iac-building-blocks/.github/workflows/orchestrator-gh-release.yml at main · mathworks-ref-arch/iac-building-blocks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# Copyright 2026 The MathWorks, Inc.
name: 'Orchestrator: GitHub Release'

on:
  workflow_call:
    inputs:
      target_versions:
        description: |
          JSON array of MATLAB versions to include in this release.
          Typically passed from module-gh-get-versions output.
          Example: '["R2026a","R2025b","R2025a"]'
        required: true
        type: string
      s3_bucket_url:
        description: |
          Base URL of the S3 bucket where release templates are
          published for distribution.
          Example: "https://s3.amazonaws.com/matlab-on-aws-win"
        required: true
        type: string
      dual_repo_url:
        description: |
          URL of the other OS variant repository for the same product.
          Used to cross-link between Linux and Windows variants of the
          same reference architecture.
          Example: "https://github.com/mathworks-ref-arch/matlab-on-aws"
        required: true
        type: string
      artifacts_path:
        description: |
          Local path where build artifacts are downloaded and processed.
          Rarely needs overriding — change only if your workflow has
          conflicting path usage.
        type: string
        default: ./artifacts
      release_template_name_pattern:
        description: |
          Glob pattern to identify release template files among
          downloaded artifacts.
          Example: "*-release-template.json"
        type: string
        default: "*-release-template.json"
      release_files_pattern:
        description: |
          Glob pattern for files to include in the GitHub Release zip
          archives. Each version's matching files are zipped separately.
          Use "*" to include all artifacts.
        default: "*"
        type: string
      release_tag:
        description: |
          Git tag name for the GitHub Release. Must be unique across
          releases. Defaults to "Build-<run_number>" for automatic
          sequential naming.
          Example: "Build-42", "v2025a-release"
        default: "Build-${{ github.run_number }}"
        type: string
      release_title:
        description: |
          Display title for the GitHub Release page. Shown in the
          releases UI and notification emails.
          Example: "MATLAB on AWS Windows - Build 42"
        required: true
        type: string
      generate_attestations:
        description: |
          When true, generates SLSA provenance attestations for release
          artifacts. Requires the caller workflow to have
          `attestations: write` permission.
        default: true
        type: boolean
      is_supplementary_build:
        description: |
          When true, skips committing release files back to the repo.
          The GitHub Release is still created. Use for secondary builds
          where the primary pipeline owns the repo commit step.
        type: boolean
        default: false

jobs:

  commit-release-files:
    if: ${{ inputs.is_supplementary_build == false }}
    name: Commit release files into repository
    uses: mathworks-ref-arch/iac-building-blocks/.github/workflows/module-gh-commit-files.yml@main
    with:
      target_versions: ${{ inputs.target_versions }}
      s3_bucket_url: ${{ inputs.s3_bucket_url }}
      dual_repo_url: ${{ inputs.dual_repo_url }}
      artifacts_path: ${{ inputs.artifacts_path }}
      release_template_name_pattern: ${{ inputs.release_template_name_pattern }}
    secrets: inherit

  publish-release-artifacts:
    needs: [commit-release-files]
    if: ${{ !cancelled() && (needs.commit-release-files.result == 'success' || needs.commit-release-files.result == 'skipped') }}
    name: Create Aggregate GH Release
    uses: mathworks-ref-arch/iac-building-blocks/.github/workflows/module-gh-create-release.yml@main
    with:
      release_files_pattern: ${{ inputs.release_files_pattern }}
      release_tag: ${{ inputs.release_tag }}
      release_title: ${{ inputs.release_title }}
      prerelease: false
      generate_attestations: ${{ inputs.generate_attestations }}
    secrets: inherit