-
Notifications
You must be signed in to change notification settings - Fork 1
423 lines (379 loc) · 17.9 KB
/
reusable-release.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
name: Scala Library Release Workflow
on:
workflow_call:
inputs:
GITHUB_APP_ID:
description:
"App ID for a GitHub App that is allowed to push directly to the default branch. Eg, App ID on:
https://github.com/organizations/guardian/settings/apps/gu-scala-library-release"
default: '807361' # Only for use by the Guardian!
required: true
type: string
SONATYPE_PROFILE_NAME:
description: 'Sonatype account profile name, eg "com.gu", "org.xerial", etc (not your Sonatype username)'
default: 'com.gu' # Only for use by the Guardian!
required: false # Must be supplied if used by a non-Guardian project
type: string
SONATYPE_CREDENTIAL_HOST:
description: 'The host of your SONATYPE_PROFILE_NAME, either "oss.sonatype.org" or "s01.oss.sonatype.org"'
default: 'oss.sonatype.org' # The default host is going to be whatever "com.gu" is using
required: false # ...but if you're not the Guardian, you'll want to set this explicitly
type: string
SONATYPE_USERNAME:
description: 'Sonatype username'
default: 'guardian.automated.maven.release' # Only for use by the Guardian!
required: false # Must be supplied if used by a non-Guardian project
type: string
secrets:
SONATYPE_PASSWORD:
description: 'Password for the SONATYPE_USERNAME account - used to authenticate when uploading artifacts'
required: true
PGP_PRIVATE_KEY:
description:
"A passphrase-less PGP private key used to sign artifacts, commits, & tags.
Should be in normal plaintext 'BEGIN PGP PUBLIC KEY BLOCK' (ASCII-armored) format, with no additional BASE64-encoding.
The passphrase can be removed from an existing key using 'gpg --edit-key <key-id> passwd' : https://unix.stackexchange.com/a/550538/46453"
required: true
GITHUB_APP_PRIVATE_KEY:
description:
"See https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps#generating-private-keys
Should be in normal plaintext '-----BEGIN RSA PRIVATE KEY-----' format"
required: true
outputs:
RELEASE_VERSION:
description: "The un-prefixed version number of the release, eg '3.0.1'"
value: ${{ jobs.push-release-commit.outputs.release_version }}
RELEASE_TYPE:
description: "Either 'FULL_MAIN_BRANCH' or 'PREVIEW_FEATURE_BRANCH' - whether this is a full release or a pre-release"
value: ${{ jobs.init.outputs.release_type }}
env:
LOCAL_ARTIFACTS_STAGING_PATH: /tmp/artifact_staging
COMMITTER_NAME: "@${{github.actor}} using gha-scala-library-release-workflow"
RUN_ATTEMPT_UID: ${{ github.run_id }}-${{ github.run_attempt }}
jobs:
init:
name: 🔒 Init
runs-on: ubuntu-latest
outputs:
key_fingerprint: ${{ steps.read-identifiers.outputs.key_fingerprint }}
key_email: ${{ steps.read-identifiers.outputs.key_email }}
release_type: ${{ steps.generate-version-suffix.outputs.release_type }}
version_suffix: ${{ steps.generate-version-suffix.outputs.version_suffix }}
steps:
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Read Identifiers from Signing Key
id: read-identifiers
run: |
key_fingerprint_and_email=$(gpg2 --list-secret-keys --list-options show-only-fpr-mbox)
key_fingerprint=$(echo $key_fingerprint_and_email | awk '{print $1}')
key_email=$(echo $key_fingerprint_and_email | awk '{print $2}')
echo "key_fingerprint=$key_fingerprint"
cat << EndOfFile >> $GITHUB_OUTPUT
key_fingerprint=$key_fingerprint
key_email=$key_email
EndOfFile
if ! [[ "$key_fingerprint" =~ ^[[:xdigit:]]{8,}$ ]]; then
echo "::error title=Missing PGP key::Has PGP_PRIVATE_KEY been set correctly? https://github.com/guardian/gha-scala-library-release-workflow/blob/main/docs/credentials/supplying-credentials.md"
exit 1
fi
- name: Check for default branch
id: generate-version-suffix
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
default_branch=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name ${{ github.repository }})
if [[ "$default_branch" = $GITHUB_REF_NAME ]]; then
release_type="FULL_MAIN_BRANCH"
version_suffix=""
else
release_type="PREVIEW_FEATURE_BRANCH"
version_suffix="-PREVIEW.${GITHUB_REF_NAME//[^[:alnum:]-_]/}.$(date +%Y-%m-%dT%H%M).${GITHUB_SHA:0:8}"
fi
echo "current branch: $GITHUB_REF_NAME, release_type: $release_type, version_suffix: $version_suffix"
cat << EndOfFile >> $GITHUB_OUTPUT
release_type=$release_type
version_suffix=$version_suffix
EndOfFile
generate-version-update-commits:
name: 🎊 Test & Version
needs: init
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is merged
with:
distribution: corretto
java-version: 17
# - name: Debug MIMA assessment
# run: |
# sbt "show versionPolicyFindIssues"
- name: Use sbt-release to construct version.sbt updates
run: |
git config user.email "${{ needs.init.outputs.key_email }}"
git config user.name "$COMMITTER_NAME"
sbt_commands_file=$(mktemp)
cat << EndOfFile > $sbt_commands_file
set releaseVersion := releaseVersion.value.andThen(_ + "${{ needs.init.outputs.version_suffix }}")
release with-defaults
EndOfFile
cat $sbt_commands_file
sbt ";< $sbt_commands_file"
echo $GITHUB_WORKSPACE
cd `mktemp -d`
git clone --bare $GITHUB_WORKSPACE repo-with-unsigned-version-update-commits.git
rm -Rf $GITHUB_WORKSPACE/*
mv repo-with-unsigned-version-update-commits.git $GITHUB_WORKSPACE/
ls -lR $GITHUB_WORKSPACE
- name: Job summary
run: |
echo "# Release $(git describe --tags --abbrev=0)" >> $GITHUB_STEP_SUMMARY
- uses: actions/cache/save@v4
with:
path: repo-with-unsigned-version-update-commits.git
key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}
push-release-commit:
name: 🔒 Push Release Commit
needs: [generate-version-update-commits, init]
permissions:
contents: write
runs-on: ubuntu-latest
outputs:
release_tag: ${{ steps.create-commit.outputs.release_tag }}
release_version: ${{ steps.create-commit.outputs.release_version }}
release_commit_id: ${{ steps.create-commit.outputs.release_commit_id }}
steps:
- id: generate-github-app-token
uses: actions/create-github-app-token@v1
with: { app-id: ${{ inputs.GITHUB_APP_ID }} , private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
- uses: actions/checkout@v4
with:
path: repo
token: ${{ steps.generate-github-app-token.outputs.token }}
persist-credentials: true # Allow us to push as the GitHub App, and bypass branch ruleset
- uses: actions/cache/restore@v4
with:
path: repo-with-unsigned-version-update-commits.git
key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Create commit
id: create-commit
env:
KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
KEY_EMAIL: ${{ needs.init.outputs.key_email }}
run: |
echo "GITHUB_REF_NAME=$GITHUB_REF_NAME"
echo "GITHUB_REF=$GITHUB_REF"
cd repo-with-unsigned-version-update-commits.git
RELEASE_TAG=$(git describe --tags --abbrev=0)
cd ../repo
git status
git config user.email "$KEY_EMAIL"
git config user.name "$COMMITTER_NAME"
git config commit.gpgsign true
git config user.signingkey "$KEY_FINGERPRINT"
git remote add unsigned ../repo-with-unsigned-version-update-commits.git
git fetch unsigned
git cherry-pick -S$KEY_FINGERPRINT $GITHUB_REF_NAME..unsigned/$GITHUB_REF_NAME
git status
release_commit_id=$(git rev-parse HEAD^)
cat << EndOfFile >> $GITHUB_OUTPUT
release_tag=$RELEASE_TAG
release_version=${RELEASE_TAG#"v"}
release_commit_id=$release_commit_id
EndOfFile
git log --format="%h %p %ce %s" --decorate=short -n3
git status
if [ "${{ needs.init.outputs.release_type }}" == "FULL_MAIN_BRANCH" ]
then
echo "Full Main-Branch release, pushing 2 commits to the default branch"
git push # push 2 commits (non-snapshot release version, then new snapshot version) onto the default branch
else
tag_for_pushing="preliminary-${{ github.run_id }}"
echo "Preview Feature-Branch release, pushing 1 commit with the temporary tag $tag_for_pushing"
git tag -a -m "Tag created merely to allow _pushing_ the release commit, which gains the signed $RELEASE_TAG tag later on in the workflow" $tag_for_pushing $release_commit_id
git push origin $tag_for_pushing # push only the single release version commit with a disposable tag
fi
create-artifacts:
name: 🎊 Create artifacts
needs: [init, push-release-commit]
runs-on: ubuntu-latest
outputs:
ARTIFACT_SHA256SUMS: ${{ steps.record-hashes.outputs.ARTIFACT_SHA256SUMS }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
- uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is resolved
with:
distribution: corretto
java-version: 17
- name: Generate artifacts
run: |
cat << EndOfFile > sbt-commands.txt
set every sonatypeProjectHosting := Some(xerial.sbt.Sonatype.GitHubHosting("$GITHUB_REPOSITORY_OWNER", "${GITHUB_REPOSITORY#*/}", "${{ needs.init.outputs.key_email }}"))
set ThisBuild / publishTo := Some(Resolver.file("foobar", file("$LOCAL_ARTIFACTS_STAGING_PATH")))
EndOfFile
cat sbt-commands.txt
sbt ";< sbt-commands.txt; +publish"
- name: Record SHA-256 hashes of artifacts
id: record-hashes
run: |
sudo apt-get install hashdeep -q > /dev/null
cd $LOCAL_ARTIFACTS_STAGING_PATH
{
echo 'ARTIFACT_SHA256SUMS<<EOF'
sha256deep -r -l .
echo EOF
} >> "$GITHUB_OUTPUT"
- uses: actions/cache/save@v4
id: cache
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: unsigned-${{ env.RUN_ATTEMPT_UID }}
sign:
name: 🔒 Sign
needs: [init, push-release-commit, create-artifacts]
runs-on: ubuntu-latest
env:
KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
steps:
- uses: actions/checkout@v4
with:
path: repo
ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
- uses: actions/cache/restore@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: unsigned-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Sign artifacts
run: |
echo "KEY_FINGERPRINT=$KEY_FINGERPRINT"
find $LOCAL_ARTIFACTS_STAGING_PATH -type f -exec gpg -a --local-user "$KEY_FINGERPRINT" --detach-sign {} \;
- name: Push signed tag
env:
RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
RELEASE_COMMIT_ID: ${{ needs.push-release-commit.outputs.release_commit_id }}
ARTIFACT_SHA256SUMS: ${{ needs.create-artifacts.outputs.ARTIFACT_SHA256SUMS }}
KEY_EMAIL: ${{ needs.init.outputs.key_email }}
run: |
echo "RELEASE_TAG=$RELEASE_TAG"
echo "RELEASE_COMMIT_ID=$RELEASE_COMMIT_ID"
cd repo
git config user.email "$KEY_EMAIL"
git config user.name "$COMMITTER_NAME"
git config tag.gpgSign true
git config user.signingkey "$KEY_FINGERPRINT"
cat << EndOfFile > tag-message.txt
Release $RELEASE_TAG initiated by $COMMITTER_NAME
$ARTIFACT_SHA256SUMS
EndOfFile
echo "Message is..."
cat tag-message.txt
echo "Creating release tag (including artifact hashes)"
git tag -a -F tag-message.txt $RELEASE_TAG $RELEASE_COMMIT_ID
echo "RELEASE_TAG=$RELEASE_TAG"
echo "Pushing tag $RELEASE_TAG"
git push origin $RELEASE_TAG
- uses: actions/cache/save@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: signed-${{ env.RUN_ATTEMPT_UID }}
sonatype-release:
name: 🔒 Sonatype Release
needs: sign
runs-on: ubuntu-latest
steps:
- uses: actions/cache/restore@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: signed-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- name: Create tiny sbt project to perform Sonatype upload
run: |
cat << EndOfFile > build.sbt
sonatypeBundleDirectory := new File("$LOCAL_ARTIFACTS_STAGING_PATH")
sonatypeProfileName := "${{ inputs.SONATYPE_PROFILE_NAME }}"
sonatypeCredentialHost := "${{ inputs.SONATYPE_CREDENTIAL_HOST }}"
EndOfFile
mkdir project
echo 'addSbtPlugin("org.xerial.sbt" % "sbt-sonatype" % "3.9.21")' > project/plugins.sbt
echo 'sbt.version = 1.9.8' > project/build.properties
ls -lR .
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
cache: sbt # the issue described in https://github.com/actions/setup-java/pull/564 doesn't affect this step (no version.sbt)
- name: Release
env:
SONATYPE_USERNAME: ${{ inputs.SONATYPE_USERNAME }}
SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
run: |
sbt "sonatypeBundleRelease"
github-release:
name: 🔒 Update GitHub
needs: [init, push-release-commit, sign]
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
env:
RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
RELEASE_VERSION: ${{ needs.push-release-commit.outputs.release_version }}
GH_REPO: ${{ github.repository }}
GITHUB_REPO_URL: ${{ github.server_url }}/${{ github.repository }}
steps:
- id: generate-github-app-token
uses: actions/create-github-app-token@v1
with: { app-id: ${ { inputs.GITHUB_APP_ID } }, private-key: ${ { secrets.GITHUB_APP_PRIVATE_KEY } } }
- name: Common values
run: |
GITHUB_ACTIONS_PATH="$GITHUB_REPO_URL/actions"
GITHUB_WORKFLOW_FILE="release.yml" # Could be derived from $GITHUB_WORKFLOW_REF
GITHUB_WORKFLOW_URL="$GITHUB_ACTIONS_PATH/workflows/$GITHUB_WORKFLOW_FILE"
cat << EndOfFile >> $GITHUB_ENV
GITHUB_WORKFLOW_FILE=$GITHUB_WORKFLOW_FILE
GITHUB_WORKFLOW_LINK=[GitHub UI]($GITHUB_WORKFLOW_URL)
GITHUB_WORKFLOW_RUN_LINK=[#${{ github.run_number }}]($GITHUB_ACTIONS_PATH/runs/${{ github.run_id }})
EndOfFile
- name: Create Github Release
if: needs.init.outputs.release_type == 'FULL_MAIN_BRANCH'
env: { GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }} }
run: |
gh release create $RELEASE_TAG --verify-tag --generate-notes --notes "Release run: $GITHUB_WORKFLOW_RUN_LINK"
echo "GitHub Release notes: [$RELEASE_TAG]($GITHUB_REPO_URL/releases/tag/$RELEASE_TAG)" >> $GITHUB_STEP_SUMMARY
- name: Update PR with comment
if: needs.init.outputs.release_type == 'PREVIEW_FEATURE_BRANCH'
env: { GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }} }
run: |
cat << EndOfFile > comment_body.txt
@${{github.actor}} has published a preview version of this PR with release workflow run $GITHUB_WORKFLOW_RUN_LINK, based on commit ${{ github.sha }}:
$RELEASE_VERSION
<details>
<summary>Want to make another preview release?</summary>
Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, specifying the $GITHUB_REF_NAME branch, or use the [GitHub CLI](https://cli.github.com/) command:
gh workflow run $GITHUB_WORKFLOW_FILE --ref $GITHUB_REF_NAME
</details>
<details>
<summary>Want to make a full release after this PR is merged?</summary>
Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, leaving the branch as the default, or use the [GitHub CLI](https://cli.github.com/) command:
gh workflow run $GITHUB_WORKFLOW_FILE
</details>
EndOfFile
cat comment_body.txt
gh pr comment ${{ github.ref_name }} --body-file comment_body.txt >> $GITHUB_STEP_SUMMARY