Add a static Linux release pipeline

.changes/20260910_195554_cardano-sieve_jordan.millar_release_pipeline.yml

@@ -0,0 +1,10 @@
+description: 'Initial release. A pattern-filtered chain index for Cardano: follows
+  a local node over node-to-client chain-sync from Byron onwards, indexes matching
+  outputs, spends, datums, scripts and (opt-in) redeemers into SQLite, and serves
+  the HTTP query API (/matches, /datums, /scripts, /checkpoints, /patterns, /health,
+  /metrics, /metadata) from the same process or read-only from an existing database.
+  Static Linux binaries for x86_64 and aarch64 are published on every release tag.'
+kind:
+- feature
+pr: 7
+project: cardano-sieve

.changes/_TEMPLATE.yml

@@ -0,0 +1,16 @@
+# Changelog fragment template - copy this file and fill in the fields.
+# Or use 'herald new' for interactive creation.
+#
+# Files starting with _ are ignored by herald.
+#
+# Available projects and kinds are defined in .herald.yml
+
+# Which project this change belongs to (see 'projects' in .herald.yml)
+project: cardano-sieve
+# Pull request number associated with this change
+pr: 0
+# One or more change kinds (see 'kinds' in .herald.yml)
+kind:
+  - bugfix
+description: |
+  Describe your change here.

.github/workflows/build.yml

@@ -0,0 +1,204 @@
+name: Build
+
+# Builds fully static Linux binaries (x86_64 and aarch64) inside IOG's devx
+# static shell when a cardano-sieve-A.B.C.D release tag is pushed (created by
+# the herald release flow, see RELEASING.md), and publishes a GitHub Release
+# with the tarballs, checksums, and the matching CHANGELOG.md section.
+# Run it manually (workflow_dispatch) for a dry run: it builds and uploads the
+# tarballs as workflow artifacts without creating a release.
+
+on:
+  push:
+    tags: ['cardano-sieve-*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  # devx flavour: musl GHC 9.8 + cabal, static libsodium-vrf, secp256k1, blst,
+  # gmp, zlib, openssl. The prebuilt shell closure is fetched from
+  # ghcr.io/input-output-hk/devx by the setup action; nothing is built with nix.
+  DEVX_COMPILER: ghc98
+  PROJECT: --project-file=cabal.project.release --builddir=dist-static
+jobs:
+  build:
+    name: Build (${{ matrix.arch }}-linux, static)
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x86_64, aarch64]
+    runs-on: ${{ matrix.arch == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    timeout-minutes: 360
+    env:
+      # The musl cross compiler has to be named twice over: --with-compiler /
+      # --with-hc-pkg drive cabal's project-level compiler probe, while the
+      # --with-PROG forms reach per-package configure. Supplying only one set
+      # makes cabal fall back to a plain `ghc`/`ghc-pkg` on PATH for the other
+      # (none exists in the static shell). The shell's cabal wrapper adds the
+      # --with-PROG set itself via NIX_CABAL_FLAGS; spelling it out here keeps
+      # the build independent of that. `build` is deliberately not the first
+      # word: the wrapper's `cabal build` branch adds --disable-shared, which
+      # breaks dependency builds. Static linking comes from the project file.
+      CABAL_FLAGS: >-
+        --with-compiler=${{ matrix.arch }}-unknown-linux-musl-ghc
+        --with-hc-pkg=${{ matrix.arch }}-unknown-linux-musl-ghc-pkg
+        --with-ghc=${{ matrix.arch }}-unknown-linux-musl-ghc
+        --with-ghc-pkg=${{ matrix.arch }}-unknown-linux-musl-ghc-pkg
+        --with-hsc2hs=${{ matrix.arch }}-unknown-linux-musl-hsc2hs
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+
+      - name: Set up devx static shell
+        # Installs nix, imports the prebuilt closure, and provides a `devx`
+        # wrapper that runs a script inside the shell (CABAL_DIR=~/.cabal-static).
+        uses: input-output-hk/actions/devx@dbb6ea6d50ffc37a2d481fd8047aff028bac3223 # 2026-02-28
+        with:
+          platform: ${{ matrix.arch }}-linux
+          target-platform: -static
+          compiler-nix-name: ${{ env.DEVX_COMPILER }}
+          minimal: true
+          iog: true
+
+      - name: Configure
+        # devx exports the cabal.project.local snippet static links need
+        # (pkg-config for zlib/digest/HsOpenSSL). The freeze file keys the cache.
+        shell: devx {0}
+        env:
+          TRIPLE: ${{ matrix.arch }}-unknown-linux-musl
+        run: |
+          set -euo pipefail
+          # cabal still reaches for a plain `ghc-pkg` on PATH in one code path
+          # regardless of the --with flags, and the static shell has only the
+          # triple-prefixed tools; give it musl-backed plain names. The runner's
+          # git is appended for the cardano-api source-repository-package.
+          mkdir -p "$HOME/.musl-bin"
+          for t in ghc ghc-pkg hsc2hs; do ln -sf "$(command -v "$TRIPLE-$t")" "$HOME/.musl-bin/$t"; done
+          export PATH="$HOME/.musl-bin:$PATH:/usr/bin:/bin"
+          echo "$CABAL_PROJECT_LOCAL_TEMPLATE" > cabal.project.release.local
+          echo "::group::toolchain"
+          echo "NIX_CABAL_FLAGS=${NIX_CABAL_FLAGS-<unset>}"
+          type ghc ghc-pkg hsc2hs cabal git
+          "$TRIPLE-ghc" --version
+          cabal --version
+          echo "::endgroup::"
+          cabal update
+          cabal $PROJECT $CABAL_FLAGS freeze
+
+      - name: Cache cabal store
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cabal-static/packages
+            ~/.cabal-static/store
+          key: cabal-static-${{ matrix.arch }}-linux-${{ env.DEVX_COMPILER }}-${{ hashFiles('cabal.project.release.freeze') }}
+          restore-keys: |
+            cabal-static-${{ matrix.arch }}-linux-${{ env.DEVX_COMPILER }}-
+
+      - name: Build
+        shell: devx {0}
+        env:
+          TRIPLE: ${{ matrix.arch }}-unknown-linux-musl
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.musl-bin:$PATH:/usr/bin:/bin"
+          cabal $PROJECT $CABAL_FLAGS build cardano-sieve:exe:cardano-sieve -j4
+          echo "BIN=$(cabal $PROJECT $CABAL_FLAGS list-bin cardano-sieve:exe:cardano-sieve)" >> "$GITHUB_ENV"
+
+      - name: Verify
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          file "$BIN"
+          file "$BIN" | grep -q 'statically linked'
+          "$BIN" --version
+          "$BIN" +RTS --info -RTS
+          if [[ "$REF_TYPE" == tag ]]; then
+            expected="cardano-sieve ${REF_NAME#cardano-sieve-}"
+            actual=$("$BIN" --version)
+            if [[ "$actual" != "$expected" ]]; then
+              echo "::error::binary reports '$actual' but tag $REF_NAME expects '$expected' (bump version: in cardano-sieve.cabal)"
+              exit 1
+            fi
+          fi
+
+      - name: Package
+        id: package
+        env:
+          ARCH: ${{ matrix.arch }}
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          # Tag cardano-sieve-A.B.C.D -> cardano-sieve-A.B.C.D-<arch>-linux.tar.gz
+          if [[ "$REF_TYPE" == tag ]]; then label="${REF_NAME#cardano-sieve-}"; else label="${SHA::7}"; fi
+          name="cardano-sieve-${label}-${ARCH}-linux"
+          mkdir -p dist/bin dist/share/cardano-sieve \
+                   dist/share/bash-completion/completions dist/share/zsh/site-functions
+          cp "$BIN" dist/bin/cardano-sieve
+          strip dist/bin/cardano-sieve
+          cp LICENSE dist/share/cardano-sieve/LICENSE
+          dist/bin/cardano-sieve --bash-completion-script cardano-sieve \
+            > dist/share/bash-completion/completions/cardano-sieve
+          dist/bin/cardano-sieve --zsh-completion-script cardano-sieve \
+            > dist/share/zsh/site-functions/_cardano-sieve
+          tar -czf "$name.tar.gz" -C dist bin share
+          ls -l "$name.tar.gz"
+          echo "name=$name" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ steps.package.outputs.name }}
+          path: ${{ steps.package.outputs.name }}.tar.gz
+          if-no-files-found: error
+
+  release:
+    name: Publish GitHub Release
+    needs: build
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          pattern: cardano-sieve-*
+          merge-multiple: true
+
+      - name: Checksums and release notes
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          ls -l cardano-sieve-*.tar.gz
+          version="${REF_NAME#cardano-sieve-}"
+          sha256sum cardano-sieve-*.tar.gz | tee "cardano-sieve-${version}-sha256sums.txt"
+          # Fails if CHANGELOG.md has no section for this version.
+          scripts/ci/extract-changelog.sh "$version" > RELEASE_NOTES.md
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+
+      - name: Create release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ env.VERSION }}
+          body_path: RELEASE_NOTES.md
+          draft: false
+          fail_on_unmatched_files: true
+          files: |
+            cardano-sieve-*.tar.gz
+            cardano-sieve-*-sha256sums.txt

.github/workflows/check-pr-changelog.yml

@@ -0,0 +1,33 @@
+name: Check changelog fragments
+
+# Every PR must carry a herald changelog fragment in .changes/ whose `pr:`
+# matches the PR number. Create one with:
+#   nix run github:input-output-hk/cardano-dev/herald-0.2.0.0#herald -- new
+
+permissions:
+  contents: read
+
+on:
+  merge_group:
+  pull_request:
+    types: [opened, synchronize, ready_for_review]
+
+jobs:
+  check-changelog:
+    # Skip for merge_group: batched diffs would cause false positives and
+    # the PR number is unavailable. The trigger is kept so the check reports
+    # "skipped" (passes) when it is a required status check.
+    if: ${{ github.event_name != 'merge_group' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
+        with:
+          extra_nix_config: |
+            accept-flake-config = true
+
+      - uses: input-output-hk/cardano-dev/actions/herald-validate@9106b37910e40be00cda65051922d6ef939fa67a # herald-validate-0.0.1.1

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+
+# Cuts a release the way cardano-api does, with herald: computes the next PVP
+# version from the changelog fragments (or takes an explicit one), creates a
+# release/cardano-sieve-A.B.C.D branch with the changelog section and cabal
+# version bump, and opens a release PR. Signing the commits and pushing the
+# cardano-sieve-A.B.C.D tag is done by hand from the PR's instructions; the
+# tag push then triggers the Build workflow, which publishes the binaries.
+# See RELEASING.md.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Explicit version (A.B.C.D). Leave empty to compute from the changelog fragments.'
+        required: false
+        type: string
+      branch:
+        description: 'Branch to release from and target for the PR. Leave empty for the selected branch.'
+        required: false
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.branch || github.ref_name }}
+          fetch-depth: 0
+
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
+        with:
+          extra_nix_config: |
+            accept-flake-config = true
+
+      - uses: input-output-hk/cardano-dev/actions/herald-release@609046ca0378bdac28ff9abc4b42d7dcf9a96965 # herald-release-0.0.3.0
+        with:
+          package: cardano-sieve
+          version: ${{ inputs.version }}
+          base-branch: ${{ inputs.branch || github.ref_name }}
+          chap-instructions: false

.gitignore

@@ -5,3 +5,6 @@ bench/
 .ghc.environment.*
 *.hi
 *.o
+cabal.project.release.local
+cabal.project.release.freeze
+dist-static/

.herald.yml

@@ -0,0 +1,68 @@
+# Herald configuration
+# Changelog and release automation for PVP-versioned Haskell projects
+
+# Git repository URL (used for PR links in changelogs)
+git-repo: https://github.com/IntersectMBO/cardano-sieve
+
+# Directory for changelog fragments, relative to repo root
+# Fragments are YAML files created by 'herald new' and consumed by 'herald batch'
+changes-dir: .changes
+
+# Change kinds and their properties
+#
+# Each kind defines:
+#   notable: if true (default), changes of this kind appear in the changelog
+#           if false, they still bump the version but are omitted from the changelog text
+#   bump:    PVP version component to bump when this kind is present
+#           0.1.0.0 = bump 2nd component (breaking changes)
+#           0.0.1.0 = bump 3rd component (features, compatible changes)
+#           0.0.0.1 = bump 4th component (patches, internal changes)
+#
+# The highest bump across all fragment kinds determines the final version bump.
+kinds:
+  breaking:
+    bump: 0.1.0.0
+    description: the API has changed in a breaking way
+  bugfix:
+    bump: 0.0.0.1
+    description: fixes a defect
+  compatible:
+    bump: 0.0.1.0
+    description: the API has changed but is non-breaking
+  documentation:
+    notable: false
+    bump: 0.0.0.1
+    description: change in code docs, haddocks
+  feature:
+    bump: 0.0.1.0
+    description: introduces a new feature
+  maintenance:
+    notable: false
+    bump: 0.0.0.1
+    description: not directly related to the code
+  optimisation:
+    bump: 0.0.0.1
+    description: measurable performance improvements
+  refactoring:
+    notable: false
+    bump: 0.0.0.1
+    description: code quality improvements
+  release:
+    notable: false
+    bump: 0.0.0.1
+    description: related to a new release preparation
+  test:
+    notable: false
+    bump: 0.0.0.1
+    description: fixes or modifies tests
+
+# Projects in this repository
+#
+# Each project needs:
+#   changelog:  path to the project's CHANGELOG.md (relative to repo root)
+#   cabal-file:   (optional) path to the project's .cabal file (version is read/updated here)
+#   version-file: (optional) path to a plain-text version file (alternative to cabal-file)
+projects:
+  cardano-sieve:
+    changelog: CHANGELOG.md
+    cabal-file: cardano-sieve.cabal

CHANGELOG.md

@@ -0,0 +1 @@
+# Changelog for cardano-sieve