498 lines
21 KiB
YAML
498 lines
21 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
types: [closed]
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_branch:
|
|
description: Frozen release branch (release/VERSION)
|
|
required: true
|
|
type: string
|
|
phase:
|
|
description: Prepare the release PR, or publish its reviewed merge
|
|
required: true
|
|
default: prepare
|
|
type: choice
|
|
options: [prepare, publish]
|
|
|
|
env:
|
|
HUSKY: "0"
|
|
# Remote cache stays local when either value is empty.
|
|
# Writes only on the default branch for push, schedule, manual dispatch,
|
|
# and workflow_call. Pull requests get an empty token and remote read-only mode.
|
|
TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
|
|
TURBO_TEAM: ${{ vars.TURBO_TEAM }}
|
|
TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"
|
|
|
|
concurrency:
|
|
group: release-${{ inputs.release_branch || github.event.pull_request.merge_commit_sha || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release-proposal:
|
|
name: Update release proposal
|
|
if: github.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Respect finalized release notes
|
|
id: editorial
|
|
env:
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
run: |
|
|
# Filter at the repository connection, without a search-index dependency.
|
|
pages=$(gh api graphql --paginate --slurp \
|
|
-f owner="${GH_REPO%/*}" -f name="${GH_REPO#*/}" \
|
|
-f query='query($owner:String!,$name:String!,$endCursor:String) {
|
|
repository(owner:$owner,name:$name) {
|
|
nameWithOwner
|
|
pullRequests(first:100,after:$endCursor,states:OPEN,baseRefName:"main",labels:["rea:release-notes-finalized"]) {
|
|
nodes { number headRefName headRepository { nameWithOwner } }
|
|
pageInfo { hasNextPage endCursor }
|
|
}
|
|
}
|
|
}')
|
|
finalized=$(jq -er '
|
|
if type != "array" or length == 0 then error("Missing GitHub pages") else . end |
|
|
if .[-1].data.repository.pullRequests.pageInfo.hasNextPage != false
|
|
then error("Incomplete GitHub pagination") else . end |
|
|
map(
|
|
if (.errors // [] | length) != 0 then error("GitHub query failed") else . end |
|
|
.data.repository |
|
|
if (.nameWithOwner | type) != "string" or (.pullRequests.nodes | type) != "array" or
|
|
(.pullRequests.pageInfo.hasNextPage | type) != "boolean"
|
|
then error("Invalid GitHub repository connection") else . end |
|
|
.nameWithOwner as $repo | .pullRequests.nodes[] |
|
|
if (.number | type) != "number" or (.headRefName | type) != "string" or (has("headRepository") | not) or
|
|
(.headRepository != null and (.headRepository.nameWithOwner | type) != "string")
|
|
then error("Invalid GitHub pull request") else . end |
|
|
select(.headRepository.nameWithOwner == $repo) |
|
|
select(.headRefName | startswith("release-please--branches--main--")) | .number
|
|
) | map(tostring) | join(" ")' <<< "$pages")
|
|
if [[ -n "${finalized}" ]]; then
|
|
echo "Finalized release notes on PR ${finalized}; automatic proposal refresh is paused." >> "$GITHUB_STEP_SUMMARY"
|
|
echo "frozen=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Check out proposal controller and complete Git history
|
|
if: steps.editorial.outputs.frozen != 'true'
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
if: steps.editorial.outputs.frozen != 'true'
|
|
with:
|
|
node-version-file: .nvmrc
|
|
package-manager-cache: false
|
|
|
|
- name: Install proposal controller dependencies
|
|
if: steps.editorial.outputs.frozen != 'true'
|
|
run: npm ci
|
|
|
|
- name: Update release proposal
|
|
if: steps.editorial.outputs.frozen != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: node scripts/release-proposal.mjs --target-branch main --source-sha "$SOURCE_SHA"
|
|
|
|
merged-release:
|
|
name: Release reviewed main merge
|
|
if: >-
|
|
github.event_name == 'pull_request' && github.event.pull_request.merged == true &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
startsWith(github.event.pull_request.head.ref, 'release-please--branches--main--')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
release_created: ${{ steps.release.outputs.release_created }}
|
|
sha: ${{ steps.release.outputs.sha }}
|
|
steps:
|
|
- name: Check out reviewed release merge
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.merge_commit_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
node-version-file: .nvmrc
|
|
package-manager-cache: false
|
|
|
|
- run: npm ci
|
|
|
|
- name: Validate reviewed merge before release creation
|
|
env:
|
|
SOURCE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
|
|
run: |
|
|
if [[ "${SOURCE_SHA}" != "${GITHUB_SHA}" ]]; then
|
|
echo "The reviewed merge differs from the workflow source; refusing mismatched publication provenance." >&2
|
|
exit 1
|
|
fi
|
|
node scripts/verify-release-checkpoint.mjs \
|
|
--phase publish --release-branch main --source-sha "$SOURCE_SHA"
|
|
|
|
- name: Validate finalized notes before release creation
|
|
env:
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
RELEASE_PR: ${{ github.event.pull_request.number }}
|
|
SOURCE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
|
|
run: |
|
|
node scripts/release-notes.mjs publication --repository "$GH_REPO" \
|
|
--source "$SOURCE_SHA" --pr "$RELEASE_PR"
|
|
|
|
- uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
|
|
id: release
|
|
with:
|
|
token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
target-branch: main
|
|
skip-github-release: false
|
|
skip-github-pull-request: true
|
|
|
|
- name: Bind publication to the reviewed merge
|
|
env:
|
|
RELEASE_CREATED: ${{ steps.release.outputs.release_created }}
|
|
RELEASE_SHA: ${{ steps.release.outputs.sha }}
|
|
SOURCE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
|
|
run: |
|
|
if [[ "${RELEASE_CREATED}" != true ]]; then
|
|
echo "Release Please did not create a release for the reviewed merge. Check its pending label and release metadata; for a partial publication, re-run failed jobs in the original run." >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_SHA}" != "${SOURCE_SHA}" ]]; then
|
|
echo "The tagged release differs from the reviewed merge; refusing mismatched publication provenance. The GitHub release already exists; do not create another release as a retry." >&2
|
|
exit 1
|
|
fi
|
|
|
|
release-please:
|
|
name: Release Please
|
|
if: github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
release_created: ${{ steps.release.outputs.release_created }}
|
|
sha: ${{ steps.release.outputs.sha }}
|
|
steps:
|
|
- name: Validate release selection
|
|
shell: bash
|
|
env:
|
|
RELEASE_BRANCH: ${{ inputs.release_branch }}
|
|
RELEASE_PHASE: ${{ inputs.phase }}
|
|
run: |
|
|
if [[ "${RELEASE_PHASE}" != prepare && "${RELEASE_PHASE}" != publish ]]; then
|
|
echo "phase must be prepare or publish." >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_PHASE}" == prepare && "${GITHUB_REF}" != "refs/heads/main" ]]; then
|
|
echo "Run prepare from main; release_branch selects the frozen source." >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_PHASE}" == publish && "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" ]]; then
|
|
echo "Run publish from the selected frozen release branch so npm provenance records its source." >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! "${RELEASE_BRANCH}" =~ ^release/[^/]+$ ]]; then
|
|
echo "release_branch must select a release/ branch; main is not a release checkpoint." >&2
|
|
exit 1
|
|
fi
|
|
if ! git check-ref-format "refs/heads/${RELEASE_BRANCH}"; then
|
|
echo "Invalid release_branch: ${RELEASE_BRANCH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Resolve release branch tip
|
|
id: branch
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
RELEASE_BRANCH: ${{ inputs.release_branch }}
|
|
run: |
|
|
sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" --jq '.object | select(.type == "commit") | .sha')"
|
|
if [[ ! "${sha}" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "The release branch tip is not a commit." >&2
|
|
exit 1
|
|
fi
|
|
echo "sha=${sha}" >> "${GITHUB_OUTPUT}"
|
|
|
|
- name: Require the publish dispatch to match the branch tip
|
|
if: inputs.phase == 'publish'
|
|
shell: bash
|
|
env:
|
|
BRANCH_SHA: ${{ steps.branch.outputs.sha }}
|
|
run: |
|
|
if [[ "${BRANCH_SHA}" != "${GITHUB_SHA}" ]]; then
|
|
echo "The release branch tip differs from the dispatched checkpoint; refusing to create a release for a moved source." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Check out release controller and Git history
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js for checkpoint validation
|
|
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
node-version-file: .nvmrc
|
|
package-manager-cache: false
|
|
|
|
- name: Install checkpoint validation dependencies
|
|
run: npm ci
|
|
|
|
- name: Validate checkpoint version and ancestry before release creation
|
|
env:
|
|
RELEASE_PHASE: ${{ inputs.phase }}
|
|
RELEASE_BRANCH: ${{ inputs.release_branch }}
|
|
SOURCE_SHA: ${{ steps.branch.outputs.sha }}
|
|
run: >-
|
|
node scripts/verify-release-checkpoint.mjs
|
|
--phase "$RELEASE_PHASE" --release-branch "$RELEASE_BRANCH"
|
|
--source-sha "$SOURCE_SHA"
|
|
|
|
- name: Validate manual finalized notes before release creation
|
|
if: inputs.phase == 'publish'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
SOURCE_SHA: ${{ steps.branch.outputs.sha }}
|
|
run: |
|
|
node scripts/release-notes.mjs publication --repository "$GH_REPO" \
|
|
--source "$SOURCE_SHA"
|
|
|
|
- name: Prepare checkpoint release proposal
|
|
if: inputs.phase == 'prepare'
|
|
id: proposal
|
|
env:
|
|
# A dedicated credential starts PR CI automatically; the built-in
|
|
# token creates approval-required PR runs for maintainers to approve.
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
|
|
RELEASE_BRANCH: ${{ inputs.release_branch }}
|
|
SOURCE_SHA: ${{ steps.branch.outputs.sha }}
|
|
run: node scripts/release-proposal.mjs --target-branch "$RELEASE_BRANCH" --source-sha "$SOURCE_SHA"
|
|
|
|
- uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
|
|
if: inputs.phase == 'publish'
|
|
id |