Release #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tags a semver release from conventional commits once CI is green on main. | |
| # | |
| # For a Go module a tag *is* the release for library consumers — there is no | |
| # registry to publish to, so they can require a real version instead of a commit | |
| # pseudo-version. | |
| # | |
| # The tag is not inert, and this job does not do the publishing. Two workflows | |
| # watch `v*` and hang off the tag rather than off each other: | |
| # publish-image.yml builds the sandbox image | |
| # publish-daemon.yml builds and attaches the openbloxd binaries | |
| # That makes the token this job pushes with load bearing — see the note on it | |
| # below. It also means a tag cut without those workflows firing is a release that | |
| # ships nothing, which is how v0.3.0 came to have no assets. | |
| on: | |
| workflow_run: | |
| workflows: [CI] | |
| branches: [main] | |
| types: | |
| - completed | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| release: | |
| name: Create Release | |
| # workflow_run fires regardless of the triggering run's result. | |
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Read-only on purpose. Every write on this job goes through RELEASE_TOKEN, | |
| # and checkout runs with persist-credentials: false, so the built-in token | |
| # has no consumer left — granting it write would only widen what a | |
| # compromised third-party action could reach. | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Create Release | |
| uses: go-semantic-release/action@2e9dc4247a6004f8377781bef4cb9dad273a741f # v1.24.1 | |
| with: | |
| changelog-file: CHANGELOG.md | |
| allow-initial-development-versions: true | |
| prepend: true | |
| env: | |
| # A PAT, not the built-in GITHUB_TOKEN: GitHub refuses to start a | |
| # workflow for a ref pushed with GITHUB_TOKEN, so the tag this step | |
| # creates would never reach publish-image.yml's `tags: ['v*']` trigger | |
| # and every release would ship without its container image. | |
| # | |
| # RELEASE_TOKEN is a fine-grained PAT scoped to this repository with | |
| # Contents: write — enough to push the tag, commit the changelog, and | |
| # cut the release, and nothing else. It expires; when it does this job | |
| # fails outright rather than silently skipping the image. | |
| GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }} |