Release / publish-dry-run / main #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| run-name: Release / ${{ inputs.operation }} / ${{ github.ref_name }} | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| operation: | |
| description: Prepare a release PR, dry-run publish, or publish from main | |
| required: true | |
| type: choice | |
| default: prepare-release-pr | |
| options: | |
| - prepare-release-pr | |
| - publish-dry-run | |
| - publish | |
| release_commit: | |
| description: Optional full commit SHA to publish/dry-run instead of the workflow commit | |
| required: false | |
| type: string | |
| default: "" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| CANONICAL_RELEASE_REPOSITORY: f0rr0/oliphaunt | |
| NODE_VERSION: 22.22.3 | |
| PNPM_VERSION: 11.5.0 | |
| NPM_VERSION: 11.5.1 | |
| DENO_VERSION: v2.8.1 | |
| BUN_VERSION: 1.3.14 | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| release-identity: | |
| name: Validate release identity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Require canonical release repository | |
| run: | | |
| if [[ "${GITHUB_REPOSITORY}" != "${CANONICAL_RELEASE_REPOSITORY}" ]]; then | |
| echo "Release workflow is pinned to ${CANONICAL_RELEASE_REPOSITORY}; got ${GITHUB_REPOSITORY}" >&2 | |
| exit 1 | |
| fi | |
| prepare-release-pr: | |
| name: Prepare release PR | |
| needs: release-identity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| if: ${{ inputs.operation == 'prepare-release-pr' }} | |
| environment: release-pr | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| steps: | |
| - name: Require main | |
| run: | | |
| if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then | |
| echo "Releases must be run from main; got ${GITHUB_REF}" >&2 | |
| exit 1 | |
| fi | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Moon | |
| uses: ./.github/actions/setup-moon | |
| - name: Set up Rust | |
| uses: ./.github/actions/setup-rust | |
| with: | |
| cache-save-if: "true" | |
| - name: Validate release metadata | |
| run: | | |
| tools/release/release.py check | |
| - name: Require release PR token | |
| env: | |
| RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }} | |
| run: | | |
| if [[ -z "${RELEASE_PR_TOKEN}" ]]; then | |
| echo "RELEASE_PR_TOKEN is required so generated release PRs trigger normal PR CI." >&2 | |
| echo "Configure a GitHub App or maintainer bot token in the release-pr environment." >&2 | |
| exit 1 | |
| fi | |
| - name: Create or update release-please PR | |
| id: release_please | |
| uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 | |
| with: | |
| token: ${{ secrets.RELEASE_PR_TOKEN }} | |
| target-branch: main | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| skip-github-release: true | |
| - name: Sync derived release PR files | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }} | |
| RELEASE_PLEASE_PR: ${{ steps.release_please.outputs.pr }} | |
| RELEASE_PLEASE_PRS: ${{ steps.release_please.outputs.prs }} | |
| RELEASE_PLEASE_PRS_CREATED: ${{ steps.release_please.outputs.prs_created }} | |
| run: | | |
| set -euo pipefail | |
| release_pr_number="$( | |
| python3 - <<'PY' | |
| import json | |
| import os | |
| candidates = [] | |
| for name in ("RELEASE_PLEASE_PR", "RELEASE_PLEASE_PRS"): | |
| raw = os.environ.get(name, "").strip() | |
| if not raw: | |
| continue | |
| try: | |
| value = json.loads(raw) | |
| except json.JSONDecodeError: | |
| continue | |
| if isinstance(value, dict): | |
| candidates.append(value) | |
| elif isinstance(value, list): | |
| candidates.extend(item for item in value if isinstance(item, dict)) | |
| for item in candidates: | |
| number = item.get("number") or item.get("pullRequestNumber") | |
| if number: | |
| print(number) | |
| break | |
| PY | |
| )" | |
| if [[ -z "${release_pr_number}" ]]; then | |
| release_pr_number="$( | |
| gh pr list \ | |
| --base main \ | |
| --head release-please--branches--main \ | |
| --state open \ | |
| --json number \ | |
| --jq '.[0].number // empty' | |
| )" | |
| fi | |
| if [[ -z "${release_pr_number}" ]]; then | |
| if [[ "${RELEASE_PLEASE_PRS_CREATED}" == "true" ]]; then | |
| echo "release-please reported PR changes, but no release PR number could be resolved." >&2 | |
| exit 1 | |
| fi | |
| echo "No open release-please PR found; derived release file sync skipped." | |
| exit 0 | |
| fi | |
| release_pr_head="$(gh pr view "${release_pr_number}" --json headRefName --jq .headRefName)" | |
| if [[ -z "${release_pr_head}" ]]; then | |
| echo "release PR #${release_pr_number} does not expose a head branch." >&2 | |
| exit 1 | |
| fi | |
| gh auth setup-git | |
| git fetch origin "+refs/heads/${release_pr_head}:refs/remotes/origin/${release_pr_head}" | |
| git switch -C "${release_pr_head}" "origin/${release_pr_head}" | |
| tools/release/sync_release_pr.py | |
| tools/release/sync_release_pr.py --check | |
| tools/release/release.py check | |
| if git diff --quiet; then | |
| echo "Derived release files already match release-please output." | |
| exit 0 | |
| fi | |
| git config user.name "oliphaunt-release-bot" | |
| git config user.email "oliphaunt-release-bot@users.noreply.github.com" | |
| git add -u | |
| git commit -m "chore(release): sync derived release files" | |
| git push origin "HEAD:${release_pr_head}" | |
| - name: Report release-please PR result | |
| run: | | |
| if [[ "${{ steps.release_please.outputs.prs_created }}" == "true" ]]; then | |
| echo "release-please created or updated a release PR." | |
| else | |
| echo "release-please found no releasable changes." | |
| fi | |
| publish: | |
| name: Publish release | |
| needs: | |
| - release-identity | |
| runs-on: macos-latest | |
| timeout-minutes: 240 | |
| if: ${{ inputs.operation != 'prepare-release-pr' }} | |
| environment: ${{ inputs.operation == 'publish' && 'release-publish' || 'release-dry-run' }} | |
| permissions: | |
| actions: read | |
| attestations: write | |
| contents: write | |
| id-token: write | |
| pull-requests: read | |
| steps: | |
| - name: Require main | |
| run: | | |
| if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then | |
| echo "Releases must be run from main; got ${GITHUB_REF}" >&2 | |
| exit 1 | |
| fi | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Resolve release commit | |
| id: release_head | |
| env: | |
| INPUT_RELEASE_COMMIT: ${{ inputs.release_commit }} | |
| run: .github/scripts/resolve-release-head.sh | |
| - name: Set up Moon | |
| uses: ./.github/actions/setup-moon | |
| - name: Set up Rust | |
| uses: ./.github/actions/setup-rust | |
| with: | |
| cache-save-if: "true" | |
| - name: Configure macOS release toolchains | |
| run: | | |
| if [[ -n "${JAVA_HOME_17_X64:-}" ]]; then | |
| echo "JAVA_HOME=${JAVA_HOME_17_X64}" >> "$GITHUB_ENV" | |
| echo "${JAVA_HOME_17_X64}/bin" >> "$GITHUB_PATH" | |
| fi | |
| if [[ -z "${ANDROID_HOME:-}" && -d "$HOME/Library/Android/sdk" ]]; then | |
| echo "ANDROID_HOME=$HOME/Library/Android/sdk" >> "$GITHUB_ENV" | |
| echo "ANDROID_SDK_ROOT=$HOME/Library/Android/sdk" >> "$GITHUB_ENV" | |
| fi | |
| - name: Validate release metadata | |
| run: | | |
| tools/release/release.py check | |
| - name: Enable pnpm for registry release checks | |
| run: | | |
| corepack enable | |
| corepack prepare pnpm@${{ env.PNPM_VERSION }} --activate | |
| npm install --global "npm@${{ env.NPM_VERSION }}" | |
| node --version | |
| npm_version="$(npm --version)" | |
| echo "npm ${npm_version}" | |
| node - "$npm_version" <<'NODE' | |
| const min = [11, 5, 1]; | |
| const version = process.argv[2] ?? ''; | |
| const current = version.split('.').map((part) => Number.parseInt(part, 10)); | |
| const valid = | |
| current.length >= min.length && | |
| current.every(Number.isFinite) && | |
| (current[0] > min[0] || | |
| (current[0] === min[0] && | |
| (current[1] > min[1] || | |
| (current[1] === min[1] && current[2] >= min[2])))); | |
| if (!version || !valid) { | |
| console.error(`npm ${version || '<unknown>'} is too old for trusted publishing; need >= ${min.join('.')}`); | |
| process.exit(1); | |
| } | |
| NODE | |
| pnpm --version | |
| - name: Plan product releases | |
| id: release_plan | |
| run: | | |
| tools/release/release.py plan --from-product-tags --include-current-tags --head-ref "$RELEASE_HEAD_SHA" --format github-output >> "$GITHUB_OUTPUT" | |
| - name: No package release planned | |
| if: ${{ steps.release_plan.outputs.has_release_changes != 'true' }} | |
| run: echo "No release-affecting product changes were found since the last product tag." | |
| - name: Check publish environment | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/release/check_publish_environment.py --products-json "${PRODUCTS_JSON}" | |
| - name: Require release-commit CI build gate | |
| id: ci_build_gate | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| run: bash .github/scripts/require-workflow-success.sh CI "$RELEASE_HEAD_SHA" 7200 --job Builds | |
| - name: Require exact-extension package build artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| bash .github/scripts/require-workflow-success.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| 7200 \ | |
| --run-id "${CI_RUN_ID}" \ | |
| --job Builds \ | |
| --artifact oliphaunt-extension-package-artifacts | |
| - name: Validate product changelogs | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/release/release.py check --products-json "${PRODUCTS_JSON}" | |
| - name: Validate product versions and registry state | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/release/release.py check-registries --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Check existing WASIX runtime release tag | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| id: wasix_runtime_existing_tag | |
| run: tools/release/release.py publish --product liboliphaunt-wasix --step existing-tag --head-ref "$RELEASE_HEAD_SHA" --format github-output >> "$GITHUB_OUTPUT" | |
| - name: Check existing WASIX Rust binding release tag | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_wasix_rust == 'true' }} | |
| id: wasix_rust_existing_tag | |
| run: tools/release/release.py publish --product oliphaunt-wasix-rust --step existing-tag --head-ref "$RELEASE_HEAD_SHA" --format github-output >> "$GITHUB_OUTPUT" | |
| - name: Check existing Rust SDK release tag | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_rust == 'true' }} | |
| id: rust_existing_tag | |
| run: tools/release/release.py publish --product oliphaunt-rust --step existing-tag --head-ref "$RELEASE_HEAD_SHA" --format github-output >> "$GITHUB_OUTPUT" | |
| - name: Download WASIX runtime build artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: .github/scripts/download-wasix-runtime-build-artifacts.sh | |
| - name: Download WASIX release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/oliphaunt-wasix/release-assets \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact liboliphaunt-wasix-release-assets | |
| - name: Download exact-extension package artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/extension-artifacts \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact oliphaunt-extension-package-artifacts | |
| - name: Download SDK package artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PRODUCT_OLIPHAUNT_RUST: ${{ steps.release_plan.outputs.product_oliphaunt_rust }} | |
| PRODUCT_OLIPHAUNT_SWIFT: ${{ steps.release_plan.outputs.product_oliphaunt_swift }} | |
| PRODUCT_OLIPHAUNT_KOTLIN: ${{ steps.release_plan.outputs.product_oliphaunt_kotlin }} | |
| PRODUCT_OLIPHAUNT_REACT_NATIVE: ${{ steps.release_plan.outputs.product_oliphaunt_react_native }} | |
| PRODUCT_OLIPHAUNT_JS: ${{ steps.release_plan.outputs.product_oliphaunt_js }} | |
| PRODUCT_OLIPHAUNT_WASIX_RUST: ${{ steps.release_plan.outputs.product_oliphaunt_wasix_rust }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| download_sdk_artifact() { | |
| local product="$1" | |
| local artifact="$2" | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| "target/sdk-artifacts/$product" \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact "$artifact" | |
| } | |
| [ "$PRODUCT_OLIPHAUNT_RUST" != "true" ] || download_sdk_artifact oliphaunt-rust oliphaunt-rust-sdk-package-artifacts | |
| [ "$PRODUCT_OLIPHAUNT_SWIFT" != "true" ] || download_sdk_artifact oliphaunt-swift oliphaunt-swift-sdk-package-artifacts | |
| [ "$PRODUCT_OLIPHAUNT_KOTLIN" != "true" ] || download_sdk_artifact oliphaunt-kotlin oliphaunt-kotlin-sdk-package-artifacts | |
| [ "$PRODUCT_OLIPHAUNT_REACT_NATIVE" != "true" ] || download_sdk_artifact oliphaunt-react-native oliphaunt-react-native-sdk-package-artifacts | |
| [ "$PRODUCT_OLIPHAUNT_JS" != "true" ] || download_sdk_artifact oliphaunt-js oliphaunt-js-sdk-package-artifacts | |
| [ "$PRODUCT_OLIPHAUNT_WASIX_RUST" != "true" ] || download_sdk_artifact oliphaunt-wasix-rust oliphaunt-wasix-rust-package-artifacts | |
| - name: Download liboliphaunt release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/liboliphaunt/release-assets \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact liboliphaunt-native-release-assets | |
| - name: Set up Deno for TypeScript JSR consumer checks | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| uses: ./.github/actions/setup-deno | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: Set up Bun for TypeScript npm consumer checks | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| uses: ./.github/actions/setup-bun | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Install TypeScript release tooling | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| run: pnpm install --frozen-lockfile | |
| - name: Download native helper release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && (steps.release_plan.outputs.product_oliphaunt_broker == 'true' || steps.release_plan.outputs.product_oliphaunt_node_direct == 'true') }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PRODUCT_OLIPHAUNT_BROKER: ${{ steps.release_plan.outputs.product_oliphaunt_broker }} | |
| PRODUCT_OLIPHAUNT_NODE_DIRECT: ${{ steps.release_plan.outputs.product_oliphaunt_node_direct }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| download_helper_artifacts() { | |
| local prefix="$1" | |
| local destination="$2" | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| "$destination" \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact "${prefix}-macos-arm64" \ | |
| --artifact "${prefix}-linux-x64-gnu" \ | |
| --artifact "${prefix}-linux-arm64-gnu" \ | |
| --artifact "${prefix}-windows-x64-msvc" | |
| } | |
| if [ "$PRODUCT_OLIPHAUNT_BROKER" = "true" ]; then | |
| download_helper_artifacts \ | |
| oliphaunt-broker-release-assets \ | |
| target/oliphaunt-broker/release-assets | |
| fi | |
| if [ "$PRODUCT_OLIPHAUNT_NODE_DIRECT" = "true" ]; then | |
| download_helper_artifacts \ | |
| oliphaunt-node-direct-release-assets \ | |
| target/oliphaunt-node-direct/release-assets | |
| fi | |
| - name: Download Node direct optional npm packages | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| .github/scripts/download-build-artifacts.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/oliphaunt-node-direct/npm-packages \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact oliphaunt-node-direct-npm-package-macos-arm64 \ | |
| --artifact oliphaunt-node-direct-npm-package-linux-x64-gnu \ | |
| --artifact oliphaunt-node-direct-npm-package-linux-arm64-gnu \ | |
| --artifact oliphaunt-node-direct-npm-package-windows-x64-msvc | |
| - name: Validate selected release product dry-runs | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| OLIPHAUNT_BROKER_RELEASE_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-broker/release-assets | |
| OLIPHAUNT_NODE_ADDON_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-node-direct/release-assets | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/release/release.py publish-dry-run --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Create release-please target branch | |
| if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' && steps.release_head.outputs.uses_temporary_target_branch == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh auth setup-git | |
| git push origin "${RELEASE_HEAD_SHA}:refs/heads/${{ steps.release_head.outputs.target_branch }}" --force | |
| - name: Create release-please GitHub releases | |
| id: release_please | |
| if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' }} | |
| uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| target-branch: ${{ steps.release_head.outputs.target_branch }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| skip-github-pull-request: true | |
| - name: Remove release-please target branch | |
| if: ${{ always() && inputs.operation == 'publish' && steps.release_head.outputs.uses_temporary_target_branch == 'true' }} | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh auth setup-git | |
| git push origin ":refs/heads/${{ steps.release_head.outputs.target_branch }}" | |
| - name: Publish liboliphaunt GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product liboliphaunt-native --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish selected extension GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.extension_products_json }} | |
| run: tools/release/release.py publish --step github-release-assets --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest selected extension release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/extension-artifacts/*/release-assets/*.tar.gz | |
| target/extension-artifacts/*/release-assets/*.tar.zst | |
| target/extension-artifacts/*/release-assets/*.zip | |
| target/extension-artifacts/*/release-assets/*.json | |
| target/extension-artifacts/*/release-assets/*.properties | |
| target/extension-artifacts/*/release-assets/*.sha256 | |
| - name: Attest liboliphaunt release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/liboliphaunt/release-assets/*.tar.gz | |
| target/liboliphaunt/release-assets/*.tar.zst | |
| target/liboliphaunt/release-assets/*.zip | |
| target/liboliphaunt/release-assets/*.tsv | |
| target/liboliphaunt/release-assets/*.sha256 | |
| - name: Publish Swift SDK GitHub release and SwiftPM tags | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_swift == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-swift --step github-release --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Kotlin SDK to Maven Central | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_kotlin == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/release/release.py publish --product oliphaunt-kotlin --step maven-central --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish React Native package to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_react_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-react-native --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish WASIX runtime crates to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product liboliphaunt-wasix --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish WASIX Rust binding to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_wasix_rust == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-wasix-rust --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Rust SDK to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_rust == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-rust --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish broker GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| OLIPHAUNT_BROKER_RELEASE_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-broker/release-assets | |
| run: tools/release/release.py publish --product oliphaunt-broker --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest broker release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-broker/release-assets/*.tar.gz | |
| target/oliphaunt-broker/release-assets/*.zip | |
| target/oliphaunt-broker/release-assets/*.sha256 | |
| - name: Publish Node direct GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| OLIPHAUNT_NODE_ADDON_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-node-direct/release-assets | |
| run: tools/release/release.py publish --product oliphaunt-node-direct --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest Node direct release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-node-direct/release-assets/*.tar.gz | |
| target/oliphaunt-node-direct/release-assets/*.zip | |
| target/oliphaunt-node-direct/release-assets/*.sha256 | |
| - name: Publish Node direct optional packages to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-node-direct --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish TypeScript packages to npm and JSR | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product oliphaunt-js --step npm-jsr --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Upload WASIX GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/release/release.py publish --product liboliphaunt-wasix --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest WASIX release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-wasix/release-assets/*.tar.zst | |
| target/oliphaunt-wasix/release-assets/*.sha256 | |
| - name: Verify published release | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: | | |
| gh auth setup-git | |
| git fetch --force --tags origin | |
| tools/release/release.py verify-release --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Run consumer shape gates | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/release/release.py consumer-shape --require-ready --products-json "${PRODUCTS_JSON}" |