Date the 0.1.0 entry for the first public beta #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Cut a GitHub release from a version tag. | |
| # | |
| # Pushing a tag like v0.1.0 builds the extension with the full verification | |
| # chain (tests, finalize-dist, the packer's own manifest checks), refuses the | |
| # tag if it disagrees with package.json, generates SHA-256 checksums, attests | |
| # build provenance, and publishes a GitHub release whose notes are the | |
| # changelog entry for that version plus the install and update procedure from | |
| # docs/release.md, pasted in every time because users read release notes, not | |
| # docs folders. | |
| # | |
| # The release signing key (docs/release.md) is NOT involved: the pinned | |
| # extension ID comes from the public manifest key, and the private half stays | |
| # off CI by design. | |
| name: Release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| release: | |
| name: Build, attest, publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Test | |
| run: npm test | |
| # Build + package in one step, exactly what a maintainer runs locally. | |
| # The packer refuses a build without the pinned manifest key, with a | |
| # version that disagrees with package.json, or with | |
| # web_accessible_resources present. | |
| - name: Build and package | |
| run: npm run release | |
| - name: Verify the tag matches the packaged version | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| ZIP="release/kivuli-extension-v${VERSION}.zip" | |
| if [ ! -f "$ZIP" ]; then | |
| echo "Tag ${GITHUB_REF_NAME} does not match package.json: expected ${ZIP}" >&2 | |
| ls release >&2 || true | |
| exit 1 | |
| fi | |
| echo "VERSION=${VERSION}" >> "$GITHUB_ENV" | |
| echo "ZIP=${ZIP}" >> "$GITHUB_ENV" | |
| - name: Generate SHA-256 checksums | |
| run: | | |
| cd release | |
| sha256sum "kivuli-extension-v${VERSION}.zip" > SHA256SUMS.txt | |
| cat SHA256SUMS.txt | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-path: ${{ env.ZIP }} | |
| - name: Compose release notes | |
| run: | | |
| { | |
| echo "## Changes" | |
| echo | |
| awk -v ver="$VERSION" ' | |
| index($0, "## " ver) == 1 { grab = 1; next } | |
| grab && /^## / { exit } | |
| grab { print } | |
| ' CHANGELOG.md > /tmp/changelog-section.md | |
| if [ -s /tmp/changelog-section.md ]; then | |
| cat /tmp/changelog-section.md | |
| else | |
| echo "See CHANGELOG.md for this version." | |
| fi | |
| echo | |
| echo "## Verify the download" | |
| echo | |
| echo '```' | |
| cat release/SHA256SUMS.txt | |
| echo '```' | |
| echo | |
| echo "Build provenance is attested by GitHub. To verify:" | |
| echo '```sh' | |
| echo "gh attestation verify kivuli-extension-v${VERSION}.zip --repo ${GITHUB_REPOSITORY}" | |
| echo '```' | |
| echo | |
| # The install + update procedure, pasted from docs/release.md so | |
| # nobody has to find the docs folder to update safely. | |
| awk '/^## Users: installing/ { grab = 1 } grab { print }' docs/release.md | |
| } > /tmp/release-notes.md | |
| cat /tmp/release-notes.md | |
| - name: Publish the GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" \ | |
| "$ZIP" \ | |
| release/SHA256SUMS.txt \ | |
| --title "Kivuli extension ${GITHUB_REF_NAME}" \ | |
| --notes-file /tmp/release-notes.md \ | |
| --verify-tag |