This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-sqlx-adapter.git
The following commit(s) were added to refs/heads/master by this push:
new ad4f8f8 feat: derive release version from git tag and add ASF release
pipeline
ad4f8f8 is described below
commit ad4f8f827006ad240207024eb3d6a702c31565ff
Author: Yang Luo <[email protected]>
AuthorDate: Thu Sep 17 21:44:35 2026 +0800
feat: derive release version from git tag and add ASF release pipeline
---
.github/dependabot.yml | 17 ++++
.github/scripts/release.sh | 157 +++++++++++++++++++++++++++++
.github/scripts/test-release.sh | 140 ++++++++++++++++++++++++++
.github/workflows/ci.yml | 60 +++++++++++-
.github/workflows/coverage.yml | 19 +++-
.github/workflows/release.yml | 180 +++++++++++++++++++---------------
.gitignore | 19 +++-
.rat-excludes | 24 +++++
Cargo.toml | 29 +++++-
README.md | 31 +++++-
RELEASING.md | 94 ++++++++++++++++++
examples/rbac_model.conf | 19 +++-
examples/rbac_with_domains_model.conf | 19 +++-
sample.env | 17 ++++
scripts/login-db.sh | 17 ++++
scripts/setup-db.sh | 17 ++++
src/actions.rs | 17 ++++
src/adapter.rs | 17 ++++
src/error.rs | 17 ++++
src/lib.rs | 17 ++++
src/models.rs | 17 ++++
21 files changed, 854 insertions(+), 90 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index dd5e655..9221bf7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
version: 2
updates:
- package-ecosystem: cargo
diff --git a/.github/scripts/release.sh b/.github/scripts/release.sh
new file mode 100755
index 0000000..2a98a0e
--- /dev/null
+++ b/.github/scripts/release.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Release helpers used by .github/workflows/release.yml. Run from the
+# repository root.
+#
+# release.sh meta <tag> tag -> version / is_rc / basename
+# release.sh set-version <version> write the version into Cargo.toml
+# release.sh archive <version> <dir> build the source tarball + .sha512
+# release.sh verify <version> <dir> fetch the voted tarball from ASF,
+# check it, and compare it with git
+#
+# Cargo.toml carries the placeholder version 0.0.0. The real version only
+# exists in the git tag (vX.Y.Z or vX.Y.Z-rcN) and is substituted here, so a
+# release never needs a "bump version" commit.
+
+set -euo pipefail
+
+PLACEHOLDER='0.0.0'
+ARTIFACT_PREFIX='apache-casbin-sqlx-adapter'
+# Where promoted releases end up after the vote. Overridable for tests.
+ASF_DIST_URL="${ASF_DIST_URL:-https://downloads.apache.org/incubator/casbin}";
+
+fail() {
+ echo "::error::$*" >&2
+ exit 1
+}
+
+basename_for() {
+ echo "${ARTIFACT_PREFIX}-$1-incubating-src"
+}
+
+require_version() {
+ [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail "'$1' is not a final
version X.Y.Z"
+}
+
+# Substitute the placeholder in a Cargo.toml read from stdin.
+substitute_version() {
+ local version="$1" manifest
+ manifest="$(cat)"
+ local hits
+ hits="$(grep -c "^version = \"$PLACEHOLDER\"$" <<<"$manifest" || true)"
+ [[ "$hits" == 1 ]] || fail "Cargo.toml must contain exactly one 'version =
\"$PLACEHOLDER\"' line (found $hits). The version comes from the git tag; do
not hard-code it."
+ sed "s/^version = \"$PLACEHOLDER\"$/version = \"$version\"/" <<<"$manifest"
+}
+
+# Print the id of a tree that is HEAD with the version written into
+# Cargo.toml. Uses a scratch index, so neither the real index nor the working
+# tree is touched.
+source_tree() {
+ local version="$1" blob
+ blob="$(git show HEAD:Cargo.toml | substitute_version "$version" | git
hash-object -w --stdin)"
+ (
+ export GIT_INDEX_FILE
+ GIT_INDEX_FILE="$(mktemp)"
+ git read-tree HEAD
+ git update-index --cacheinfo "100644,$blob,Cargo.toml"
+ git write-tree
+ rm -f "$GIT_INDEX_FILE"
+ )
+}
+
+cmd_meta() {
+ local tag="${1:?usage: release.sh meta <tag>}"
+ [[ "$tag" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)(-rc[1-9][0-9]*)?$ ]] || fail "Tag
'$tag' is not vX.Y.Z or vX.Y.Z-rcN"
+ local version="${BASH_REMATCH[1]}" is_rc=false
+ [[ -n "${BASH_REMATCH[2]}" ]] && is_rc=true
+ {
+ echo "version=$version"
+ echo "is_rc=$is_rc"
+ echo "basename=$(basename_for "$version")"
+ } >>"${GITHUB_OUTPUT:-/dev/stdout}"
+}
+
+cmd_set_version() {
+ local version="${1:?usage: release.sh set-version <version>}"
+ require_version "$version"
+ local manifest
+ manifest="$(substitute_version "$version" <Cargo.toml)"
+ printf '%s
+' "$manifest" >Cargo.toml
+ echo "Cargo.toml version set to $version"
+}
+
+cmd_archive() {
+ local version="${1:?usage: release.sh archive <version> <dir>}"
dir="${2:?output dir required}"
+ require_version "$version"
+ local name tree
+ name="$(basename_for "$version")"
+ tree="$(source_tree "$version")"
+ mkdir -p "$dir"
+ # Tracked sources only, unpacking into a single top-level directory.
+ git archive --format=tar.gz --prefix="$name/" -o "$dir/$name.tar.gz"
"$tree"
+ (cd "$dir" && sha512sum "$name.tar.gz" >"$name.tar.gz.sha512")
+ echo "Built $dir/$name.tar.gz from tree $tree (HEAD $(git rev-parse HEAD)
with version $version)"
+}
+
+cmd_verify() {
+ local version="${1:?usage: release.sh verify <version> <dir>}"
dir="${2:?output dir required}"
+ require_version "$version"
+ local name url tmp
+ name="$(basename_for "$version")"
+ url="$ASF_DIST_URL/sqlx-adapter-$version-incubating"
+ [[ ! -e "$dir" ]] || [[ -z "$(ls -A "$dir")" ]] || fail "Output dir $dir
already exists and is not empty"
+ mkdir -p "$dir"
+ tmp="$(mktemp -d)"
+ # shellcheck disable=SC2064 # expand now: $tmp is local to this function
+ trap "rm -rf '$tmp'" EXIT
+
+ # 1. The voted files, exactly as promoted to the ASF release area.
+ for suffix in '' .sha512 .asc; do
+ curl -fsSL --retry 3 -o "$dir/$name.tar.gz$suffix"
"$url/$name.tar.gz$suffix" \
+ || fail "Cannot download $url/$name.tar.gz$suffix. Was the release
promoted to the ASF dist area?"
+ done
+ curl -fsSL --retry 3 -o "$tmp/KEYS" "$ASF_DIST_URL/KEYS" || fail "Cannot
download $ASF_DIST_URL/KEYS"
+
+ # 2. Checksum and signature, against the project KEYS file only.
+ (cd "$dir" && sha512sum -c "$name.tar.gz.sha512") || fail "SHA-512
mismatch for $name.tar.gz"
+ (umask 077 && mkdir "$tmp/gnupg")
+ gpg --batch --quiet --homedir "$tmp/gnupg" --import "$tmp/KEYS"
+ gpg --batch --homedir "$tmp/gnupg" --verify "$dir/$name.tar.gz.asc"
"$dir/$name.tar.gz" \
+ || fail "GPG signature of $name.tar.gz does not verify against
$ASF_DIST_URL/KEYS"
+
+ # 3. The voted sources must be exactly what this tag points at.
+ mkdir "$tmp/asf" "$tmp/git"
+ tar -xzf "$dir/$name.tar.gz" -C "$tmp/asf"
+ git archive --format=tar --prefix="$name/" "$(source_tree "$version")" |
tar -x -C "$tmp/git"
+ diff -r "$tmp/asf" "$tmp/git" || fail "The voted source archive differs
from the sources at $(git rev-parse HEAD)"
+ echo "Verified $name.tar.gz: checksum, signature and contents match $(git
rev-parse HEAD)"
+}
+
+case "${1:-}" in
+ meta) shift; cmd_meta "$@" ;;
+ set-version) shift; cmd_set_version "$@" ;;
+ archive) shift; cmd_archive "$@" ;;
+ verify) shift; cmd_verify "$@" ;;
+ *)
+ echo "usage: release.sh meta <tag> | set-version <version> | archive
<version> <dir> | verify <version> <dir>" >&2
+ exit 2
+ ;;
+esac
diff --git a/.github/scripts/test-release.sh b/.github/scripts/test-release.sh
new file mode 100755
index 0000000..14f15ac
--- /dev/null
+++ b/.github/scripts/test-release.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# End-to-end test for release.sh against a throwaway git repository, a
+# throwaway GPG key and a fake ASF dist area served over file://. Nothing
+# touches the network or the real repository. Needs git, gpg, curl, tar,
+# sha512sum.
+
+set -euo pipefail
+
+RELEASE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release.sh"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+cd "$WORK"
+
+VERSION=1.2.3
+NAME="apache-casbin-sqlx-adapter-$VERSION-incubating-src"
+ASF="$WORK/asf"
+RELEASE_DIR="$ASF/sqlx-adapter-$VERSION-incubating"
+
+# curl wants file:///C:/... on Windows and file:///tmp/... elsewhere.
+file_url() {
+ local p
+ p="$(cygpath -m "$1" 2>/dev/null || printf '%s' "$1")"
+ case "$p" in /*) echo "file://$p" ;; *) echo "file:///$p" ;; esac
+}
+
+pass() { echo "ok - $*"; }
+expect_fail() {
+ local what="$1"; shift
+ if "$@" >/dev/null 2>&1; then
+ echo "FAIL - $what: expected failure, but it succeeded" >&2
+ exit 1
+ fi
+ pass "$what (rejected)"
+}
+
+commit() {
+ git -c user.name=test -c [email protected] commit -q
--allow-empty -am "$1"
+}
+
+# --- fixture repository ----------------------------------------------------
+mkdir repo && cd repo
+git init -q
+printf '[package]\nname = "sqlx-adapter"\nversion = "0.0.0"\nedition =
"2018"\n' >Cargo.toml
+echo 'fixture' >LICENSE
+git add . && commit 'fixture'
+
+# --- meta --------------------------------------------------------------------
+out="$WORK/meta"
+GITHUB_OUTPUT="$out" "$RELEASE" meta v1.2.3
+grep -qx "version=1.2.3" "$out" && grep -qx "is_rc=false" "$out" && grep -qx
"basename=$NAME" "$out"
+pass "meta v1.2.3"
+: >"$out"
+GITHUB_OUTPUT="$out" "$RELEASE" meta v1.2.3-rc7
+grep -qx "version=1.2.3" "$out" && grep -qx "is_rc=true" "$out" && grep -qx
"basename=$NAME" "$out"
+pass "meta v1.2.3-rc7 (same artifact name as the final release)"
+for tag in 1.2.3 v1.2 v1.2.3-rc0 v1.2.3-rc v1.2.3-beta1 v1.2.3rc1 master; do
+ expect_fail "meta $tag" "$RELEASE" meta "$tag"
+done
+
+# --- set-version -------------------------------------------------------------
+"$RELEASE" set-version "$VERSION" >/dev/null
+grep -qx "version = \"$VERSION\"" Cargo.toml && pass "set-version writes
$VERSION"
+expect_fail "set-version twice (placeholder already gone)" "$RELEASE"
set-version "$VERSION"
+expect_fail "set-version with rc suffix" "$RELEASE" set-version "$VERSION-rc1"
+git checkout -q -- Cargo.toml
+
+# --- archive -----------------------------------------------------------------
+"$RELEASE" archive "$VERSION" "$WORK/dist" >/dev/null
+(cd "$WORK/dist" && sha512sum -c --quiet "$NAME.tar.gz.sha512")
+pass "archive produces tarball and matching .sha512"
+tar -tzf "$WORK/dist/$NAME.tar.gz" | grep -vq "^$NAME/" && { echo "FAIL -
entries outside $NAME/" >&2; exit 1; }
+tar -xzf "$WORK/dist/$NAME.tar.gz" -C "$WORK" "$NAME/Cargo.toml"
+grep -qx "version = \"$VERSION\"" "$WORK/$NAME/Cargo.toml" && pass "archive
carries the tag version"
+grep -qx 'version = "0.0.0"' Cargo.toml && [[ -z "$(git status --porcelain)"
]] && pass "archive leaves the working tree untouched"
+expect_fail "archive with rc suffix" "$RELEASE" archive "$VERSION-rc1"
"$WORK/dist-rc"
+
+# --- fake ASF dist area
-------------------------------------------------------
+(umask 077 && mkdir "$WORK/gnupg" "$WORK/gnupg-other")
+gpg --batch --quiet --homedir "$WORK/gnupg" --passphrase ''
--quick-generate-key 'Release Manager <[email protected]>' default default
never
+gpg --batch --quiet --homedir "$WORK/gnupg-other" --passphrase ''
--quick-generate-key 'Someone Else <[email protected]>' default default
never
+mkdir -p "$RELEASE_DIR"
+gpg --batch --quiet --homedir "$WORK/gnupg" --armor --export >"$ASF/KEYS"
+cp "$WORK/dist/$NAME.tar.gz" "$WORK/dist/$NAME.tar.gz.sha512" "$RELEASE_DIR/"
+sign() { gpg --batch --quiet --homedir "$1" --armor --yes --detach-sign -o
"$RELEASE_DIR/$NAME.tar.gz.asc" "$RELEASE_DIR/$NAME.tar.gz"; }
+sign "$WORK/gnupg"
+export ASF_DIST_URL
+ASF_DIST_URL="$(file_url "$ASF")"
+
+# --- verify: happy path
-------------------------------------------------------
+"$RELEASE" verify "$VERSION" "$WORK/verified"
+for f in "$NAME.tar.gz" "$NAME.tar.gz.sha512" "$NAME.tar.gz.asc"; do
+ cmp -s "$WORK/verified/$f" "$RELEASE_DIR/$f"
+done
+pass "verify accepts the promoted files and keeps them byte for byte"
+expect_fail "verify into a non-empty dir" "$RELEASE" verify "$VERSION"
"$WORK/verified"
+
+# --- verify: rejections
-------------------------------------------------------
+expect_fail "verify with rc suffix" "$RELEASE" verify "$VERSION-rc1" "$WORK/v0"
+expect_fail "verify unknown version (nothing promoted)" "$RELEASE" verify
9.9.9 "$WORK/v1"
+
+mv "$RELEASE_DIR/$NAME.tar.gz.asc" "$WORK/asc.bak"
+expect_fail "verify without .asc" "$RELEASE" verify "$VERSION" "$WORK/v2"
+mv "$WORK/asc.bak" "$RELEASE_DIR/$NAME.tar.gz.asc"
+
+sign "$WORK/gnupg-other"
+expect_fail "verify with a signature from a key not in KEYS" "$RELEASE" verify
"$VERSION" "$WORK/v3"
+sign "$WORK/gnupg"
+
+cp "$RELEASE_DIR/$NAME.tar.gz" "$WORK/tgz.bak"
+printf 'x' >>"$RELEASE_DIR/$NAME.tar.gz"
+expect_fail "verify with a tampered tarball" "$RELEASE" verify "$VERSION"
"$WORK/v4"
+cp "$WORK/tgz.bak" "$RELEASE_DIR/$NAME.tar.gz"
+
+# Valid checksum and signature, but the tag no longer points at the voted
+# sources: this is the case the download step alone cannot catch.
+echo 'changed after the vote' >>LICENSE
+commit 'post-vote change'
+expect_fail "verify when the tag differs from the voted sources" "$RELEASE"
verify "$VERSION" "$WORK/v5"
+git reset -q --hard HEAD~1
+"$RELEASE" verify "$VERSION" "$WORK/v6" >/dev/null 2>&1 && pass "verify passes
again at the voted commit"
+
+echo "all release.sh checks passed"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4b6e7c0..2636b46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
name: CI
on:
@@ -43,9 +60,9 @@ jobs:
if: matrix.os == 'ubuntu-latest'
run: |
sudo apt-get update
- sudo apt-get upgrade
sudo apt-get install -y libpq-dev postgresql libmysqlclient-dev
mysql-client libsqlite3-dev sqlite3
- echo "host all all 127.0.0.1/32
md5" > sudo tee -a /etc/postgresql/10/main/pg_hba.conf
+ # The runner's stock pg_hba.conf already allows password logins from
+ # 127.0.0.1, which is all the tests need.
sudo service postgresql restart && sleep 3
sudo -u postgres createuser casbin_rs
sudo -u postgres createdb casbin
@@ -151,4 +168,41 @@ jobs:
cargo test --no-default-features --features
sqlite,runtime-async-std-native-tls
cargo test --no-default-features --features
sqlite,runtime-async-std-rustls
cargo test --no-default-features --features
sqlite,runtime-tokio-native-tls
- cargo test --no-default-features --features
sqlite,runtime-tokio-rustls
\ No newline at end of file
+ cargo test --no-default-features --features
sqlite,runtime-tokio-rustls
+
+ release-scripts:
+ name: Release Scripts
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@v4
+
+ - name: Test release.sh against a throwaway repo and a fake ASF dist area
+ run: .github/scripts/test-release.sh
+
+ license-headers:
+ name: License Headers (Apache RAT)
+ runs-on: ubuntu-latest
+ env:
+ RAT_VERSION: 0.16.1
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@v4
+
+ - name: Set up Java
+ uses: actions/setup-java@v4
+ with:
+ distribution: temurin
+ java-version: '17'
+
+ - name: Download Apache RAT
+ run: curl -fsSL --retry 3 -o "$RUNNER_TEMP/rat.jar"
"https://repo1.maven.org/maven2/org/apache/rat/apache-rat/$RAT_VERSION/apache-rat-$RAT_VERSION.jar";
+
+ # Audit exactly what a source release would contain: the tracked files.
+ - name: Check license headers
+ run: |
+ set -euo pipefail
+ mkdir "$RUNNER_TEMP/src"
+ git archive HEAD | tar -x -C "$RUNNER_TEMP/src"
+ java -jar "$RUNNER_TEMP/rat.jar" --scan-hidden-directories -d
"$RUNNER_TEMP/src" -E .rat-excludes | tee "$RUNNER_TEMP/rat.txt"
+ grep -q '^0 Unknown Licenses' "$RUNNER_TEMP/rat.txt"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 8a0209a..3111779 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
name: Coverage
on:
@@ -62,4 +79,4 @@ jobs:
- name: Upload to codecov.io
uses: codecov/codecov-action@v5
with:
- token: ${{secrets.CODECOV_TOKEN}}
\ No newline at end of file
+ token: ${{secrets.CODECOV_TOKEN}}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cadb401..d4922aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,8 +1,32 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
name: Release
-# Releases are NOT automatic. A release manager pushes a git tag manually:
-# * v1.4.0-rc1 -> publishes a GitHub *pre-release* only (artifact for the
Apache vote)
-# * v1.4.0 -> publishes a GitHub *release* and pushes the crate to
crates.io
+# Releases are cut by hand by pushing a tag. The version lives only in the
+# tag; Cargo.toml keeps the 0.0.0 placeholder. See RELEASING.md.
+#
+# vX.Y.Z-rcN -> builds the source tarball for the Apache vote and attaches
+# it to a GitHub pre-release. Nothing is signed or published.
+# vX.Y.Z -> downloads the voted tarball from the ASF release area,
+# checks its signature/checksum and that it matches this
+# tag, then creates the GitHub release and publishes the
+# crate to crates.io from the very same sources.
+
on:
push:
tags:
@@ -11,98 +35,98 @@ on:
permissions:
contents: write
+concurrency:
+ group: release-${{ github.ref }}
+ cancel-in-progress: false
+
jobs:
release:
- name: Manual Tag Release
+ name: Release ${{ github.ref_name }}
+ if: github.repository == 'apache/casbin-sqlx-adapter'
runs-on: ubuntu-latest
-
+ outputs:
+ version: ${{ steps.meta.outputs.version }}
+ is_rc: ${{ steps.meta.outputs.is_rc }}
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- - name: Resolve Tag
- id: tag
- run: |
- set -euo pipefail
- TAG="${GITHUB_REF_NAME}"
- VERSION="${TAG#v}"
-
- if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-[Rr][Cc]([0-9]+)$ ]];
then
- BASE_VERSION="${BASH_REMATCH[1]}"
- RC_NUMBER="${BASH_REMATCH[2]}"
- IS_RC=true
- elif [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
- BASE_VERSION="$VERSION"
- RC_NUMBER=""
- IS_RC=false
- else
- echo "::error::Tag '$TAG' is not a supported release tag (expected
vX.Y.Z or vX.Y.Z-rcN)."
- exit 1
- fi
-
- CARGO_VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml |
head -n 1)"
- if [[ "$CARGO_VERSION" != "$BASE_VERSION" ]]; then
- echo "::error::Cargo.toml version ($CARGO_VERSION) does not match
tag version ($BASE_VERSION). Bump Cargo.toml before tagging."
- exit 1
- fi
+ - name: Resolve version from tag
+ id: meta
+ run: .github/scripts/release.sh meta "$GITHUB_REF_NAME"
- # Apache source release artifact naming. The RC number is
intentionally
- # NOT part of the file name, so the bits that get voted on are byte
- # identical to the bits published for the final release.
-
ARTIFACT="apache-casbin-sqlx-adapter-${BASE_VERSION}-incubating-src.tar.gz"
+ - name: Build source tarball for the vote
+ if: steps.meta.outputs.is_rc == 'true'
+ run: .github/scripts/release.sh archive "${{
steps.meta.outputs.version }}" "$RUNNER_TEMP/dist"
- {
- echo "tag=$TAG"
- echo "base_version=$BASE_VERSION"
- echo "rc_number=$RC_NUMBER"
- echo "is_rc=$IS_RC"
- echo "artifact=$ARTIFACT"
- } >> "$GITHUB_OUTPUT"
+ - name: Fetch and verify the voted tarball from the ASF release area
+ if: steps.meta.outputs.is_rc == 'false'
+ run: .github/scripts/release.sh verify "${{ steps.meta.outputs.version
}}" "$RUNNER_TEMP/dist"
- - name: Build Apache Source Package
- run: |
- set -euo pipefail
- ARTIFACT="${{ steps.tag.outputs.artifact }}"
- # The tarball unpacks into a single top level directory named after
the
- # artifact, and contains sources only - no binaries, no VCS metadata.
- git archive --format=tar.gz \
- --prefix="${ARTIFACT%.tar.gz}/" \
- -o "$ARTIFACT" HEAD
- sha512sum "$ARTIFACT" > "$ARTIFACT.sha512"
-
- - name: Publish GitHub Pre-Release
- if: steps.tag.outputs.is_rc == 'true'
+ - name: Write release notes
env:
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ VERSION: ${{ steps.meta.outputs.version }}
+ BASENAME: ${{ steps.meta.outputs.basename }}
+ IS_RC: ${{ steps.meta.outputs.is_rc }}
run: |
set -euo pipefail
- ARTIFACT="${{ steps.tag.outputs.artifact }}"
- gh release create "${{ steps.tag.outputs.tag }}" \
- --title "v${{ steps.tag.outputs.base_version }}-rc${{
steps.tag.outputs.rc_number }}" \
- --prerelease \
- --notes "Release candidate ${{ steps.tag.outputs.rc_number }} for
version ${{ steps.tag.outputs.base_version }}. This is not an official release;
it is the source package for the Apache vote. Release managers should download
\`$ARTIFACT\`, sign it locally, and use it for the vote." \
- "$ARTIFACT" "$ARTIFACT.sha512"
-
- - name: Publish GitHub Release
- if: steps.tag.outputs.is_rc == 'false'
+ NOTES="$RUNNER_TEMP/notes.md"
+ if [ "$IS_RC" = true ]; then
+ cat >"$NOTES" <<EOF
+ Release candidate for sqlx-adapter $VERSION. **This is not an Apache
release**; it is the source tarball for the Apache vote.
+
+ Release manager: download \`$BASENAME.tar.gz\` and its \`.sha512\`,
sign the tarball with your key from the Casbin KEYS file, stage all three files
under \`dist/dev/incubator/casbin/\`, and start the vote. See RELEASING.md.
+ EOF
+ else
+ cat >"$NOTES" <<EOF
+ sqlx-adapter $VERSION.
+
+ The attached files are the voted source release, byte for byte as
published at
https://downloads.apache.org/incubator/casbin/sqlx-adapter-$VERSION-incubating/
(verify with https://www.apache.org/info/verification.html). The crate on
crates.io is built from these sources.
+ EOF
+ fi
+ printf '\n---\n\n' >>"$NOTES"
+ cat DISCLAIMER >>"$NOTES"
+
+ - name: Create GitHub release
env:
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_TOKEN: ${{ github.token }}
+ TAG: ${{ github.ref_name }}
+ IS_RC: ${{ steps.meta.outputs.is_rc }}
run: |
set -euo pipefail
- ARTIFACT="${{ steps.tag.outputs.artifact }}"
- gh release create "${{ steps.tag.outputs.tag }}" \
- --title "v${{ steps.tag.outputs.base_version }}" \
- --notes "Version ${{ steps.tag.outputs.base_version }}. The
official source package is \`$ARTIFACT\`." \
- "$ARTIFACT" "$ARTIFACT.sha512"
+ FLAGS=(--verify-tag --title "$TAG" --notes-file
"$RUNNER_TEMP/notes.md")
+ if [ "$IS_RC" = true ]; then
+ FLAGS+=(--prerelease --latest=false)
+ fi
+ # gh refuses to create a release that already exists, so a re-run can
+ # never silently replace published assets.
+ gh release create "$TAG" "$RUNNER_TEMP"/dist/* "${FLAGS[@]}"
+
+ publish:
+ name: Publish to crates.io
+ needs: release
+ if: needs.release.outputs.is_rc == 'false'
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@v4
+
+ # Independent of the job above: the crate must come from the voted
+ # sources, checked again right before the publish token is used.
+ - name: Verify the voted tarball matches this tag
+ run: .github/scripts/release.sh verify "${{
needs.release.outputs.version }}" "$RUNNER_TEMP/dist"
+
+ - name: Write the version into Cargo.toml
+ run: .github/scripts/release.sh set-version "${{
needs.release.outputs.version }}"
- name: Install Rust toolchain
- if: steps.tag.outputs.is_rc == 'false'
- run: |
- rustup update stable
- rustup default stable
+ run: rustup update stable --no-self-update && rustup default stable
- - name: Publish To crates.io
- if: steps.tag.outputs.is_rc == 'false'
+ - name: Publish crate
env:
- SQLX_OFFLINE: true
- run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+ CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+ # --allow-dirty: the only uncommitted change is the version written
+ # into Cargo.toml by the step above.
+ run: cargo publish --allow-dirty
diff --git a/.gitignore b/.gitignore
index 0b2fe33..12f371b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
# Generated by Cargo
# will have compiled files and executables
/target
@@ -20,4 +37,4 @@ Cargo.lock
# Ignore sqlite DB files
*.db
*.db-wal
-*.db-shm
\ No newline at end of file
+*.db-shm
diff --git a/.rat-excludes b/.rat-excludes
new file mode 100644
index 0000000..b452ce9
--- /dev/null
+++ b/.rat-excludes
@@ -0,0 +1,24 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Files Apache RAT may skip when checking license headers, one file name
+# per line (RAT matches on the base name). Keep this list to data files
+# that cannot carry a comment.
+
+# Casbin policy fixtures in examples/: plain CSV rows read by the tests.
+rbac_policy.csv
+rbac_with_domains_policy.csv
diff --git a/Cargo.toml b/Cargo.toml
index 4b3d96e..e6e1e6f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,15 +1,40 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
[package]
name = "sqlx-adapter"
-version = "1.8.0"
+# Placeholder on purpose. The release workflow derives the real version from
+# the git tag (vX.Y.Z -> X.Y.Z) and substitutes it when it builds the source
+# archive and publishes the crate, so nothing in the tree has to be bumped.
+version = "0.0.0"
authors = [
"Eason Chai <[email protected]>",
"Cheng JIANG <[email protected]>",
]
edition = "2018"
+rust-version = "1.94"
license = "Apache-2.0"
-description = "Sqlx adapter for casbin-rs"
+description = "SQLx adapter for Apache Casbin (Incubating)"
homepage = "https://casbin.apache.org";
+repository = "https://github.com/apache/casbin-sqlx-adapter";
readme = "README.md"
+# Keep SQLite databases left behind by the test suite out of the crate, also
+# when packaging from an extracted source archive where .gitignore does not
apply.
+exclude = ["*.db", "*.db-wal", "*.db-shm"]
[dependencies]
casbin = { version = "2.1.0", default-features = false }
diff --git a/README.md b/README.md
index cd12925..ccd17ca 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,26 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
# sqlx-adapter
+Apache Casbin (Incubating) is an effort undergoing incubation at the Apache
Software Foundation (ASF), sponsored by the Apache Incubator PMC. Incubation is
required of all newly accepted projects until a further review indicates that
the infrastructure, communications, and decision making process have stabilized
in a manner consistent with other successful ASF projects. While incubation
status is not necessarily a reflection of the completeness or stability of the
code, it does indicate [...]
+
[](https://crates.io/crates/sqlx-adapter)
[](https://docs.rs/sqlx-adapter)
[](https://github.com/apache/casbin-sqlx-adapter/actions/workflows/ci.yml)
@@ -24,26 +45,30 @@ ALTER TABLE casbin_rules RENAME TO casbin_rule;
## Install
+Requires Rust 1.94 or newer (the minimum supported by SQLx 0.9). The snippets
+below track the latest `1.x` release; the exact version is on the crates.io
+badge above.
+
Add the following to `Cargo.toml`:
For MySQL:
```toml
-sqlx-adapter = { version = "1.8.0", default-features = false, features =
["mysql", "runtime-tokio", "tls-native-tls"]}
+sqlx-adapter = { version = "1", default-features = false, features = ["mysql",
"runtime-tokio", "tls-native-tls"]}
tokio = { version = "1.1.1", features = ["macros"] }
```
For PostgreSQL:
```toml
-sqlx-adapter = { version = "1.8.0", default-features = false, features =
["postgres", "runtime-tokio", "tls-native-tls"]}
+sqlx-adapter = { version = "1", default-features = false, features =
["postgres", "runtime-tokio", "tls-native-tls"]}
tokio = { version = "1.1.1", features = ["macros"] }
```
For SQLite:
```toml
-sqlx-adapter = { version = "1.8.0", default-features = false, features =
["sqlite", "runtime-tokio", "tls-native-tls"]}
+sqlx-adapter = { version = "1", default-features = false, features =
["sqlite", "runtime-tokio", "tls-native-tls"]}
tokio = { version = "1.1.1", features = ["macros"] }
```
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..be0cc0e
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,94 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Releasing
+
+There is no version to bump. `Cargo.toml` always says `version = "0.0.0"`;
+the real version comes from the git tag and is written in by
+[`.github/scripts/release.sh`](.github/scripts/release.sh) when the source
+tarball is built and when the crate is published. A release is therefore just
+two tags pushed at the same commit, with the Apache vote in between.
+
+The official release is the source tarball voted on by the PPMC and the
+Incubator PMC. The GitHub release and the crates.io package are conveniences
+built from exactly those bytes.
+
+## 1. Release candidate
+
+Pick the commit to release (CI green on `master`) and push an RC tag:
+
+```bash
+git tag v1.9.0-rc1 <commit> && git push origin v1.9.0-rc1
+```
+
+The `Release` workflow creates a GitHub **pre-release** carrying
+
+- `apache-casbin-sqlx-adapter-1.9.0-incubating-src.tar.gz`
+- `apache-casbin-sqlx-adapter-1.9.0-incubating-src.tar.gz.sha512`
+
+The tarball is `git archive` of the tagged commit with the version written
+into `Cargo.toml`. Nothing is signed and nothing reaches crates.io.
+
+Download both files, check the tarball builds and tests from a clean
+extraction, then sign it with the key you have in the Casbin
+[KEYS](https://downloads.apache.org/incubator/casbin/KEYS) file:
+
+```bash
+gpg --armor --detach-sign
apache-casbin-sqlx-adapter-1.9.0-incubating-src.tar.gz
+```
+
+Stage the three files (`.tar.gz`, `.sha512`, `.asc`) under
+`https://dist.apache.org/repos/dist/dev/incubator/casbin/sqlx-adapter-1.9.0-incubating-rc1/`
+and start the vote. If anything has to change, fix it on `master`, push
+`v1.9.0-rc2` at the new commit and stage a new candidate directory; never
+overwrite staged files.
+
+## 2. Final release
+
+After the votes pass, `svn mv` the candidate directory to
+`https://dist.apache.org/repos/dist/release/incubator/casbin/sqlx-adapter-1.9.0-incubating/`
+and wait until it shows up at
+`https://downloads.apache.org/incubator/casbin/sqlx-adapter-1.9.0-incubating/`.
+
+Then push the final tag **at the same commit as the voted RC**:
+
+```bash
+git tag v1.9.0 <commit> && git push origin v1.9.0
+```
+
+The workflow does not rebuild anything. It downloads the three promoted files,
+checks the SHA-512, checks the GPG signature against the Casbin `KEYS` file,
+checks that the tarball's contents are identical to the tagged commit, and
+only then creates the GitHub release with those files and runs
+`cargo publish` (using the repository secret `CARGO_REGISTRY_TOKEN`). Any
+mismatch fails the workflow before anything is published.
+
+`gh release create` refuses to touch an existing release, so re-running the
+workflow can never replace published assets. If only the crates.io job failed,
+re-run just that job.
+
+## Checks you can run locally
+
+```bash
+.github/scripts/test-release.sh # exercises release.sh end to end, offline
+.github/scripts/release.sh archive 1.9.0 /tmp/dist # build the tarball
yourself
+```
+
+License headers are checked by the `License Headers` CI job with Apache RAT;
+files that cannot carry a header are listed in
[`.rat-excludes`](.rat-excludes).
diff --git a/examples/rbac_model.conf b/examples/rbac_model.conf
index 71159e3..80d0754 100644
--- a/examples/rbac_model.conf
+++ b/examples/rbac_model.conf
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
[request_definition]
r = sub, obj, act
@@ -11,4 +28,4 @@ g = _, _
e = some(where (p.eft == allow))
[matchers]
-m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
\ No newline at end of file
+m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
diff --git a/examples/rbac_with_domains_model.conf
b/examples/rbac_with_domains_model.conf
index 57c3721..785daf0 100644
--- a/examples/rbac_with_domains_model.conf
+++ b/examples/rbac_with_domains_model.conf
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
[request_definition]
r = sub, dom, obj, act
@@ -11,4 +28,4 @@ g = _, _, _
e = some(where (p.eft == allow))
[matchers]
-m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act ==
p.act
\ No newline at end of file
+m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act ==
p.act
diff --git a/sample.env b/sample.env
index 170ffda..18490a7 100644
--- a/sample.env
+++ b/sample.env
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
DATABASE_URL=postgres://casbin_rs:casbin_rs@localhost:5432/casbin
# DATABASE_URL=mysql://casbin_rs:casbin_rs@localhost:3306/casbin
POOL_SIZE=8
diff --git a/scripts/login-db.sh b/scripts/login-db.sh
index d46bf1b..58d46af 100755
--- a/scripts/login-db.sh
+++ b/scripts/login-db.sh
@@ -1,5 +1,22 @@
#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
if [[ ! $# > 0 ]]; then
echo "help: ./login-db.sh --mysql|--postgres" && exit 1;
elif [ "$1" == "--postgres" ]; then
diff --git a/scripts/setup-db.sh b/scripts/setup-db.sh
index 795b7eb..f8d38f0 100755
--- a/scripts/setup-db.sh
+++ b/scripts/setup-db.sh
@@ -1,5 +1,22 @@
#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
DIS=$(lsb_release -is)
command -v docker > /dev/null 2>&1 || {
diff --git a/src/actions.rs b/src/actions.rs
index d5aa58e..394d941 100644
--- a/src/actions.rs
+++ b/src/actions.rs
@@ -1,3 +1,20 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
#![allow(clippy::suspicious_else_formatting)]
#![allow(clippy::toplevel_ref_arg)]
use crate::Error;
diff --git a/src/adapter.rs b/src/adapter.rs
index 299b169..24b9aac 100644
--- a/src/adapter.rs
+++ b/src/adapter.rs
@@ -1,3 +1,20 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
use async_trait::async_trait;
use casbin::{error::AdapterError, Adapter, Error as CasbinError, Filter,
Model, Result};
use std::sync::{
diff --git a/src/error.rs b/src/error.rs
index 4961801..6076d1d 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -1,3 +1,20 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
use sqlx::error::Error as SqlxError;
use std::{error::Error as StdError, fmt};
diff --git a/src/lib.rs b/src/lib.rs
index d361c98..6c2da2e 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,3 +1,20 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
extern crate sqlx;
mod adapter;
diff --git a/src/models.rs b/src/models.rs
index 722406c..174e85b 100644
--- a/src/models.rs
+++ b/src/models.rs
@@ -1,3 +1,20 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
use sqlx::FromRow;
#[allow(dead_code)]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
