Skip to content

Commit cad4f67

Browse files
laxa1986laxa1986
committed
docs: review with AI-5 [skip ci]
1 parent fb7de40 commit cad4f67

File tree

3 files changed

+27
-25
lines changed

3 files changed

+27
-25
lines changed

‎README.md‎

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ This is especially useful in microservices where the releases are _binary_ + _Ia
1010

1111
The action comes with an **ecosystem**:
1212
- Terraform modules to provide AWS roles and policies to [read](https://registry.terraform.io/modules/agilecustoms/ci-builder/aws/latest) and [publish](https://registry.terraform.io/modules/agilecustoms/ci-publisher/aws/latest) artifacts
13-
- (Fall 2025) Terraform module to create security-aware GitHub repo
14-
- (Fall 2025) GitHub action to access terraform modules from corporate private GH repos
1513
- GitHub actions to use in build workflows, e.g., [setup-maven-codeartifact](https://github.com/agilecustoms/setup-maven-codeartifact)
1614
- documentation and examples for all supported [artifact types](./docs/artifact-types/index.md)
1715
- [Authorization and Security](./docs/authorization.md) — how to make releases secure, including self-service (dev-releases)
@@ -31,13 +29,13 @@ The action comes with an **ecosystem**:
3129

3230
## Artifact types ⇔ features
3331

34-
| Artifact type | floating tags | idempotency | dev-release — auto cleanup |
35-
|---------------------------------------------------------------------------|---------------|-------------|----------------------------|
36-
| [git](./docs/artifact-types/git.md) | ✅ | ✅ | ✅ — ❌️ |
37-
| [AWS S3](./docs/artifact-types/aws-s3.md) | ✅ | ✅ | ✅ — ✅ |
38-
| [AWS ECR](./docs/artifact-types/aws-ecr.md) | ✅ | ✅ | ✅ — ✅ |
39-
| [AWS CodeArtifact maven](./docs/artifact-types/aws-codeartifact-maven.md) | ❌️ | ⚠️ | ❌️ |
40-
| [npmjs](./docs/artifact-types/npmjs.md) | ✅ | ⚠️ | ❌️ |
32+
| Artifact type | floating tags | idempotency | dev-release | auto cleanup |
33+
|---------------------------------------------------------------------------|---------------|-------------|-------------|--------------|
34+
| [git](./docs/artifact-types/git.md) | ✅ | ✅ | ✅ ️ | ✅ |
35+
| [AWS S3](./docs/artifact-types/aws-s3.md) | ✅ | ✅ | ✅ | ✅ |
36+
| [AWS ECR](./docs/artifact-types/aws-ecr.md) | ✅ | ✅ | ✅ | ✅ |
37+
| [AWS CodeArtifact maven](./docs/artifact-types/aws-codeartifact-maven.md) | ❌️ | ⚠️ | ❌️ | N/A |
38+
| [npmjs](./docs/artifact-types/npmjs.md) | ✅ | ⚠️ | ❌️ | N/A |
4139

4240
_See the respective artifact type to learn about idempotency limitations ⚠️_
4341

@@ -58,10 +56,10 @@ on:
5856
jobs:
5957
Release:
6058
runs-on: ubuntu-latest
61-
environment: release
59+
environment: release # has secret GH_TOKEN - a PAT with permission to bypass branch protection rule
6260
permissions:
63-
contents: read
64-
id-token: write
61+
contents: read # to checkout code
62+
id-token: write # to assume AWS role via OIDC
6563
steps:
6664
# (example) package AWS Lambda code as a zip archive in ./s3 directory
6765

@@ -79,7 +77,7 @@ jobs:
7977
Assume:
8078
- you store artifacts in AWS account "Dist" and its number is stored in GH org variable `AWS_ACCOUNT_DIST`
8179
- you have an S3 bucket `mycompany-dist` in `us-east-1` region
82-
- there is a role `ci/publisher` with permissions to upload files in this S3 bucket
80+
- there is a role `ci/publisher` with permissions to upload files in this S3 bucket and trust policy that allows to assume this role from GH action
8381
- you have repo `mycompany/myapp`
8482
- current release branch `main` has a protection rule so all changes must be done via PR
8583
- you have a GH environment `release` associated with branch `main`
@@ -93,7 +91,7 @@ Scenario:
9391
- build steps (omitted) produced a directory `./s3` with files (like a zip archive for AWS Lambda)
9492

9593
The action will:
96-
- generate a new version `v1.3.0`
94+
- generate a new version `v1.3.0` (minor bump based on commit message prefix `feat:`)
9795
- upload files from `./s3` directory to S3 bucket `mycompany-dist` at path `/myapp/v1.3.0/`
9896
- update `CHANGELOG.md` with release notes
9997
- push tags `v1.3.0`, `v1.3`, `v1` and `latest` to the remote repository
@@ -111,7 +109,7 @@ _There are no required inputs. The action only controls that the combination of
111109
| aws-codeartifact-maven | | If true, then publish maven artifacts to AWS CodeArtifact |
112110
| aws-ecr | | If true, then push docker image to AWS ECR, [example](./docs/artifact-types/aws-ecr.md) |
113111
| aws-region | | AWS region |
114-
| aws-role | | AWS IAM role to assume to publish, e.g., `/ci/publisher` |
112+
| aws-role | | AWS IAM role to assume to publish, e.g., `ci/publisher` |
115113
| aws-s3-bucket | | AWS S3 bucket to upload artifacts to |
116114
| aws-s3-dir | | Allows you to specify AWS S3 bucket directory to upload artifacts to. By default, just place in `bucket/{repo-name}/{version}/*` |
117115
| changelog-file | CHANGELOG.md | Changelog file path. Pass an empty string to disable changelog generation |
@@ -121,7 +119,7 @@ _There are no required inputs. The action only controls that the combination of
121119
| floating-tags | true | When next version to be released is `1.2.4`, then also release `1.2`, `1` and `latest`. Not desired for public terraform modules |
122120
| npm-extra-deps | | Additional npm dependencies needed to use non-default commit analyzer preset, e.g., `conventional-changelog-conventionalcommits@9.1.0`. Use white space or new line to specify multiple deps (extremely rare) |
123121
| npm-visibility | public | Used together with env variable `NPM_TOKEN` to publish npm package. Specifies package visibility: public or private (not tested yet). [Example](./docs/artifact-types/npmjs.md) |
124-
| node-version | 22 | Node.js version to publish npm packages. Default is 22 because it is the highest pre-cached in Ubuntu 24 |
122+
| node-version | 22 | Node.js version to publish npm packages. Default is 22 because it is the highest pre-cached in Ubuntu 24 (latest at time of writing) |
125123
| java-version | 21 | Java version to use with input `aws-codeartifact-maven`. [Example](./docs/artifact-types/aws-codeartifact-maven.md) |
126124
| pre-publish-script | | Custom sh script that allows you to update version in arbitrary file(s), not only files governed by build tool (pom.xml, package.json, etc.). In this script you can use variable `$version`. See example in [npmjs](./docs/artifact-types/npmjs.md) |
127125
| release-branches | (see description) | Semantic-release [branches](https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches), mainly used to support [maintenance releases](./docs/features/maintenance-release.md) and [prereleases](./docs/features/prerelease.md) |
@@ -141,10 +139,10 @@ _There are no required inputs. The action only controls that the combination of
141139

142140
## Environment variables
143141

144-
| Name | Description |
145-
|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
146-
| GH_TOKEN | Takes GH PAT with permission to bypass the branch protection rule. Required if `release-gh: true` (default). See details in [Authorization and Security](./docs/authorization.md) |
147-
| NPM_TOKEN | If specified, publish npm package in npmjs repo. See [details](./docs/artifact-types/npmjs.md) |
142+
| Name | Description |
143+
|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------|
144+
| GH_TOKEN | Takes GH PAT with permission to bypass the branch and tags protection rules. See details in [Authorization and Security](./docs/authorization.md) |
145+
| NPM_TOKEN | If specified, publish npm package in npmjs repo. See [details](./docs/artifact-types/npmjs.md) |
148146

149147
## Misc
150148

‎action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ inputs:
1212
description: 'AWS region'
1313
required: false
1414
aws-role:
15-
description: 'IAM role to assume to publish, e.g., `/ci/publisher`'
15+
description: 'IAM role to assume to publish, e.g., `ci/publisher`'
1616
required: false
1717
aws-codeartifact-domain:
1818
description: 'CodeArtifact domain name, e.g., `mycompany`'
@@ -57,7 +57,7 @@ inputs:
5757
required: false
5858
default: '21'
5959
node-version:
60-
description: 'Node.js version to publish npm packages, default is 22 because it is highest pre-cached in Ubuntu 24'
60+
description: 'Node.js version to publish npm packages, default is 22 because it is highest pre-cached in Ubuntu 24 (latest at time of writing)'
6161
required: false
6262
default: '22'
6363
npm-extra-deps:

‎docs/roadmap.md‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
# Roadmap
22

3-
Below is the list of potential future features:
3+
Fall 2025:
4+
- Terraform module to create security-aware GitHub repo
5+
- GitHub action to access terraform modules from corporate private GH repos
6+
- setup-maven-codeartifact support Maven 4
7+
- publish in Maven central
8+
- publish Python packages (pip and Twine) in CodeArtifact
49

10+
Potential future features (not prioritized):
511
- publish in AWS CodeArtifact. Every artifact type will require a corresponding GH action like [setup-maven-codeartifact](https://github.com/agilecustoms/setup-maven-codeartifact)
612
- npm (and Yarn) repository
7-
- pip (and Twine) repository
813
- Gradle repository
914
- publish in non-AWS repositories
1015
- private npmjs repository
11-
- Maven central
1216
- GitHub release
1317
- ability to specify a list of files to include release
1418
- integration between release and issues/PRs, ex: close issues fixed in a release, see [semantic-release/github](https://github.com/semantic-release/github)

0 commit comments

Comments
 (0)