history

Uh oh!

Uh oh!

mergify Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

jd commented Apr 23, 2026 •

edited

Loading

jd commented Apr 23, 2026 •

edited

Loading

mergify Bot commented Apr 23, 2026 •

edited

Loading

jd commented Apr 23, 2026 •

edited

Loading

mergify Bot commented Apr 29, 2026 •

edited

Loading