ci: wait for all release jobs and upload debian packages to github release - #38
ci: wait for all release jobs and upload debian packages to github release#38esteve wants to merge 1 commit into
Conversation
|
@j-rivero can you have a look when you have a moment? I had to manually upload the Debian packages and the cargo-dist artifacts (https://github.com/ros2-rust/cargo-ament-build/releases/tag/v0.1.11) because release-plz had already created a GitHub release. These changes should solve that issue. The contents of the cargo-dist job are automatically generated by cargo-dist itself, but I'm not sure about the Debian packaging job. I changed it to a |
…lease Signed-off-by: Esteve Fernandez <esteve@apache.org>
9c27cb2 to
f77dbe3
Compare
j-rivero
left a comment
j-rivero
left a comment
There was a problem hiding this comment.
The PR is not trivial to review, many changes. Overall looks fine to me, can not detect a major problem on the behavior.
There is a good bunch of security warnings raised by zizmor that worth given it a run, I just highlighted the most notable ones to my eyes. https://docs.zizmor.sh/
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
|
|
||
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
v4 is going to be deprecated at some point in the near future, I think it is fine to use v6.
|
|
||
| name: Release | ||
| permissions: | ||
| "contents": "write" |
There was a problem hiding this comment.
This permission clause affects the whole file. Since permissions can be defined per-job worth checking which of them require to write in the contents and fine the clause there.
|
|
||
| custom-wait-for-release-draft: | ||
| uses: ./.github/workflows/wait-for-release-draft.yml | ||
| secrets: inherit |
There was a problem hiding this comment.
really need to inherit all the secrets? worth checking.
|
Scott asking me about providing the "source package" together with the usual .deb packages for the Debian repository. We can include in this PR the commit https://github.com/ros2-rust/cargo-ament-build/commit/4b191c1e2c39a655cf65561f3e93c92436c0c08e.patch . Tested here: https://github.com/j-rivero/cargo-ament-build/actions/runs/24846887334 |
2 participants
This PR updates the release pipeline so release-plz creates the draft GitHub release, cargo-dist waits for that draft and uploads its artifacts in bring-your-own-release mode (https://axodotdev.github.io/cargo-dist/book/ci/customizing.html#bring-your-own-release), and Debian packages are built and uploaded as a blocking publish step before the release is undrafted.