Release / publish / main #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| run-name: Release / ${{ inputs.operation }} / ${{ github.ref_name }} | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| operation: | |
| description: Prepare a release PR, dry-run publish, or publish from main | |
| required: true | |
| type: choice | |
| default: prepare-release-pr | |
| options: | |
| - prepare-release-pr | |
| - publish-dry-run | |
| - publish | |
| release_commit: | |
| description: Optional full commit SHA to publish/dry-run instead of the workflow commit | |
| required: false | |
| type: string | |
| default: "" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| CANONICAL_RELEASE_REPOSITORY: f0rr0/oliphaunt | |
| NODE_VERSION: 22.22.3 | |
| PNPM_VERSION: 11.5.0 | |
| NPM_VERSION: 11.5.1 | |
| DENO_VERSION: v2.8.1 | |
| BUN_VERSION: 1.3.14 | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| release-identity: | |
| name: Validate release identity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Require canonical release repository | |
| run: | | |
| if [[ "${GITHUB_REPOSITORY}" != "${CANONICAL_RELEASE_REPOSITORY}" ]]; then | |
| echo "Release workflow is pinned to ${CANONICAL_RELEASE_REPOSITORY}; got ${GITHUB_REPOSITORY}" >&2 | |
| exit 1 | |
| fi | |
| prepare-release-pr: | |
| name: Prepare release PR | |
| needs: release-identity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| if: ${{ inputs.operation == 'prepare-release-pr' }} | |
| environment: release-pr | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| steps: | |
| - name: Require main | |
| run: | | |
| if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then | |
| echo "Releases must be run from main; got ${GITHUB_REF}" >&2 | |
| exit 1 | |
| fi | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Moon | |
| uses: ./.github/actions/setup-moon | |
| - name: Set up Rust | |
| uses: ./.github/actions/setup-rust | |
| with: | |
| cache-save-if: "true" | |
| - name: Validate release metadata | |
| run: | | |
| tools/dev/bun.sh tools/release/release-check.mjs | |
| - name: Require release PR token | |
| env: | |
| RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }} | |
| run: | | |
| if [[ -z "${RELEASE_PR_TOKEN}" ]]; then | |
| echo "RELEASE_PR_TOKEN is required so generated release PRs trigger normal PR CI." >&2 | |
| echo "Configure a GitHub App or maintainer bot token in the release-pr environment." >&2 | |
| exit 1 | |
| fi | |
| - name: Create or update release-please PR | |
| id: release_please | |
| uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 | |
| with: | |
| token: ${{ secrets.RELEASE_PR_TOKEN }} | |
| target-branch: main | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| skip-github-release: true | |
| - name: Sync derived release PR files | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }} | |
| RELEASE_PLEASE_PR: ${{ steps.release_please.outputs.pr }} | |
| RELEASE_PLEASE_PRS: ${{ steps.release_please.outputs.prs }} | |
| RELEASE_PLEASE_PRS_CREATED: ${{ steps.release_please.outputs.prs_created }} | |
| run: | | |
| set -euo pipefail | |
| release_pr_number="$(bun .github/scripts/resolve-release-please-pr.mjs)" | |
| if [[ -z "${release_pr_number}" ]]; then | |
| release_pr_number="$( | |
| gh pr list \ | |
| --base main \ | |
| --head release-please--branches--main \ | |
| --state open \ | |
| --json number \ | |
| --jq '.[0].number // empty' | |
| )" | |
| fi | |
| if [[ -z "${release_pr_number}" ]]; then | |
| if [[ "${RELEASE_PLEASE_PRS_CREATED}" == "true" ]]; then | |
| echo "release-please reported PR changes, but no release PR number could be resolved." >&2 | |
| exit 1 | |
| fi | |
| echo "No open release-please PR found; derived release file sync skipped." | |
| exit 0 | |
| fi | |
| release_pr_head="$(gh pr view "${release_pr_number}" --json headRefName --jq .headRefName)" | |
| if [[ -z "${release_pr_head}" ]]; then | |
| echo "release PR #${release_pr_number} does not expose a head branch." >&2 | |
| exit 1 | |
| fi | |
| gh auth setup-git | |
| git fetch origin "+refs/heads/${release_pr_head}:refs/remotes/origin/${release_pr_head}" | |
| git switch -C "${release_pr_head}" "origin/${release_pr_head}" | |
| tools/dev/bun.sh tools/release/sync-release-pr.mjs | |
| tools/dev/bun.sh tools/release/sync-release-pr.mjs --check | |
| tools/dev/bun.sh tools/release/release-check.mjs | |
| if git diff --quiet; then | |
| echo "Derived release files already match release-please output." | |
| exit 0 | |
| fi | |
| git config user.name "oliphaunt-release-bot" | |
| git config user.email "oliphaunt-release-bot@users.noreply.github.com" | |
| git add -u | |
| git commit -m "chore(release): sync derived release files" | |
| git push origin "HEAD:${release_pr_head}" | |
| - name: Report release-please PR result | |
| run: | | |
| if [[ "${{ steps.release_please.outputs.prs_created }}" == "true" ]]; then | |
| echo "release-please created or updated a release PR." | |
| else | |
| echo "release-please found no releasable changes." | |
| fi | |
| publish: | |
| name: Publish release | |
| needs: | |
| - release-identity | |
| runs-on: macos-latest | |
| timeout-minutes: 240 | |
| if: ${{ inputs.operation != 'prepare-release-pr' }} | |
| environment: ${{ inputs.operation == 'publish' && 'release-publish' || 'release-dry-run' }} | |
| permissions: | |
| actions: read | |
| attestations: write | |
| contents: write | |
| id-token: write | |
| pull-requests: read | |
| steps: | |
| - name: Require main | |
| run: | | |
| if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then | |
| echo "Releases must be run from main; got ${GITHUB_REF}" >&2 | |
| exit 1 | |
| fi | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Resolve release commit | |
| id: release_head | |
| env: | |
| INPUT_RELEASE_COMMIT: ${{ inputs.release_commit }} | |
| run: .github/scripts/resolve-release-head.sh | |
| - name: Set up Moon | |
| uses: ./.github/actions/setup-moon | |
| - name: Set up Rust | |
| uses: ./.github/actions/setup-rust | |
| with: | |
| cache-save-if: "true" | |
| - name: Configure macOS release toolchains | |
| run: | | |
| if [[ -n "${JAVA_HOME_17_X64:-}" ]]; then | |
| echo "JAVA_HOME=${JAVA_HOME_17_X64}" >> "$GITHUB_ENV" | |
| echo "${JAVA_HOME_17_X64}/bin" >> "$GITHUB_PATH" | |
| fi | |
| if [[ -z "${ANDROID_HOME:-}" && -d "$HOME/Library/Android/sdk" ]]; then | |
| echo "ANDROID_HOME=$HOME/Library/Android/sdk" >> "$GITHUB_ENV" | |
| echo "ANDROID_SDK_ROOT=$HOME/Library/Android/sdk" >> "$GITHUB_ENV" | |
| fi | |
| - name: Validate release metadata | |
| run: | | |
| tools/dev/bun.sh tools/release/release-check.mjs | |
| - name: Enable pnpm for registry release checks | |
| run: | | |
| corepack enable | |
| corepack prepare pnpm@${{ env.PNPM_VERSION }} --activate | |
| npm install --global "npm@${{ env.NPM_VERSION }}" | |
| node --version | |
| npm_version="$(npm --version)" | |
| echo "npm ${npm_version}" | |
| node - "$npm_version" <<'NODE' | |
| const min = [11, 5, 1]; | |
| const version = process.argv[2] ?? ''; | |
| const current = version.split('.').map((part) => Number.parseInt(part, 10)); | |
| const valid = | |
| current.length >= min.length && | |
| current.every(Number.isFinite) && | |
| (current[0] > min[0] || | |
| (current[0] === min[0] && | |
| (current[1] > min[1] || | |
| (current[1] === min[1] && current[2] >= min[2])))); | |
| if (!version || !valid) { | |
| console.error(`npm ${version || '<unknown>'} is too old for trusted publishing; need >= ${min.join('.')}`); | |
| process.exit(1); | |
| } | |
| NODE | |
| pnpm --version | |
| - name: Plan product releases | |
| id: release_plan | |
| run: | | |
| tools/dev/bun.sh tools/release/release_plan.mjs --from-product-tags --include-current-tags --head-ref "$RELEASE_HEAD_SHA" --format github-output >> "$GITHUB_OUTPUT" | |
| - name: No package release planned | |
| if: ${{ steps.release_plan.outputs.has_release_changes != 'true' }} | |
| run: echo "No release-affecting product changes were found since the last product tag." | |
| - name: Check publish environment | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/release/check_publish_environment.mjs --products-json "${PRODUCTS_JSON}" | |
| - name: Require release-commit CI build gate | |
| id: ci_build_gate | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| run: bash .github/scripts/require-workflow-success.sh CI "$RELEASE_HEAD_SHA" 7200 --job Builds | |
| - name: Require exact-extension package build artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| bash .github/scripts/require-workflow-success.sh \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| 7200 \ | |
| --run-id "${CI_RUN_ID}" \ | |
| --job Builds \ | |
| --artifact oliphaunt-extension-package-artifacts | |
| - name: Validate product changelogs | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/dev/bun.sh tools/release/release-check.mjs --products-json "${PRODUCTS_JSON}" | |
| - name: Validate product versions and registry state | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/dev/bun.sh tools/release/release-check-registries.mjs --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Download WASIX runtime build artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: bun .github/scripts/download-wasix-runtime-build-artifacts.mjs | |
| - name: Download WASIX release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/oliphaunt-wasix/release-assets \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact liboliphaunt-wasix-release-assets | |
| - name: Download exact-extension package artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/extension-artifacts \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact oliphaunt-extension-package-artifacts | |
| - name: Download SDK package artifacts | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| download_sdk_artifact() { | |
| local product="$1" | |
| local artifact_args=() | |
| while IFS= read -r artifact; do | |
| artifact_args+=(--artifact "$artifact") | |
| done < <(tools/dev/bun.sh tools/release/release_graph_query.mjs ci-artifact-names --product "$product" --family sdk-package --format lines) | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| "target/sdk-artifacts/$product" \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| "${artifact_args[@]}" | |
| } | |
| while IFS= read -r product; do | |
| download_sdk_artifact "$product" | |
| done < <(tools/dev/bun.sh tools/release/release_graph_query.mjs ci-products --family sdk-package --products-json "$PRODUCTS_JSON" --format lines) | |
| - name: Download liboliphaunt release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/liboliphaunt/release-assets \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| --artifact liboliphaunt-native-release-assets | |
| - name: Set up Deno for TypeScript JSR consumer checks | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| uses: ./.github/actions/setup-deno | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: Set up Bun for TypeScript npm consumer checks | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| uses: ./.github/actions/setup-bun | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Install TypeScript release tooling | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| run: pnpm install --frozen-lockfile | |
| - name: Download native helper release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && (steps.release_plan.outputs.product_oliphaunt_broker == 'true' || steps.release_plan.outputs.product_oliphaunt_node_direct == 'true') }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PRODUCT_OLIPHAUNT_BROKER: ${{ steps.release_plan.outputs.product_oliphaunt_broker }} | |
| PRODUCT_OLIPHAUNT_NODE_DIRECT: ${{ steps.release_plan.outputs.product_oliphaunt_node_direct }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| download_helper_artifacts() { | |
| local product="$1" | |
| local kind="$2" | |
| local destination="$3" | |
| local artifact_args=() | |
| while IFS= read -r artifact; do | |
| artifact_args+=(--artifact "$artifact") | |
| done < <(tools/dev/bun.sh tools/release/release_graph_query.mjs ci-artifact-names --product "$product" --kind "$kind" --family release-assets --format lines) | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| "$destination" \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| "${artifact_args[@]}" | |
| } | |
| if [ "$PRODUCT_OLIPHAUNT_BROKER" = "true" ]; then | |
| download_helper_artifacts \ | |
| oliphaunt-broker \ | |
| broker-helper \ | |
| target/oliphaunt-broker/release-assets | |
| fi | |
| if [ "$PRODUCT_OLIPHAUNT_NODE_DIRECT" = "true" ]; then | |
| download_helper_artifacts \ | |
| oliphaunt-node-direct \ | |
| node-direct-addon \ | |
| target/oliphaunt-node-direct/release-assets | |
| fi | |
| - name: Download Node direct optional npm packages | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| CI_RUN_ID: ${{ steps.ci_build_gate.outputs.run_id }} | |
| run: | | |
| artifact_args=() | |
| while IFS= read -r artifact; do | |
| artifact_args+=(--artifact "$artifact") | |
| done < <(tools/dev/bun.sh tools/release/release_graph_query.mjs ci-artifact-names --product oliphaunt-node-direct --kind node-direct-addon --family npm-package --format lines) | |
| bun .github/scripts/download-build-artifacts.mjs \ | |
| CI \ | |
| "$RELEASE_HEAD_SHA" \ | |
| target/oliphaunt-node-direct/npm-packages \ | |
| --run-id "$CI_RUN_ID" \ | |
| --job Builds \ | |
| "${artifact_args[@]}" | |
| - name: Validate selected release product dry-runs | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| OLIPHAUNT_BROKER_RELEASE_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-broker/release-assets | |
| OLIPHAUNT_NODE_ADDON_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-node-direct/release-assets | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish-dry-run --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Create release-please target branch | |
| if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' && steps.release_head.outputs.uses_temporary_target_branch == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh auth setup-git | |
| git push origin "${RELEASE_HEAD_SHA}:refs/heads/${{ steps.release_head.outputs.target_branch }}" --force | |
| - name: Create release-please GitHub releases | |
| id: release_please | |
| if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' }} | |
| uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| target-branch: ${{ steps.release_head.outputs.target_branch }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| skip-github-pull-request: true | |
| - name: Verify release-please product tags | |
| if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' }} | |
| env: | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/dev/bun.sh tools/release/verify_product_tags.mjs --products-json "${PRODUCTS_JSON}" --target "$RELEASE_HEAD_SHA" | |
| - name: Remove release-please target branch | |
| if: ${{ always() && inputs.operation == 'publish' && steps.release_head.outputs.uses_temporary_target_branch == 'true' }} | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh auth setup-git | |
| git push origin ":refs/heads/${{ steps.release_head.outputs.target_branch }}" | |
| - name: Publish liboliphaunt GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-native --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish selected extension GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.extension_products_json }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --step github-release-assets --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish selected extension Android artifacts to Maven Central | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.extension_products_json }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --step maven-central --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish selected extension packages to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.extension_products_json }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --step npm --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish selected extension Cargo artifact crates to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.extension_products_json }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --step crates-io --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest selected extension release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.has_extension_products == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/extension-artifacts/*/release-assets/*.tar.gz | |
| target/extension-artifacts/*/release-assets/*.tar.zst | |
| target/extension-artifacts/*/release-assets/*.zip | |
| target/extension-artifacts/*/release-assets/*.json | |
| target/extension-artifacts/*/release-assets/*.properties | |
| target/extension-artifacts/*/release-assets/*.sha256 | |
| - name: Attest liboliphaunt release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/liboliphaunt/release-assets/*.tar.gz | |
| target/liboliphaunt/release-assets/*.tar.zst | |
| target/liboliphaunt/release-assets/*.zip | |
| target/liboliphaunt/release-assets/*.tsv | |
| target/liboliphaunt/release-assets/*.sha256 | |
| - name: Publish liboliphaunt native artifact packages to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-native --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish liboliphaunt artifact packages to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-native --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish liboliphaunt Android runtime artifacts to Maven Central | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-native --step maven-central --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Swift SDK GitHub release and SwiftPM tags | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_swift == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-swift --step github-release --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Kotlin SDK to Maven Central | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_kotlin == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MAVEN_GPG_KEY_ID }} | |
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-kotlin --step maven-central --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish React Native package to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_react_native == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-react-native --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish broker GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| OLIPHAUNT_BROKER_RELEASE_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-broker/release-assets | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-broker --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest broker release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-broker/release-assets/*.tar.gz | |
| target/oliphaunt-broker/release-assets/*.zip | |
| target/oliphaunt-broker/release-assets/*.sha256 | |
| - name: Publish broker artifact packages to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-broker --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish broker artifact packages to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_broker == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-broker --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Rust SDK to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_rust == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-rust --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish Node direct GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| OLIPHAUNT_NODE_ADDON_ASSET_INPUT_DIRS: ${{ github.workspace }}/target/oliphaunt-node-direct/release-assets | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-node-direct --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest Node direct release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-node-direct/release-assets/*.tar.gz | |
| target/oliphaunt-node-direct/release-assets/*.zip | |
| target/oliphaunt-node-direct/release-assets/*.sha256 | |
| - name: Publish Node direct optional packages to npm | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_node_direct == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-node-direct --step npm --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish TypeScript packages to npm and JSR | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_js == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-js --step npm-jsr --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Upload WASIX GitHub release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-wasix --step github-release-assets --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Attest WASIX release assets | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 | |
| with: | |
| subject-path: | | |
| target/oliphaunt-wasix/release-assets/*.tar.zst | |
| target/oliphaunt-wasix/release-assets/*.sha256 | |
| - name: Publish WASIX runtime artifact packages to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_liboliphaunt_wasix == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product liboliphaunt-wasix --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Publish WASIX Rust binding to crates.io | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && steps.release_plan.outputs.product_oliphaunt_wasix_rust == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: tools/dev/bun.sh tools/release/release-publish.mjs publish --product oliphaunt-wasix-rust --step crates-io --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Verify published release | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: | | |
| gh auth setup-git | |
| git fetch --force --tags origin | |
| tools/dev/bun.sh tools/release/release-verify.mjs --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" | |
| - name: Run consumer shape gates | |
| if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }} | |
| run: tools/dev/bun.sh tools/release/release-consumer-shape.mjs --require-ready --products-json "${PRODUCTS_JSON}" |