okf/.github/workflows/release.yml at main · btwld/okf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Deploy Release

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  # cli_pkg 2.15.2 uses the Dart 3.11-only xml 7 API; pinned for reproducibility.
  RELEASE_DART_SDK: "3.11.0"

jobs:
  test:
    name: Test
    uses: ./.github/workflows/test.yml
    secrets: inherit

  release:
    name: Release
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # exchanged by setup-dart for temporary pub.dev credentials
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Prepare environment
        uses: ./.github/actions/prepare
        with:
          sdk-version: ${{ env.RELEASE_DART_SDK }}

      # cli_pkg hardcodes the release's tag_name to the bare pubspec version
      # and attaches every asset to that tag. Publish it at this commit first:
      # left to itself, GitHub invents the tag at the default branch head,
      # which is not necessarily what was tagged and tested.
      - name: Tag the release commit with the bare version
        run: |
          [[ "$GITHUB_REF_TYPE" == tag ]]
          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          version="${GITHUB_REF_NAME#v}"
          if git ls-remote --exit-code --tags origin "$version" >/dev/null; then
            echo "okf: $version already exists"
          else
            git tag "$version"
            git push origin "$version"
          fi

      - name: Get release tool dependencies
        working-directory: tool/release
        run: dart pub get --enforce-lockfile

      - name: Deploy Github
        working-directory: tool/release
        run: dart run grinder pkg-github-release

      - name: Deploy Github Linux
        working-directory: tool/release
        run: dart run grinder pkg-github-linux

      # The prepare action above dropped the credential so that dependency
      # resolution could talk to pub.dev unauthenticated. Mint a fresh one now
      # that every read is done. Same SDK as prepare, so this is a tool-cache
      # hit and only the token is refreshed; the cleanup guards the download
      # path that test.yml documents, in case the two versions ever diverge.
      - name: Clean Dart SDK temp files
        run: rm -f ${{ runner.temp }}/dartsdk-*.zip

      - name: Provision pub.dev OIDC credentials
        uses: dart-lang/setup-dart@v1
        with:
          sdk: ${{ env.RELEASE_DART_SDK }}
          problem-matcher: false

      # cli_pkg's pkg-pub-deploy only knows how to write a long-lived
      # PUB_CREDENTIALS file before publishing. setup-dart exchanged this job's
      # OIDC token for temporary pub.dev credentials, so publish directly and
      # keep no durable secret.
      #
      # --force skips the interactive confirmation, which a workflow cannot
      # answer. Validation runs: dart-lang/pub-dev#9576, which rejected
      # authenticated metadata reads with HTTP 403 and forced
      # --skip-validation here, is fixed upstream.
      - name: Deploy to Pub
        run: dart pub publish --force

  deploy-macos:
    name: Deploy macOS
    runs-on: macos-latest
    needs: release
    permissions:
      # pkg-github-macos uploads assets to the release the previous job
      # created, which is a write to repository contents.
      contents: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Prepare environment
        uses: ./.github/actions/prepare
        with:
          sdk-version: ${{ env.RELEASE_DART_SDK }}

      - name: Get release tool dependencies
        working-directory: tool/release
        run: dart pub get --enforce-lockfile

      - name: Deploy Github Mac
        working-directory: tool/release
        run: dart run grinder pkg-github-macos

      - name: Deploy versioned formula
        working-directory: tool/release
        run: dart run grinder pkg-homebrew-update --versioned-formula
        env:
          GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GH_TOKEN }}

      - name: Deploy Homebrew
        working-directory: tool/release
        run: dart run grinder pkg-homebrew-update
        env:
          GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GH_TOKEN }}