chore(deps): bump tempo dependencies to 8376f6c #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Validate and Tag Release | |
| permissions: {} | |
| 'on': | |
| pull_request: | |
| branches: [master] | |
| types: [opened, synchronize, reopened, edited] | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] closed merges only; trusted code validates the exact merge tree | |
| branches: [master] | |
| types: [closed] | |
| concurrency: | |
| group: tag-release-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| validate: | |
| name: Validate release | |
| if: >- | |
| (github.event_name == 'pull_request' || github.event.pull_request.merged == true) && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| github.event.pull_request.head.ref == 'release/version' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout trusted release code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| path: trusted | |
| persist-credentials: false | |
| sparse-checkout: | | |
| .github/scripts/create-tag.js | |
| .github/scripts/prepare-stable-release.py | |
| sparse-checkout-cone-mode: false | |
| - name: Recognize release version pull request | |
| id: release | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| RELEASE_APP_BOT_ID: ${{ vars.FOUNDRY_RELEASE_APP_BOT_ID }} | |
| with: | |
| script: | | |
| const pr = context.payload.pull_request; | |
| const repository = `${context.repo.owner}/${context.repo.repo}`; | |
| if (!process.env.RELEASE_APP_BOT_ID) { | |
| throw new Error('FOUNDRY_RELEASE_APP_BOT_ID is not configured'); | |
| } | |
| if (pr.user?.type !== 'Bot' || String(pr.user.id) !== process.env.RELEASE_APP_BOT_ID) { | |
| throw new Error('Release version pull request was not created by the release App'); | |
| } | |
| if (pr.base.ref !== 'master' || pr.base.repo.full_name !== repository) { | |
| throw new Error('Release version pull request does not target this repository master'); | |
| } | |
| if (pr.head.ref !== 'release/version' || pr.head.repo.full_name !== repository) { | |
| throw new Error('Release version pull request did not use the release/version branch'); | |
| } | |
| const marker = '<!-- foundry-release-version-pr -->'; | |
| const metadata = new RegExp( | |
| `${marker}\\nPrepares an exact Foundry release transition\\.\\n\\n` + | |
| '- Operation: `(stable|start|advance|promote)`\\n' + | |
| '- Base branch: `master`\\n' + | |
| '- Source master SHA: `([0-9a-f]{40})`\\n' + | |
| '- Source tag: `(v[^`]+)`\\n' + | |
| '- Target version: `([^`]+)`\\n' + | |
| '- Target tag: `(v[^`]+)`\\n' + | |
| '- Changelog fragments: (\\d+)\\n' + | |
| '- Workspace packages: (\\d+)\\n?$', | |
| ).exec(pr.body || ''); | |
| if (!metadata) throw new Error('Release version pull request metadata is malformed'); | |
| if (metadata[5] !== `v${metadata[4]}`) { | |
| throw new Error('Release version pull request tag does not match its version'); | |
| } | |
| if (pr.title !== `chore: prepare ${metadata[5]}`) { | |
| throw new Error('Release version pull request title does not match its tag'); | |
| } | |
| if ((metadata[1] === 'promote') !== (Number(metadata[6]) === 0)) { | |
| throw new Error('Release version pull request has invalid fragment semantics'); | |
| } | |
| if (context.eventName === 'pull_request') { | |
| const master = await github.rest.repos.getCommit({ ...context.repo, ref: 'master' }); | |
| if (metadata[2] !== pr.base.sha || metadata[2] !== master.data.sha) { | |
| throw new Error('Release version pull request was prepared from a stale master commit'); | |
| } | |
| } | |
| const sha = context.eventName === 'pull_request' ? context.sha : pr.merge_commit_sha; | |
| if (!/^[0-9a-f]{40}$/i.test(sha || '')) { | |
| throw new Error('Release version pull request has no exact validation commit'); | |
| } | |
| core.setOutput('operation', metadata[1]); | |
| core.setOutput('source_sha', metadata[2]); | |
| core.setOutput('source_tag', metadata[3]); | |
| core.setOutput('version', metadata[4]); | |
| core.setOutput('tag', metadata[5]); | |
| core.setOutput('fragment_count', metadata[6]); | |
| core.setOutput('package_count', metadata[7]); | |
| core.setOutput('sha', sha); | |
| - name: Checkout exact release tree | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ steps.release.outputs.sha }} | |
| path: release | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify test merge parents | |
| if: github.event_name == 'pull_request' | |
| env: | |
| SHA: ${{ steps.release.outputs.sha }} | |
| SOURCE_SHA: ${{ steps.release.outputs.source_sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| parents=$(git -C release show --no-patch --format='%P' "$SHA") | |
| if [[ "$parents" != "$SOURCE_SHA $HEAD_SHA" ]]; then | |
| echo "test merge parents do not match the prepared master and PR head" >&2 | |
| exit 1 | |
| fi | |
| - name: Validate exact release tree | |
| run: | | |
| python3 trusted/.github/scripts/prepare-stable-release.py \ | |
| --validate-merged \ | |
| --root release \ | |
| --operation "$OPERATION" \ | |
| --expected-sha "$MERGE_SHA" \ | |
| --expected-source-sha "$SOURCE_SHA" \ | |
| --expected-source-tag "$SOURCE_TAG" \ | |
| --expected-version "$EXPECTED_VERSION" \ | |
| --expected-tag "$EXPECTED_TAG" \ | |
| --expected-fragment-count "$EXPECTED_FRAGMENT_COUNT" \ | |
| --expected-package-count "$EXPECTED_PACKAGE_COUNT" | |
| env: | |
| OPERATION: ${{ steps.release.outputs.operation }} | |
| MERGE_SHA: ${{ steps.release.outputs.sha }} | |
| SOURCE_SHA: ${{ steps.release.outputs.source_sha }} | |
| SOURCE_TAG: ${{ steps.release.outputs.source_tag }} | |
| EXPECTED_VERSION: ${{ steps.release.outputs.version }} | |
| EXPECTED_TAG: ${{ steps.release.outputs.tag }} | |
| EXPECTED_FRAGMENT_COUNT: ${{ steps.release.outputs.fragment_count }} | |
| EXPECTED_PACKAGE_COUNT: ${{ steps.release.outputs.package_count }} | |
| - name: Create repository-scoped App token | |
| id: app-token | |
| if: github.event_name == 'pull_request_target' && github.event.pull_request.merged == true | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ vars.FOUNDRY_RELEASE_APP_ID }} | |
| private-key: ${{ secrets.FOUNDRY_RELEASE_APP_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| permission-contents: write | |
| - name: Create exact release tag | |
| if: github.event_name == 'pull_request_target' && github.event.pull_request.merged == true | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| TAG_NAME: ${{ steps.release.outputs.tag }} | |
| MERGE_SHA: ${{ steps.release.outputs.sha }} | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const createTag = require('./trusted/.github/scripts/create-tag.js'); | |
| await createTag({ github, context }, process.env.TAG_NAME, process.env.MERGE_SHA); |