-
-
Notifications
You must be signed in to change notification settings - Fork 498
ci: publish releases from GitHub Actions #310
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Waishnav
wants to merge
7
commits into
main
Choose a base branch
from
chore/release-ci
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+319
−0
Open
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
2deeb76
chore(release): add package repository metadata
Waishnav b251cd8
ci(release): publish releases from GitHub Actions
Waishnav 7b7c974
docs(release): document CI release workflow
Waishnav ac538eb
fix(release): verify retry artifact identity
Waishnav 7d656a3
ci(release): pin privileged checkout action
Waishnav 03ac751
ci(release): assert trusted publishing runtime
Waishnav 8ec03e2
fix(release): verify existing npm channel
Waishnav File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,260 @@ | ||
| name: Release | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: Version to publish | ||
| required: true | ||
| type: string | ||
|
|
||
| permissions: | ||
| actions: read | ||
| contents: write | ||
| id-token: write | ||
|
|
||
| concurrency: | ||
| group: release | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| publish: | ||
| name: Publish ${{ inputs.version }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 20 | ||
| env: | ||
| DEVSPACE_OAUTH_OWNER_TOKEN: ci-owner-token-that-is-long-enough | ||
| VERSION: ${{ inputs.version }} | ||
| steps: | ||
| - name: Checkout release source | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
|
|
||
| - name: Require main | ||
| run: | | ||
| if [[ "$GITHUB_REF" != "refs/heads/main" ]]; then | ||
| echo "Releases must be dispatched from main; got $GITHUB_REF" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Require successful main CI | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| state="$(gh run list \ | ||
| --workflow ci.yml \ | ||
| --commit "$GITHUB_SHA" \ | ||
| --event push \ | ||
| --limit 1 \ | ||
| --json status,conclusion \ | ||
| --jq '.[0] | "\(.status):\(.conclusion)"')" | ||
| if [[ "$state" != "completed:success" ]]; then | ||
| echo "The exact release commit must have a successful main CI push run; got ${state:-no run}." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Resolve release metadata | ||
| id: release | ||
| run: | | ||
| stable='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' | ||
| prerelease='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-(beta|rc)\.([1-9][0-9]*)$' | ||
|
|
||
| if [[ "$VERSION" =~ $stable ]]; then | ||
| npm_tag=latest | ||
| is_prerelease=false | ||
| source_version="$(node -p 'require("./package.json").version')" | ||
| if [[ "$source_version" != "$VERSION" ]]; then | ||
| echo "Stable releases require package.json version $VERSION; found $source_version." >&2 | ||
| exit 1 | ||
| fi | ||
| elif [[ "$VERSION" =~ $prerelease ]]; then | ||
| npm_tag=beta | ||
| is_prerelease=true | ||
| else | ||
| echo "Unsupported release version: $VERSION" >&2 | ||
| echo "Use X.Y.Z-beta.N, X.Y.Z-rc.N, or X.Y.Z." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "tag=v$VERSION" >> "$GITHUB_OUTPUT" | ||
| echo "npm_tag=$npm_tag" >> "$GITHUB_OUTPUT" | ||
| echo "prerelease=$is_prerelease" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Verify release tag ownership | ||
| env: | ||
| TAG: ${{ steps.release.outputs.tag }} | ||
| run: | | ||
| if git show-ref --verify --quiet "refs/tags/$TAG"; then | ||
| tag_sha="$(git rev-parse "$TAG^{commit}")" | ||
| if [[ "$tag_sha" != "$GITHUB_SHA" ]]; then | ||
| echo "$TAG already points to $tag_sha instead of $GITHUB_SHA." >&2 | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| - name: Setup pnpm and Node | ||
| uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2 | ||
| with: | ||
| runtime: node@22 | ||
| cache: false | ||
| install: false | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Set package version | ||
| run: | | ||
| npm pkg set version="$VERSION" | ||
| node -e 'const pkg = require("./package.json"); if (pkg.version !== process.env.VERSION) process.exit(1)' | ||
|
|
||
| - name: Typecheck | ||
| run: pnpm typecheck | ||
|
|
||
| - name: Test | ||
| env: | ||
| DEVSPACE_REQUIRE_PI_SANDBOX: "0" | ||
| run: pnpm test | ||
|
|
||
| - name: Package install smoke test | ||
| run: pnpm test:package-install | ||
|
|
||
| - name: Pack release artifact | ||
| id: pack | ||
| run: | | ||
| mkdir -p .release | ||
| filename="$(npm pack --silent --pack-destination .release | tail -n 1)" | ||
| test -n "$filename" | ||
| tarball=".release/$filename" | ||
| integrity="sha512-$(openssl dgst -sha512 -binary "$tarball" | openssl base64 -A)" | ||
| echo "filename=$filename" >> "$GITHUB_OUTPUT" | ||
| echo "tarball=$tarball" >> "$GITHUB_OUTPUT" | ||
| echo "integrity=$integrity" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Inspect existing publication | ||
| id: publication | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| TAG: ${{ steps.release.outputs.tag }} | ||
| TARBALL: ${{ steps.pack.outputs.tarball }} | ||
| FILENAME: ${{ steps.pack.outputs.filename }} | ||
| LOCAL_INTEGRITY: ${{ steps.pack.outputs.integrity }} | ||
| IS_PRERELEASE: ${{ steps.release.outputs.prerelease }} | ||
| NPM_TAG: ${{ steps.release.outputs.npm_tag }} | ||
| run: | | ||
| package_name="$(node -p 'require("./package.json").name')" | ||
| npm_exists=false | ||
| if npm_integrity="$(npm view "$package_name@$VERSION" dist.integrity 2>/dev/null)"; then | ||
| if [[ -z "$npm_integrity" || "$npm_integrity" != "$LOCAL_INTEGRITY" ]]; then | ||
| echo "$package_name@$VERSION already exists on npm with different integrity." >&2 | ||
| exit 1 | ||
| fi | ||
| published_channel="$(npm view "$package_name" "dist-tags.$NPM_TAG" 2>/dev/null || true)" | ||
| if [[ "$published_channel" != "$VERSION" ]]; then | ||
| echo "$package_name@$VERSION exists on npm but @$NPM_TAG points to ${published_channel:-nothing}." >&2 | ||
| exit 1 | ||
| fi | ||
| npm_exists=true | ||
| fi | ||
|
|
||
| release_exists=false | ||
| release_draft=false | ||
| complete=false | ||
| if release_json="$(gh release view "$TAG" --json isDraft,isPrerelease,targetCommitish 2>/dev/null)"; then | ||
| release_exists=true | ||
| release_draft="$(jq -r .isDraft <<<"$release_json")" | ||
| release_prerelease="$(jq -r .isPrerelease <<<"$release_json")" | ||
| release_target="$(jq -r .targetCommitish <<<"$release_json")" | ||
| if [[ "$release_target" != "$GITHUB_SHA" ]]; then | ||
| echo "$TAG already targets $release_target instead of $GITHUB_SHA." >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ "$release_draft" != "true" ]]; then | ||
| if [[ "$release_prerelease" != "$IS_PRERELEASE" ]]; then | ||
| echo "$TAG is already public with the wrong prerelease state." >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ "$npm_exists" != "true" ]]; then | ||
| echo "$TAG is already public on GitHub but $package_name@$VERSION is missing from npm." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| mkdir -p .release/existing | ||
| if ! gh release download "$TAG" --pattern "$FILENAME" --dir .release/existing --clobber; then | ||
| echo "$TAG is already public but its release artifact could not be verified." >&2 | ||
| exit 1 | ||
| fi | ||
| if ! cmp --silent "$TARBALL" ".release/existing/$FILENAME"; then | ||
| echo "$TAG is already public with a different release artifact." >&2 | ||
| exit 1 | ||
| fi | ||
| complete=true | ||
| fi | ||
| fi | ||
|
|
||
| echo "npm_exists=$npm_exists" >> "$GITHUB_OUTPUT" | ||
| echo "release_exists=$release_exists" >> "$GITHUB_OUTPUT" | ||
| echo "release_draft=$release_draft" >> "$GITHUB_OUTPUT" | ||
| echo "complete=$complete" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Prepare draft GitHub release | ||
| if: steps.publication.outputs.complete != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| TAG: ${{ steps.release.outputs.tag }} | ||
| IS_PRERELEASE: ${{ steps.release.outputs.prerelease }} | ||
| RELEASE_EXISTS: ${{ steps.publication.outputs.release_exists }} | ||
| run: | | ||
| if [[ "$RELEASE_EXISTS" == "true" ]]; then | ||
| echo "Reusing existing draft GitHub release $TAG." | ||
| else | ||
| args=(release create "$TAG" --draft --title "$TAG" --target "$GITHUB_SHA" --generate-notes) | ||
| if [[ "$IS_PRERELEASE" == "true" ]]; then | ||
| args+=(--prerelease) | ||
| fi | ||
| gh "${args[@]}" | ||
| fi | ||
|
|
||
| - name: Upload release artifact | ||
| if: steps.publication.outputs.complete != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| TAG: ${{ steps.release.outputs.tag }} | ||
| TARBALL: ${{ steps.pack.outputs.tarball }} | ||
| run: gh release upload "$TAG" "$TARBALL" --clobber | ||
|
|
||
| - name: Setup npm trusted publishing | ||
| if: steps.publication.outputs.complete != 'true' && steps.publication.outputs.npm_exists != 'true' | ||
| run: | | ||
| npm install --global npm@11.8.0 | ||
| npm config set registry https://registry.npmjs.org/ | ||
| node_version="$(node -p 'process.versions.node')" | ||
| npm_version="$(npm --version)" | ||
| echo "Node.js $node_version" | ||
| echo "npm $npm_version" | ||
| node -e 'const [major, minor] = process.versions.node.split(".").map(Number); if (major < 22 || (major === 22 && minor < 14)) process.exit(1)' | ||
| if [[ "$npm_version" != "11.8.0" ]]; then | ||
| echo "Expected npm 11.8.0 for trusted publishing; resolved npm $npm_version." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Publish npm package | ||
| if: steps.publication.outputs.complete != 'true' && steps.publication.outputs.npm_exists != 'true' | ||
| env: | ||
| NPM_TAG: ${{ steps.release.outputs.npm_tag }} | ||
| TARBALL: ${{ steps.pack.outputs.tarball }} | ||
| run: npm publish "$TARBALL" --access public --tag "$NPM_TAG" --provenance | ||
|
|
||
| - name: Publish GitHub release | ||
| if: steps.publication.outputs.complete != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| TAG: ${{ steps.release.outputs.tag }} | ||
| IS_PRERELEASE: ${{ steps.release.outputs.prerelease }} | ||
| run: | | ||
| if [[ "$IS_PRERELEASE" == "true" ]]; then | ||
| gh release edit "$TAG" --draft=false --prerelease | ||
| else | ||
| gh release edit "$TAG" --draft=false --prerelease=false --latest | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.