anodizer-action (GitHub Action)

Complete reference for tj-smith47/anodizer-action — inputs, outputs, and common patterns

tj-smith47/anodizer-action is the recommended way to run anodizer in GitHub Actions. It handles installation, dependency setup, key material, split/merge artifact handling, Docker registry login, and workspace resolution — removing most of the GitHub-Actions-specific plumbing from your workflow.

Basic usage

- uses: tj-smith47/anodizer-action@v1
  with:
    auto-install: true
    args: release --clean
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Inputs

Installation source

Pick exactly one installation path. Defaults to downloading the latest released anodizer binary.

Dependency setup

Anodizer shells out to external tools for several stages (nfpm, cosign, zig, etc.). The action can install them for you.

Key material

Signing keys are passed via inputs (never env vars that echo into logs).

Docker setup

When the action sees docker-registry set, it logs in, sets up QEMU (for emulated platforms), and configures Docker Buildx (for multi-platform builds).

Split / merge artifact management

For fan-out cross-platform builds (Split/Merge), the action can upload the dist/ directory after a split build and download+merge dist artifacts before a merge job.

Workspace resolution (monorepo)

When a tag-triggered workflow runs, the action can resolve the triggering tag to its owning crate so subsequent steps can use crate-scoped paths.

Determinism Harness

The action can run anodize check determinism directly (and preserve its hermetic dist tree for a downstream release --publish-only job) without the caller needing to know the harness CLI. See Determinism for the harness semantics.

Execution

Outputs

Common patterns

Simple tag-triggered release

name: Release
on:
  push:
    tags: ["v*"]

permissions:
  contents: write
  actions: read    # cross-workflow artifact downloads (if used)

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: tj-smith47/anodizer-action@v1
        with:
          auto-install: true
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}

No failure-handling steps are needed: anodizer release runs a config-derived preflight before any stage and executes the release.on_failure policy in-process on a pipeline failure.

Auto-tag on push to main

name: CI
on:
  push:
    branches: [main]

jobs:
  tag:
    if: "!contains(github.event.head_commit.message, '#none')"
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          # PAT so the pushed tag triggers downstream release.yml.
          token: ${{ secrets.GH_PAT }}
      - name: Configure git identity
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
      - uses: tj-smith47/anodizer-action@v1
        with:
          args: tag
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}

Workspace-aware auto-tag (monorepo)

Tag each crate in the workspace independently. install-only: true gives you the binary on PATH; you drive the loop yourself.

      - uses: tj-smith47/anodizer-action@v1
        with:
          install-only: true
      - name: Auto-tag all workspaces
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
        run: |
          for crate in my-core my-cli my-operator my-plugin; do
            echo "--- tagging $crate ---"
            if anodizer tag --crate "$crate"; then
              echo "::notice::$crate: tagged"
            else
              echo "::warning::$crate: skipped or failed"
            fi
          done
          git push origin HEAD || true

Tag-triggered monorepo release (resolve tag → crate)

name: Release
on:
  push:
    tags:
      - "v*"
      - "*-v*"

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: tj-smith47/anodizer-action@v1
        id: anodizer
        with:
          auto-install: true
          resolve-workspace: true
          docker-registry: ghcr.io
          docker-password: ${{ secrets.GITHUB_TOKEN }}
          args: release --crate ${{ steps.resolve.outputs.crate }} --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - if: steps.anodizer.outputs.has-builds == 'false'
        run: echo "Library-only crate — no binary artifacts produced."

Note: resolve-workspace: true runs anodizer resolve-tag and exposes the crate name via steps.<id>.outputs.workspace. You'll typically wire that into the --crate arg of args.

Split/merge cross-platform build

The action's built-in upload-dist / download-dist replaces the manual actions/upload-artifact + actions/download-artifact pair for split builds.

If your release path already runs anodizer check determinism, the preserve-dist + release --publish-only pattern is strictly better — it reuses the harness's byte-stable dist instead of compiling everything a second time in a separate matrix.

jobs:
  build:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: tj-smith47/anodizer-action@v1
        with:
          install-rust: true
          install: zig,cargo-zigbuild,upx
          upload-dist: true        # uploads dist/ as dist-$RUNNER_OS
          args: release --split --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  merge:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: tj-smith47/anodizer-action@v1
        with:
          auto-install: true
          download-dist: true      # downloads and merges dist-* artifacts
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          args: release --merge
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

Reuse a CI-built binary across workflows

When your ci.yml builds and uploads the anodizer binary once per commit, downstream release workflows can reuse it instead of reinstalling.

# ci.yml
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
- run: cargo build --release -p anodizer
- uses: actions/upload-artifact@v4
  with:
    name: anodizer-linux
    path: target/release/anodizer

# release.yml — reuses the ci.yml artifact
- uses: tj-smith47/anodizer-action@v1
  with:
    from-artifact: anodizer-linux
    artifact-run-id: auto
    artifact-workflow: ci.yml
    auto-install: true
    args: release --clean
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Pinning artifact-run-id: auto resolves the latest successful run of ci.yml for the current commit SHA, so the release workflow always picks up a binary built from the same source.

Dynamic build matrix from config

install-only: true produces a split-matrix output derived from .anodizer.yaml. You can feed that directly into a strategy.matrix.

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.setup.outputs.split-matrix }}
    steps:
      - uses: actions/checkout@v6
      - uses: tj-smith47/anodizer-action@v1
        id: setup
        with:
          install-only: true

  build:
    needs: setup
    strategy:
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: tj-smith47/anodizer-action@v1
        with:
          install-rust: true
          install: zig,cargo-zigbuild
          upload-dist: true
          args: release --split --clean
        env:
          TARGET: ${{ matrix.target }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Install only, run anodizer yourself

- uses: tj-smith47/anodizer-action@v1
  with:
    install-only: true
- run: anodizer check
- run: anodizer release --snapshot
- run: anodizer resolve-tag v1.2.3 --json

Test an un-released branch of anodizer

For integration testing a downstream project against an in-flight anodizer PR — or dogfooding a feature branch before it lands — use from-branch. The action shallow-clones tj-smith47/anodizer at the branch you name, builds it from source, and puts it on PATH:

- uses: actions/checkout@v6
- uses: tj-smith47/anodizer-action@v1
  with:
    from-branch: my-feature        # branch on tj-smith47/anodizer
    args: release --snapshot --clean
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

• The input accepts a branch name only — the repository is hardcoded to tj-smith47/anodizer.
• The Rust toolchain is auto-installed; you don't need to pass install-rust: true.
• The cargo target/ directory is cached per branch (separate cache key from from-source / determinism modes), so re-runs of the same branch on a hot runner are fast.
• Clones to ${RUNNER_TEMP}/anodizer-src — your workdir: is never mutated.
• Mutually exclusive with version, from-artifact, and from-source. Setting two install paths at once fails the workflow with an actionable error.

Env vars the action honors

Retry behavior

The Run anodizer step retries up to 3 times for transient failures (registry rate limits, Docker push auth expiry, network blips). Between retries it prunes generated artifacts from dist/ while preserving split context files (dist/*/context.json) so --merge can still find them. Deterministic failures (config errors, compile failures) will fail identically on every attempt, but the cost of two extra 10s waits is low relative to a flaky release run.

Stateful commands are never retried. The action detects three modes and runs them exactly once:

• release --publish-only — re-running would re-trigger PR-based publishers (homebrew, scoop, nix, krew, MCP) and open DUPLICATE PRs against the same tag. Recovery: use release --rollback-only --from-run=<id> first.
• release --rollback-only — idempotent at the entry level (already-rolled back entries no-op), but a retry could mask a real partial failure.
• tag rollback — already a recovery primitive; retrying would re-attempt remote tag deletes (which 404 the second time) and re-push the revert (which would fail with "Everything up-to-date" or a non-fast-forward error). The internal failure-mode-per-tag warn-and-continue handles transient flakes within a single invocation.

To disable retries for the normal release path, wrap anodizer manually with install-only: true.