ci: create release branch with the App token to bypass the merge queu… #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'release/v*' | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| required: true | |
| description: 'Release version without the "v" prefix (e.g., 0.51.0)' | |
| type: string | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-2404-2core | |
| if: ${{ !startsWith(github.event.head_commit.message, 'release:') && !github.event.inputs.version }} | |
| steps: | |
| # GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the release PR | |
| # would not run CI — generate a GitHub App installation token instead. | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Release Please | |
| id: release | |
| uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| target-branch: ${{ github.ref_name }} | |
| manual-release-please: | |
| runs-on: ubuntu-2404-2core | |
| if: ${{ github.event.inputs.version }} | |
| steps: | |
| # GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the release PR | |
| # would not run CI — generate a GitHub App installation token instead. | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Install Release Please CLI | |
| run: npm install release-please -g | |
| - name: Release Please | |
| env: | |
| RELEASE_VERSION: ${{ github.event.inputs.version }} | |
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| release-please release-pr --repo-url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \ | |
| --token="$APP_TOKEN" \ | |
| --release-as="$RELEASE_VERSION" \ | |
| --target-branch="$GITHUB_REF_NAME" | |
| release-tag: | |
| runs-on: ubuntu-2404-2core | |
| # Skip the branch-creation push (created == true) to avoid re-running on the duplicate tag. | |
| if: ${{ startsWith(github.event.head_commit.message, 'release:') && !github.event.created }} | |
| steps: | |
| # Since skip-github-release is specified, the outputs of googleapis/release-please-action cannot be used. | |
| # Therefore, we need to parse the version ourselves. | |
| - name: Extract version and PR number from commit message | |
| id: extract_info | |
| shell: bash | |
| env: | |
| COMMIT_MESSAGE: ${{ github.event.head_commit.message }} | |
| run: | | |
| # Take only the first line to avoid git trailers (e.g. Co-authored-by) breaking $GITHUB_OUTPUT | |
| FIRST_LINE=${COMMIT_MESSAGE%%$'\n'*} | |
| echo "version=$( echo "$FIRST_LINE" | sed 's/^release: v\([0-9]\+\.[0-9]\+\.[0-9]\+\).*$/\1/' )" >> $GITHUB_OUTPUT | |
| echo "pr_number=$( echo "$FIRST_LINE" | sed 's/.*(\#\([0-9]\+\)).*$/\1/' )" >> $GITHUB_OUTPUT | |
| echo "release_branch=release/v$( echo "$FIRST_LINE" | sed 's/^release: v\([0-9]\+\.[0-9]\+\).*$/\1/' )" >> $GITHUB_OUTPUT | |
| # GITHUB_TOKEN cannot trigger the release workflow on the created tag — | |
| # generate a GitHub App installation token instead. | |
| - name: Generate token | |
| id: app-token | |
| if: ${{ steps.extract_info.outputs.version }} | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| - name: Tag release | |
| if: ${{ steps.extract_info.outputs.version }} | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| VERSION: ${{ steps.extract_info.outputs.version }} | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} # To trigger another workflow | |
| script: | | |
| await github.rest.git.createRef({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| ref: `refs/tags/v${process.env.VERSION}`, | |
| sha: context.sha | |
| }); | |
| # When v0.50.0 is released, a release branch "release/v0.50" is created. | |
| - name: Create release branch for patch versions | |
| if: ${{ endsWith(steps.extract_info.outputs.version, '.0') }} | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| RELEASE_BRANCH: ${{ steps.extract_info.outputs.release_branch }} | |
| with: | |
| # GITHUB_TOKEN cannot be a ruleset bypass actor; use the App token to bypass the merge queue rule. | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const releaseBranch = process.env.RELEASE_BRANCH; | |
| await github.rest.git.createRef({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| ref: `refs/heads/${releaseBranch}`, | |
| sha: context.sha | |
| }); | |
| # Since skip-github-release is specified, googleapis/release-please-action doesn't delete the label from PR. | |
| # This label prevents the subsequent PRs from being created. Therefore, we need to delete it ourselves. | |
| # cf. https://github.com/googleapis/release-please?tab=readme-ov-file#release-please-bot-does-not-create-a-release-pr-why | |
| - name: Remove the label from PR | |
| if: ${{ steps.extract_info.outputs.pr_number }} | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| PR_NUMBER: ${{ steps.extract_info.outputs.pr_number }} | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const prNumber = parseInt(process.env.PR_NUMBER, 10); | |
| github.rest.issues.removeLabel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| name: 'autorelease: pending' | |
| }); |