[full-ci] Release 8.1.0 (#12498) #74
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| version_override: | |
| description: 'Version (required, e.g. 8.1.0-rc.3)' | |
| type: string | |
| required: true | |
| env: | |
| PRODUCTION_RELEASE_TAGS: '5.0,7,8' | |
| DOCKER_REPO_ROLLING: owncloud/ocis-rolling | |
| DOCKER_REPO_PRODUCTION: owncloud/ocis | |
| NODE_VERSION: '24' | |
| PNPM_VERSION: '10.28.1' | |
| jobs: | |
| determine-release-type: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.info.outputs.version }} | |
| is_production: ${{ steps.info.outputs.is_production }} | |
| is_prerelease: ${{ steps.info.outputs.is_prerelease }} | |
| docker_repos: ${{ steps.info.outputs.docker_repos }} | |
| steps: | |
| - id: info | |
| run: | | |
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| VERSION="${{ inputs.version_override }}" | |
| else | |
| VERSION="${GITHUB_REF#refs/tags/v}" | |
| fi | |
| IS_PRODUCTION=false | |
| for TAG in ${PRODUCTION_RELEASE_TAGS//,/ }; do | |
| [[ "$VERSION" == "$TAG"* ]] && IS_PRODUCTION=true && break | |
| done | |
| [[ "$VERSION" == *"-"* ]] && IS_PRERELEASE=true || IS_PRERELEASE=false | |
| if [[ "$IS_PRODUCTION" == "true" && "$IS_PRERELEASE" == "false" ]]; then | |
| REPOS=[\"$DOCKER_REPO_ROLLING\",\"$DOCKER_REPO_PRODUCTION\"] | |
| else | |
| REPOS=[\"$DOCKER_REPO_ROLLING\"] | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "is_production=$IS_PRODUCTION" >> $GITHUB_OUTPUT | |
| echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT | |
| echo "docker_repos=$REPOS" >> $GITHUB_OUTPUT | |
| generate-code: | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - run: npm install --silent -g yarn npx --force | |
| - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - run: pnpm config set store-dir ./.pnpm-store && make ci-node-generate | |
| env: | |
| CHROMEDRIVER_SKIP_DOWNLOAD: 'true' | |
| - run: make ci-go-generate | |
| env: | |
| BUF_TOKEN: ${{ secrets.BUF_API_TOKEN }} | |
| - name: bump LatestTag | |
| run: | | |
| VERSION="${{ needs.determine-release-type.outputs.version }}" | |
| sed -i "s/LatestTag = \".*\"/LatestTag = \"$VERSION\"/" ocis-pkg/version/version.go | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: generated-code | |
| path: | | |
| . | |
| !.git | |
| retention-days: 1 | |
| docker-build: | |
| if: false | |
| name: docker-build (${{ matrix.arch }}, ${{ matrix.repo }}) | |
| runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }} | |
| needs: [determine-release-type, generate-code, security-scan-trivy] | |
| strategy: | |
| matrix: | |
| arch: [amd64, arm64] | |
| repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generated-code | |
| path: . | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ vars.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - id: goversion | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: | | |
| ALPINE_VERSION=$(grep '^FROM.*alpine:' ocis/docker/Dockerfile.linux.${{ matrix.arch }} | grep -o 'alpine:[0-9.]*' | cut -d: -f2 | cut -d. -f1,2) | |
| docker run --rm \ | |
| -v "${{ github.workspace }}:/workspace" \ | |
| -w /workspace \ | |
| "golang:${{ steps.goversion.outputs.go-version }}-alpine${ALPINE_VERSION}" \ | |
| sh -c "apk add --no-cache bash gcc musl-dev vips-dev make git && \ | |
| git config --global --add safe.directory /workspace && \ | |
| CGO_ENABLED=1 ENABLE_VIPS=true VERSION=${{ needs.determine-release-type.outputs.version }} \ | |
| make -C ocis release-linux-docker-${{ matrix.arch }}" | |
| - id: tags | |
| run: | | |
| VERSION="${{ needs.determine-release-type.outputs.version }}" | |
| REPO="${{ matrix.repo }}" | |
| ARCH="${{ matrix.arch }}" | |
| printf "tags<<EOF\n%s\nEOF\n" \ | |
| "${REPO}:${VERSION}-linux-${ARCH}" >> $GITHUB_OUTPUT | |
| - id: build | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: ocis | |
| file: ocis/docker/Dockerfile.linux.${{ matrix.arch }} | |
| platforms: linux/${{ matrix.arch }} | |
| load: true | |
| push: false | |
| provenance: false | |
| build-args: | | |
| REVISION=${{ github.sha }} | |
| VERSION=${{ needs.determine-release-type.outputs.version }} | |
| tags: ${{ steps.tags.outputs.tags }} | |
| - id: trivy | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| continue-on-error: true | |
| with: | |
| image-ref: ${{ steps.tags.outputs.tags }} | |
| format: table | |
| exit-code: 1 | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| skip-files: /usr/bin/gomplate,/usr/bin/wait-for | |
| hide-progress: true | |
| env: | |
| TRIVY_IGNOREFILE: .trivyignore | |
| - name: Block on vulnerabilities | |
| if: steps.trivy.outcome == 'failure' | |
| run: | | |
| echo "::error title=Security scan blocked release::Image ${{ steps.tags.outputs.tags }} has HIGH or CRITICAL vulnerabilities (see Trivy report above). Fix all findings before releasing." | |
| exit 1 | |
| - name: push | |
| if: steps.trivy.outcome == 'success' | |
| run: docker push ${{ steps.tags.outputs.tags }} | |
| docker-scan: | |
| name: docker-scan (${{ matrix.arch }}, ${{ matrix.repo }}) | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, docker-build] | |
| strategy: | |
| matrix: | |
| arch: [amd64] | |
| repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| id: trivy | |
| continue-on-error: true | |
| with: | |
| image-ref: ${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-${{ matrix.arch }} | |
| format: table | |
| exit-code: 1 | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| skip-files: /usr/bin/gomplate,/usr/bin/wait-for | |
| hide-progress: true | |
| env: | |
| TRIVY_IGNOREFILE: .trivyignore | |
| - name: Block on vulnerabilities | |
| if: steps.trivy.outcome == 'failure' | |
| run: | | |
| echo "::error title=Security scan blocked release::Image ${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-${{ matrix.arch }} has HIGH or CRITICAL vulnerabilities (see Trivy report above). Fix all findings before releasing." | |
| exit 1 | |
| docker-manifest: | |
| if: false | |
| name: docker-manifest (${{ matrix.repo }}) | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, docker-build, docker-scan] | |
| strategy: | |
| matrix: | |
| repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }} | |
| steps: | |
| - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ vars.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - if: ${{ contains(matrix.repo, 'rolling') }} | |
| run: | | |
| docker buildx imagetools create \ | |
| -t "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}" \ | |
| "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-amd64" \ | |
| "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-arm64" | |
| - if: ${{ !contains(matrix.repo, 'rolling') }} | |
| run: | | |
| docker buildx imagetools create \ | |
| -t "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}" \ | |
| "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-amd64" \ | |
| "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-arm64" | |
| docker-readme: | |
| if: false | |
| name: docker-readme (${{ matrix.repo }}) | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, docker-manifest] | |
| strategy: | |
| matrix: | |
| repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 | |
| with: | |
| username: ${{ vars.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| repository: ${{ matrix.repo }} | |
| readme-filepath: ocis/README.md | |
| build-binaries: | |
| name: build-binaries (${{ matrix.os }}) | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, generate-code] | |
| strategy: | |
| matrix: | |
| os: [linux, darwin] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generated-code | |
| path: . | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: | | |
| make -C ocis release-${{ matrix.os }} OUTPUT=${{ needs.determine-release-type.outputs.version }} | |
| make -C ocis release-finish | |
| if [[ "${{ matrix.os }}" == "linux" ]]; then | |
| cp assets/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf ocis/dist/release/ | |
| fi | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: binaries-${{ matrix.os }} | |
| path: ocis/dist/release/* | |
| retention-days: 1 | |
| security-scan-trivy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| format: table | |
| exit-code: 1 | |
| severity: CRITICAL,HIGH | |
| trivy-config: .trivy.yaml | |
| license-check: | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, generate-code] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generated-code | |
| path: . | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: npm install --silent -g yarn npx "pnpm@$PNPM_VERSION" --force | |
| - run: make ci-node-check-licenses && make ci-node-save-licenses | |
| - run: make ci-go-check-licenses && make ci-go-save-licenses | |
| - run: tar -czf third-party-licenses.tar.gz -C third-party-licenses . | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: third-party-licenses | |
| path: third-party-licenses.tar.gz | |
| retention-days: 1 | |
| generate-changelog: | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: | | |
| VERSION="${{ needs.determine-release-type.outputs.version }}" | |
| # For prereleases (e.g. 8.1.0-rc.2), pass the full version so calens finds | |
| # changelog/8.1.0-rc.2_*/ rather than falling through to the missing 8.1.0_*/ dir. | |
| if [[ "$VERSION" == *-* ]]; then | |
| CHANGELOG_VERSION="$VERSION" | |
| else | |
| CHANGELOG_VERSION=$(echo "$VERSION" | cut -d'-' -f1) | |
| fi | |
| make changelog CHANGELOG_VERSION="$CHANGELOG_VERSION" | |
| # calens produces empty output when no versioned changelog directory exists (e.g. dev builds). | |
| # Fall back to a pointer to the unreleased entries. | |
| if [[ $(wc -l < ocis/dist/CHANGELOG.md) -lt 5 ]]; then | |
| echo "Development release — no release notes yet. See [unreleased changes](https://github.com/owncloud/ocis/tree/master/changelog/unreleased/)." > ocis/dist/CHANGELOG.md | |
| fi | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: changelog | |
| path: ocis/dist/CHANGELOG.md | |
| retention-days: 1 | |
| create-github-release: | |
| runs-on: ubuntu-latest | |
| needs: [determine-release-type, build-binaries, license-check, generate-changelog, security-scan-trivy] | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: binaries-linux | |
| path: release-assets | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: binaries-darwin | |
| path: release-assets | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: third-party-licenses | |
| path: release-assets | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: changelog | |
| path: . | |
| - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 | |
| with: | |
| tag_name: v${{ needs.determine-release-type.outputs.version }} | |
| name: v${{ needs.determine-release-type.outputs.version }} | |
| body_path: CHANGELOG.md | |
| prerelease: ${{ needs.determine-release-type.outputs.is_prerelease == 'true' }} | |
| files: release-assets/* | |
| audit-release: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - determine-release-type | |
| - generate-code | |
| - build-binaries | |
| - security-scan-trivy | |
| - license-check | |
| - generate-changelog | |
| - create-github-release | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: binaries-linux | |
| path: release-assets | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: binaries-darwin | |
| path: release-assets | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: third-party-licenses | |
| path: release-assets | |
| - run: | | |
| python3 scripts/audit-release.py \ | |
| --version "${{ needs.determine-release-type.outputs.version }}" \ | |
| --dir release-assets/ \ | |
| --github-release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |