Repository navigation
Release #64
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| bump: | |
| description: "Release type" | |
| required: true | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| ci: | |
| if: github.ref == 'refs/heads/main' | |
| uses: ./.github/workflows/ci.yml | |
| release: | |
| if: github.ref == 'refs/heads/main' | |
| needs: ci | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: v3.1.3 | |
| - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| - name: Compute next version | |
| id: version | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Base the next version on the latest published release, not merely a | |
| # pushed tag, so a failed publication can retry the same version. | |
| LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName // empty') | |
| if [ -z "$LATEST" ]; then | |
| LATEST="v0.0.0" | |
| fi | |
| # Strip the leading 'v' | |
| CURRENT="${LATEST#v}" | |
| # Split into major.minor.patch | |
| IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT" | |
| # Bump based on input | |
| case "${{ inputs.bump }}" in | |
| major) | |
| MAJOR=$((MAJOR + 1)) | |
| MINOR=0 | |
| PATCH=0 | |
| ;; | |
| minor) | |
| MINOR=$((MINOR + 1)) | |
| PATCH=0 | |
| ;; | |
| patch) | |
| PATCH=$((PATCH + 1)) | |
| ;; | |
| esac | |
| NEXT="${MAJOR}.${MINOR}.${PATCH}" | |
| echo "version=${NEXT}" >> "$GITHUB_OUTPUT" | |
| echo "Bumping ${CURRENT} -> ${NEXT} (${{ inputs.bump }})" | |
| - name: Verify changelog entry | |
| env: | |
| RELEASE_VERSION: v${{ steps.version.outputs.version }} | |
| run: | | |
| if ! grep -q "## \[${RELEASE_VERSION}\]" CHANGELOG.md; then | |
| echo "::error::CHANGELOG.md has no entry for ${RELEASE_VERSION} -- add one before releasing" | |
| exit 1 | |
| fi | |
| echo "Found changelog entry for ${RELEASE_VERSION}" | |
| - name: Validate release configuration | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| version: "v2.17.1" | |
| args: check | |
| - name: Generate contributor notes | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "") | |
| NEW_TAG="v${{ steps.version.outputs.version }}" | |
| # Generate release contributor notes | |
| # Use HEAD instead of $NEW_TAG because the tag hasn't been created yet | |
| if [ -n "$PREV_TAG" ]; then | |
| go run ./cmd/contributors/ --release "$PREV_TAG" HEAD > contrib-notes.md | |
| else | |
| go run ./cmd/contributors/ --release "" HEAD > contrib-notes.md | |
| fi | |
| # Update CONTRIBUTORS.md with all-time contributors | |
| go run ./cmd/contributors/ --all | |
| # Commit updated CONTRIBUTORS.md if changed — open a PR instead of pushing directly to main | |
| if ! git diff --quiet CONTRIBUTORS.md; then | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| CONTRIB_BRANCH="auto/contributors-${NEW_TAG}" | |
| git checkout -b "$CONTRIB_BRANCH" | |
| git add CONTRIBUTORS.md | |
| git commit -m "docs: update CONTRIBUTORS.md for $NEW_TAG" | |
| git push origin "$CONTRIB_BRANCH" --force | |
| gh pr create \ | |
| --base main \ | |
| --head "$CONTRIB_BRANCH" \ | |
| --title "docs: update CONTRIBUTORS.md for $NEW_TAG" \ | |
| --body "Auto-generated contributor update for release $NEW_TAG." || echo "::warning::Could not create contributor PR — merge the branch manually" | |
| git checkout main | |
| fi | |
| # Move contrib-notes to temp dir so GoReleaser sees a clean git state | |
| mv contrib-notes.md "$RUNNER_TEMP/contrib-notes.md" 2>/dev/null || true | |
| - name: Create and push tag | |
| run: | | |
| TAG="v${{ steps.version.outputs.version }}" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| if git rev-parse "$TAG" >/dev/null 2>&1; then | |
| if [ "$(git rev-list -n 1 "$TAG")" != "$(git rev-parse HEAD)" ]; then | |
| echo "::error::Existing retry tag $TAG does not point to HEAD" | |
| exit 1 | |
| fi | |
| echo "Reusing unpublished retry tag $TAG" | |
| else | |
| git tag -a "$TAG" -m "$TAG" | |
| fi | |
| git push origin "$TAG" | |
| - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| version: "v2.17.1" | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Add contributor notes to release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| TAG="v${{ steps.version.outputs.version }}" | |
| if [ -f "$RUNNER_TEMP/contrib-notes.md" ] && [ -s "$RUNNER_TEMP/contrib-notes.md" ]; then | |
| # Get current release body | |
| CURRENT_BODY=$(gh release view "$TAG" --json body --jq '.body') | |
| # Append contributor notes via stdin to avoid ARG_MAX limits (CWE-400) | |
| { | |
| printf '%s\n\n' "$CURRENT_BODY" | |
| cat "$RUNNER_TEMP/contrib-notes.md" | |
| } | gh release edit "$TAG" --notes-file - | |
| fi | |
| pages: | |
| needs: release | |
| uses: ./.github/workflows/pages.yml | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write |