78 lines
4.2 KiB
YAML
78 lines
4.2 KiB
YAML
# The release of storebound: a version tag (v0.8.5) promotes the release candidate of its commit. Nothing is rebuilt
|
|
# or retested here: ci.yml ran the full CI, the acceptance matrix (Linux + Windows x Node 20 / 22 / Bun) and built,
|
|
# self-tested and privacy-scanned the Linux and Windows installers for that very commit (for a version-only bump
|
|
# commit: the installers, with the parent's CI and matrix, proven version-only file by file), and stored them as the
|
|
# draft rc-<sha> with green.json (tools/release-candidate.ts).
|
|
#
|
|
# push of a tag v* checks (tag = package.json version, every version copy equal, the CHANGELOG section), waits
|
|
# for the commit's candidate (heartbeat; fails at once when the commit is red or has no ci run,
|
|
# with the run's link; times out after 40 min), then ONE release "storebound <version>" with the
|
|
# candidate's installers, the acceptance matrix, SHA256SUMS and short notes. Stable versions
|
|
# then delete the older release entries (tags stay). A version with a "-" (0.0.0-rehearsal.1)
|
|
# is a prerelease: never pruning, never the stable release.
|
|
# workflow_dispatch tag: the same for an existing tag; dry (default): only the plan.
|
|
#
|
|
# Not here: macOS. tools/release.ts on the owner's Mac builds, signs and notarizes the DMG in parallel and adds it to
|
|
# this release, then publishes storebound.dev (docs/desktop-release.md). The updater signing key never reaches a runner.
|
|
# Secrets: RELEASE_TOKEN (scope write:repository), FORGEJO_ORIGIN (the server's IP: uploads over 100 MB bypass
|
|
# Cloudflare). The private terms scan of the installers ran in ci.yml's build jobs (FORBIDDEN_TERMS).
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Version tag to release (v0.8.5)
|
|
type: string
|
|
default: ''
|
|
dry:
|
|
description: Dry run (only the plan)
|
|
type: boolean
|
|
default: true
|
|
|
|
env:
|
|
BUN_VERSION: '1.4.0'
|
|
|
|
jobs:
|
|
promote:
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 50
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
FORGEJO_URL: ${{ github.server_url }}
|
|
FORGEJO_ORIGIN: ${{ secrets.FORGEJO_ORIGIN }}
|
|
TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
|
|
steps:
|
|
- name: Mode
|
|
id: mode
|
|
env:
|
|
EVENT: ${{ github.event_name }}
|
|
IN_DRY: ${{ inputs.dry }}
|
|
run: |
|
|
[ -n "$TAG" ] || { echo "input tag is required" >&2; exit 1; }
|
|
case "$(echo "${IN_DRY:-true}" | tr A-Z a-z)" in false|0|off|no) dry=false;; *) dry=true;; esac
|
|
[ "$EVENT" = push ] && dry=false
|
|
echo "dry=$dry" >> "$GITHUB_OUTPUT"; echo "tag=$TAG dry=$dry"
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: refs/tags/${{ env.TAG }}
|
|
- name: Tag, package.json version, every version copy and the CHANGELOG agree
|
|
id: check
|
|
run: |
|
|
bash tools/ci-install-bun.sh
|
|
echo "$HOME/.bun/bin" >> "${FORGEJO_PATH:-$GITHUB_PATH}"
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
bun tools/desktop-version.ts
|
|
V=$(bun tools/desktop-version.ts --print)
|
|
[ "$TAG" = "v$V" ] || { echo "tag $TAG is not v$V (package.json): bun tools/release.ts <version> makes the bump commit and the tag" >&2; exit 1; }
|
|
case "$V" in *-*) echo "prerelease $V: the CHANGELOG section is optional";; *) grep -q "^## $V" CHANGELOG.md || { echo "CHANGELOG.md has no '## $V' section" >&2; exit 1; };; esac
|
|
[ -n "$FORGEJO_TOKEN" ] || { echo "secret RELEASE_TOKEN is missing (repo Settings > Actions > Secrets)" >&2; exit 1; }
|
|
echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
echo "version=$V" >> "$GITHUB_OUTPUT"
|
|
- name: Promote the commit's green candidate
|
|
run: bun tools/release-candidate.ts promote --tag "$TAG" --sha "${{ steps.check.outputs.sha }}" --wait 40 ${{ steps.mode.outputs.dry == 'false' && '--yes' || '' }}
|
|
- name: Keep only the newest release (stable versions; tags stay)
|
|
if: ${{ steps.mode.outputs.dry == 'false' && !contains(steps.check.outputs.version, '-') }}
|
|
run: bun tools/forgejo-release.ts prune --keep "$TAG" --yes
|