mirror of
https://github.com/pocket-id/pocket-id.git
synced 2026-09-21 18:39:05 +02:00
ci/cd: replace local release script with action
This commit is contained in:
Elias Schneider
+182
-11
@@ -1,27 +1,180 @@
|
||||
name: Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*.*.*"
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
bump:
|
||||
description: Version bump (auto uses conventional commits)
|
||||
type: choice
|
||||
default: auto
|
||||
options:
|
||||
- auto
|
||||
- major
|
||||
- minor
|
||||
- patch
|
||||
|
||||
concurrency:
|
||||
group: release
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
artifact-metadata: write
|
||||
contents: read
|
||||
|
||||
defaults:
|
||||
run:
|
||||
shell: bash
|
||||
|
||||
jobs:
|
||||
release:
|
||||
prepare:
|
||||
name: Prepare release
|
||||
runs-on: depot-ubuntu-latest
|
||||
outputs:
|
||||
tag: ${{ steps.version.outputs.tag }}
|
||||
commit: ${{ steps.commit.outputs.commit }}
|
||||
|
||||
steps:
|
||||
- name: Require the main branch
|
||||
run: |
|
||||
if [[ "$GITHUB_REF" != refs/heads/main ]]; then
|
||||
echo "::error::Releases must be triggered from main."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Checkout release source
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup git-cliff
|
||||
uses: taiki-e/install-action@v2
|
||||
with:
|
||||
tool: git-cliff@2.14.2
|
||||
|
||||
- name: Calculate next version
|
||||
id: version
|
||||
env:
|
||||
BUMP: ${{ inputs.bump }}
|
||||
run: |
|
||||
version=$(git cliff --bumped-version --unreleased --offline --bump "$BUMP")
|
||||
version=${version#v}
|
||||
if [[ "$version" == "$(cat .version)" ]]; then
|
||||
echo "No commits requiring a version bump; no release created." >> "$GITHUB_STEP_SUMMARY"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "version=$version" >> "$GITHUB_OUTPUT"
|
||||
echo "tag=v$version" >> "$GITHUB_OUTPUT"
|
||||
echo "Preparing release v$version from $GITHUB_SHA." >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Setup pnpm
|
||||
if: steps.version.outputs.tag != ''
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
run_install: false
|
||||
|
||||
- name: Setup Node.js
|
||||
if: steps.version.outputs.tag != ''
|
||||
uses: actions/setup-node@v6.5.0
|
||||
with:
|
||||
node-version: 24
|
||||
cache: pnpm
|
||||
|
||||
- name: Install dependencies
|
||||
if: steps.version.outputs.tag != ''
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Update version and changelog
|
||||
if: steps.version.outputs.tag != ''
|
||||
env:
|
||||
VERSION: ${{ steps.version.outputs.version }}
|
||||
RELEASE_TAG: ${{ steps.version.outputs.tag }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
printf '%s\n' "$VERSION" > .version
|
||||
jq --arg version "$VERSION" '.version = $version' frontend/package.json > "$RUNNER_TEMP/package.json"
|
||||
mv "$RUNNER_TEMP/package.json" frontend/package.json
|
||||
pnpm --dir frontend exec prettier --write package.json
|
||||
git cliff --prepend CHANGELOG.md --tag "$RELEASE_TAG" --unreleased
|
||||
|
||||
- name: Create bot app token
|
||||
if: steps.version.outputs.tag != ''
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
permission-contents: write
|
||||
|
||||
- name: Commit and tag release
|
||||
if: steps.version.outputs.tag != ''
|
||||
id: commit
|
||||
env:
|
||||
VERSION: ${{ steps.version.outputs.version }}
|
||||
RELEASE_TAG: ${{ steps.version.outputs.tag }}
|
||||
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
||||
APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
|
||||
run: |
|
||||
# Attribute the release commit to the app and authenticate the push with its installation token
|
||||
bot_name="$APP_SLUG[bot]"
|
||||
bot_id=$(gh api "users/$bot_name" --jq .id)
|
||||
git config user.name "$bot_name"
|
||||
git config user.email "$bot_id+$bot_name@users.noreply.github.com"
|
||||
gh auth setup-git
|
||||
|
||||
git add .version frontend/package.json CHANGELOG.md
|
||||
git commit -m "release: $VERSION"
|
||||
git tag "$RELEASE_TAG"
|
||||
|
||||
# Publish both refs together so a concurrent main update cannot leave an orphaned release tag
|
||||
git push --atomic origin HEAD:refs/heads/main "refs/tags/$RELEASE_TAG"
|
||||
echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
build:
|
||||
name: Build and attest
|
||||
needs: prepare
|
||||
if: needs.prepare.outputs.tag != ''
|
||||
runs-on: depot-ubuntu-24.04-16
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
artifact-metadata: write
|
||||
env:
|
||||
RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ needs.prepare.outputs.commit }}
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Create bot app token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
permission-contents: write
|
||||
|
||||
- name: Create draft release
|
||||
env:
|
||||
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
||||
run: |
|
||||
# Reuse the draft when retrying a failed build
|
||||
if is_draft=$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft); then
|
||||
if [[ "$is_draft" != true ]]; then
|
||||
echo "::error::Release $RELEASE_TAG is already published."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
awk '/^## v[0-9]/ { if (found) exit; found=1; next } found' CHANGELOG.md > "$RUNNER_TEMP/release-notes.md"
|
||||
gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md" --draft
|
||||
fi
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
@@ -90,7 +243,25 @@ jobs:
|
||||
with:
|
||||
subject-checksums: ./dist/digests.txt
|
||||
|
||||
publish:
|
||||
name: Publish release
|
||||
needs: [prepare, build]
|
||||
runs-on: depot-ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Create bot app token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
permission-contents: write
|
||||
|
||||
- name: Publish release
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: gh release edit ${{ github.ref_name }} --draft=false
|
||||
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
||||
GH_REPO: ${{ github.repository }}
|
||||
RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
|
||||
run: |
|
||||
gh release edit "$RELEASE_TAG" --draft=false
|
||||
echo "Published [$RELEASE_TAG](https://github.com/$GH_REPO/releases/tag/$RELEASE_TAG)." >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
@@ -1,121 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Check if the script is being run from the root of the project
|
||||
if [ ! -f .version ] || [ ! -f frontend/package.json ] || [ ! -f CHANGELOG.md ]; then
|
||||
echo "Error: This script must be run from the root of the project."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if git cliff is installed
|
||||
if ! command -v git-cliff &>/dev/null; then
|
||||
echo "Error: git cliff is not installed. Please install it from https://git-cliff.org/docs/installation."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if GitHub CLI is installed
|
||||
if ! command -v gh &>/dev/null; then
|
||||
echo "Error: GitHub CLI (gh) is not installed. Please install it and authenticate using 'gh auth login'."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if Snyk CLI is installed
|
||||
if ! command -v snyk &>/dev/null; then
|
||||
echo "Error: Snyk CLI is not installed. Please install it and authenticate using 'snyk auth'."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if we're on the main branch
|
||||
if [ "$(git rev-parse --abbrev-ref HEAD)" != "main" ]; then
|
||||
echo "Error: This script must be run on the main branch."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse command line arguments
|
||||
FORCE_MAJOR=false
|
||||
for arg in "$@"; do
|
||||
case $arg in
|
||||
--major)
|
||||
FORCE_MAJOR=true
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
# Unknown option
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
BUMP_ARGUMENTS=(--bumped-version --unreleased --offline)
|
||||
if [ "$FORCE_MAJOR" == true ]; then
|
||||
BUMP_ARGUMENTS+=(--bump major)
|
||||
fi
|
||||
|
||||
# Calculate the next version from the unreleased conventional commits
|
||||
if ! NEW_VERSION=$(git cliff "${BUMP_ARGUMENTS[@]}"); then
|
||||
echo "Error: Could not calculate the next version."
|
||||
exit 1
|
||||
fi
|
||||
NEW_VERSION=${NEW_VERSION#v}
|
||||
|
||||
if [ "$NEW_VERSION" == "$(cat .version)" ]; then
|
||||
echo "No commits requiring a version bump found since the latest release. No new release will be created."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Running Snyk dependency scan..."
|
||||
if ! snyk test --all-projects --dev --detection-depth=3 --strict-out-of-sync=false --severity-threshold=high; then
|
||||
echo "Error: Snyk detected high-severity vulnerable dependencies. Release creation aborted."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Confirm release creation
|
||||
read -p "This will create a new release with version $NEW_VERSION. Do you want to proceed? (y/n) " CONFIRM
|
||||
if [[ "$CONFIRM" != "y" ]]; then
|
||||
echo "Release process canceled."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Update the .version file with the new version
|
||||
echo $NEW_VERSION >.version
|
||||
git add .version
|
||||
|
||||
# Update version in frontend/package.json
|
||||
jq --arg new_version "$NEW_VERSION" '.version = $new_version' frontend/package.json >frontend/package_tmp.json && mv frontend/package_tmp.json frontend/package.json
|
||||
pnpm --dir frontend exec prettier --write package.json
|
||||
git add frontend/package.json
|
||||
|
||||
# Generate changelog
|
||||
echo "Generating changelog..."
|
||||
git cliff --github-token=$(gh auth token) --prepend CHANGELOG.md --tag "v$NEW_VERSION" --unreleased
|
||||
git add CHANGELOG.md
|
||||
|
||||
# Commit the changes with the new version
|
||||
git commit -m "release: $NEW_VERSION"
|
||||
|
||||
# Create a Git tag with the new version
|
||||
git tag "v$NEW_VERSION"
|
||||
|
||||
# Push the commit and the tag to the repository
|
||||
git push
|
||||
git push --tags
|
||||
|
||||
# Extract the changelog content for the latest release
|
||||
echo "Extracting changelog content for version $NEW_VERSION..."
|
||||
CHANGELOG=$(awk '/^## v[0-9]/ { if (found) exit; found=1; next } found' CHANGELOG.md)
|
||||
|
||||
if [ -z "$CHANGELOG" ]; then
|
||||
echo "Error: Could not extract changelog for version $NEW_VERSION."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Create the release on GitHub
|
||||
echo "Creating GitHub release..."
|
||||
gh release create "v$NEW_VERSION" --title "v$NEW_VERSION" --notes "$CHANGELOG" --draft
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "GitHub release created successfully."
|
||||
else
|
||||
echo "Error: Failed to create GitHub release."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Release process complete. New version: $NEW_VERSION"
|
||||
Reference in New Issue
Block a user