Release #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| release_type: | |
| description: Release type | |
| required: true | |
| type: choice | |
| options: | |
| - prep | |
| - rc | |
| - stable | |
| version: | |
| description: "Version number (e.g. 0.11.0)" | |
| required: true | |
| type: string | |
| rc_number: | |
| description: "RC number (e.g. 1) — required for RC releases, must be empty for prep" | |
| required: false | |
| type: string | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: release | |
| steps: | |
| - name: Restrict to release managers | |
| if: github.actor != 'yyyyyyyan' && github.actor != 'maxbube' | |
| run: | | |
| echo "::error::Only release managers (yyyyyyyan, maxbube) can trigger this workflow." | |
| exit 1 | |
| - name: Validate inputs | |
| env: | |
| RELEASE_TYPE: ${{ inputs.release_type }} | |
| VERSION: ${{ inputs.version }} | |
| RC_NUMBER: ${{ inputs.rc_number }} | |
| run: | | |
| if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::version must match X.Y.Z (e.g. 0.11.0)" | |
| exit 1 | |
| fi | |
| if [ "$RELEASE_TYPE" = "rc" ]; then | |
| if [ -z "$RC_NUMBER" ]; then | |
| echo "::error::rc_number is required when release_type is 'rc'" | |
| exit 1 | |
| fi | |
| if ! [[ "$RC_NUMBER" =~ ^[1-9][0-9]*$ ]]; then | |
| echo "::error::rc_number must be a positive integer" | |
| exit 1 | |
| fi | |
| fi | |
| if [ "$RELEASE_TYPE" = "prep" ] && [ -n "$RC_NUMBER" ]; then | |
| echo "::error::rc_number must be empty when release_type is 'prep'" | |
| exit 1 | |
| fi | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ inputs.release_type == 'stable' && format('release/v{0}', inputs.version) || 'main' }} | |
| fetch-depth: 0 | |
| token: ${{ secrets.RELEASE_PAT }} | |
| - name: Configure git user | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Run release | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PAT }} | |
| GH_PR_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_TYPE: ${{ inputs.release_type }} | |
| VERSION: ${{ inputs.version }} | |
| RC_NUMBER: ${{ inputs.rc_number }} | |
| JIRA_VERSION_CREATE_WEBHOOK_URL: ${{ secrets.JIRA_VERSION_CREATE_WEBHOOK_URL }} | |
| JIRA_VERSION_CREATE_WEBHOOK_SECRET: ${{ secrets.JIRA_VERSION_CREATE_WEBHOOK_SECRET }} | |
| JIRA_VERSION_RELEASE_WEBHOOK_URL: ${{ secrets.JIRA_VERSION_RELEASE_WEBHOOK_URL }} | |
| JIRA_VERSION_RELEASE_WEBHOOK_SECRET: ${{ secrets.JIRA_VERSION_RELEASE_WEBHOOK_SECRET }} | |
| run: | | |
| if [ "$RELEASE_TYPE" = "rc" ]; then | |
| make release-rc VERSION="$VERSION" RC="$RC_NUMBER" SIGN_VIA_API=1 | |
| elif [ "$RELEASE_TYPE" = "prep" ]; then | |
| make release-prep VERSION="$VERSION" SIGN_VIA_API=1 | |
| else | |
| make release-stable VERSION="$VERSION" SIGN_VIA_API=1 | |
| fi | |
| - name: Assert back-merge ancestor invariant | |
| if: ${{ inputs.release_type == 'stable' }} | |
| env: | |
| VERSION: ${{ inputs.version }} | |
| run: | | |
| set -euo pipefail | |
| git fetch origin main | |
| if ! git merge-base --is-ancestor "v${VERSION}" origin/main; then | |
| echo "::error::Post-release invariant failed: v${VERSION} is NOT an ancestor of origin/main. The back-merge in cmd_stable did not land. Investigate before re-running." | |
| exit 1 | |
| fi | |
| echo "OK: v${VERSION} is an ancestor of origin/main." |