Skip to content

Commit 16ca91c

Browse files
raboofraboof
authored
ci: stage release candidate sources and jars (#2314)
* ci: stage release candidate source archive Needs Infra to configure these secrets before merging. * chore: use 'git archive' to create source archive I see some issues with reproducibility (the tar is identical but the gzip stream differs), but those can be solved independently. * fix: use reproducible gzip compression in 'git archive' * fix: version tags start with 'v' * ci: stage jars This probably needs some iterations to get it just right, but I don't see a good way to do that other than by actually merging and triggering the workflow against (fake, non-version) RC tags. * Add sonatype commands * Version tags start with 'v' * fix: set the version for sonatypeBundleUpload not sure sonatypePrepare is really necessary, it seems implicit, but let's stick to what's recommended in https://github.com/xerial/sbt-sonatype?tab=readme-ov-file#publishing-your-artifact * chore: don't require a leading 'v' for now so we can test the workflow with unprotected tags * ci: the key is not base64-encoded
1 parent 524f82b commit 16ca91c

File tree

1 file changed

+159
-0
lines changed

1 file changed

+159
-0
lines changed

‎.github/workflows/stage-release-candidate.yml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
name: Stage release candidate
19+
20+
on:
21+
workflow_dispatch:
22+
inputs:
23+
source-tar:
24+
description: "Stage the source tarball to svn"
25+
default: true
26+
type: boolean
27+
jars:
28+
description: "Stage the binary jars to nexus"
29+
default: true
30+
type: boolean
31+
32+
permissions:
33+
contents: read
34+
35+
jobs:
36+
# Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate
37+
# Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml
38+
stage-release-candidate-to-svn:
39+
runs-on: ubuntu-24.04
40+
if: ${{ inputs.source-tar }}
41+
steps:
42+
- name: Check version parameter
43+
run: |-
44+
# To be enabled after this workflow has been tested:
45+
#if [[ "$REF" != "v"* ]]; then
46+
# echo "Trigger this workflow on a version tag"
47+
# exit 1
48+
#fi
49+
if [[ "$REF" != *"-RC"* ]]; then
50+
echo "Trigger this workflow on an RC tag"
51+
exit 1
52+
fi
53+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
54+
export RC_VERSION=$(echo $REF | tail -c +2)
55+
echo "Version: $VERSION"
56+
echo "RC Version: $RC_VERSION"
57+
env:
58+
REF: ${{ github.ref_name }}
59+
60+
- name: Checkout
61+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
62+
with:
63+
fetch-depth: 0
64+
fetch-tags: true
65+
persist-credentials: false
66+
67+
- name: Generate source archive
68+
run: |-
69+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
70+
PREFIX=apache-pekko-$VERSION
71+
DATE=$(git log -n1 --format=%cs | tr -d -)
72+
TARBALL=$PREFIX-src-$DATE.tgz
73+
74+
mkdir archive
75+
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL
76+
cd archive
77+
sha512sum $TARBALL > $TARBALL.sha512
78+
env:
79+
REF: ${{ github.ref_name }}
80+
81+
- name: Sign source archive
82+
run: |-
83+
echo $PEKKO_GPG_SECRET_KEY | gpg --batch --import --import-options import-show
84+
gpg -ab archive/*.tgz
85+
env:
86+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
87+
88+
- name: Upload source dist
89+
run: |-
90+
svn checkout https://dist.apache.org/repos/dist/dev/pekko dist
91+
cd dist
92+
93+
export RC_VERSION=$(echo $REF | tail -c +2)
94+
95+
mkdir $RC_VERSION
96+
cp ../archive/* $RC_VERSION
97+
svn add $RC_VERSION $RC_VERSION/*
98+
svn commit --username $PEKKO_SVN_DEV_USERNAME --password $PEKKO_SVN_DEV_PASSWORD --message "Stage Pekko $RC_VERSION" $RC_VERSION
99+
env:
100+
PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }}
101+
PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }}
102+
REF: ${{ github.ref_name }}
103+
104+
stage-jars-to-nexus:
105+
runs-on: ubuntu-24.04
106+
if: ${{ inputs.source-tar }}
107+
steps:
108+
- name: Check version parameter
109+
run: |-
110+
# To be enabled after this workflow has been tested:
111+
#if [[ "$REF" != "v"* ]]; then
112+
# echo "Trigger this workflow on a version tag"
113+
# exit 1
114+
#fi
115+
if [[ "$REF" != *"-RC"* ]]; then
116+
echo "Trigger this workflow on an RC tag"
117+
exit 1
118+
fi
119+
export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/")
120+
export RC_VERSION=$(echo $REF | tail -c +2)
121+
echo "Version: $VERSION"
122+
echo "RC Version: $RC_VERSION"
123+
env:
124+
REF: ${{ github.ref_name }}
125+
126+
- name: Checkout
127+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
128+
with:
129+
fetch-depth: 0
130+
fetch-tags: true
131+
persist-credentials: false
132+
133+
- name: Setup Java 17
134+
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
135+
with:
136+
distribution: temurin
137+
java-version: 17
138+
139+
- name: Install sbt
140+
uses: sbt/setup-sbt@17575ea4e18dd928fe5968dbe32294b97923d65b # v1.1.13
141+
142+
# We intentionally do not use the Coursier cache for release candiates,
143+
# to reduce attack surface
144+
145+
# It would be better to split this into 3 steps, where only the first
146+
# uses sbt and the signing/staging are done with well-known tools
147+
# reducing attack surface, but this seems to be the state of the art:
148+
- name: Build, sign and stage artifacts
149+
run: |-
150+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
151+
PGP_PASSPHRASE=
152+
153+
sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned"
154+
sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose"
155+
env:
156+
REF: ${{ github.ref_name }}
157+
PGP_SECRET: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
158+
SONATYPE_USERNAME: ${{ secrets.NEXUS_USER }}
159+
SONATYPE_PASSWORD: ${{ secrets.NEXUS_PW }}

0 commit comments

Comments
 (0)