ci: separate manual release publishing
This commit is contained in:
ekklesia
@@ -0,0 +1,180 @@
|
||||
name: Publish Signage Release
|
||||
|
||||
# Builds, proves, and publishes one Signage release. This is deliberately separate from CI: only an
|
||||
# operator's workflow_dispatch on a selected branch can start it. The normal release ref is main.
|
||||
# Every local gate, including the full external-package integration and ADR 0055 redistribution
|
||||
# verification, finishes before the release/tag is created or an existing release is touched.
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
version:
|
||||
description: The Signage version to publish, equal to package and module metadata.
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
# Never cancel a publication part way, and never run two at once. A rerun safely resumes an
|
||||
# identical partial upload, but refuses a tag, release, or asset that differs from this run.
|
||||
concurrency:
|
||||
group: publish-signage-release
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
release-gate:
|
||||
name: release gate
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 75
|
||||
outputs:
|
||||
sha256: ${{ steps.canonical.outputs.sha256 }}
|
||||
env:
|
||||
DOCKER_BUILDKIT: "1"
|
||||
EKKLESIA_CI_JOB_KEY: signage-publish-release
|
||||
RELEASE_VERSION: ${{ inputs.version }}
|
||||
RELEASE_TAG: v${{ inputs.version }}
|
||||
RELEASE_REVISION: ${{ github.sha }}
|
||||
steps:
|
||||
- name: Check out the operator-selected revision
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Node.js at the repository's version
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version-file: .node-version
|
||||
|
||||
- name: Install the reviewed build and release tooling
|
||||
run: |
|
||||
corepack enable
|
||||
corepack install
|
||||
pnpm install --frozen-lockfile
|
||||
|
||||
# Match Core's manual publisher: releases come only from reviewed main. The source version is
|
||||
# checked before the expensive gate, and the selected commit remains the immutable tag target.
|
||||
- name: Validate requested version and selected revision
|
||||
run: |
|
||||
[[ "$GITHUB_REF" == refs/heads/main ]] || {
|
||||
echo "publish: select main; got $GITHUB_REF" >&2
|
||||
exit 1
|
||||
}
|
||||
[[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
|
||||
echo "publish: version must be X.Y.Z; got $RELEASE_VERSION" >&2
|
||||
exit 1
|
||||
}
|
||||
[[ "$RELEASE_REVISION" =~ ^[0-9a-f]{40}$ ]]
|
||||
[[ "$(git rev-parse HEAD)" == "$RELEASE_REVISION" ]]
|
||||
[[ -z "$(git status --porcelain)" ]]
|
||||
node --input-type=module -e '
|
||||
import { readFileSync } from "node:fs";
|
||||
const requested = process.env.RELEASE_VERSION;
|
||||
const packageVersion = JSON.parse(readFileSync("package.json", "utf8")).version;
|
||||
const moduleVersion = JSON.parse(readFileSync("ekklesia.module.json", "utf8")).version;
|
||||
if (packageVersion !== requested || moduleVersion !== requested) {
|
||||
console.error(`publish: requested ${requested}, package ${packageVersion}, module ${moduleVersion}`);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`publish: source metadata agrees on ${requested}`);
|
||||
'
|
||||
|
||||
# This is the only package build in the workflow. Every later step consumes this directory.
|
||||
- name: Build the canonical Module Package pair once
|
||||
id: canonical
|
||||
run: bash ci/package.sh build/release-assets
|
||||
|
||||
- name: Verify the canonical Module Package
|
||||
env:
|
||||
EXPECTED_PACKAGE_SHA256: ${{ steps.canonical.outputs.sha256 }}
|
||||
run: |
|
||||
pnpm validate
|
||||
python3 ci/release-assets.py verify-package \
|
||||
build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
|
||||
|
||||
- name: Fetch the pinned Ekklesia integration harness
|
||||
run: bash ci/fetch-platform.sh
|
||||
|
||||
- name: Sweep stale CI stacks from the runner
|
||||
run: bash build/platform/scripts/ci-sweep.sh --stale
|
||||
|
||||
- name: Run full integration with the exact release package
|
||||
env:
|
||||
EXPECTED_PACKAGE_SHA256: ${{ steps.canonical.outputs.sha256 }}
|
||||
run: bash ci/integration.sh "$GITHUB_WORKSPACE/build/release-assets"
|
||||
|
||||
- name: Remove this publication's CI stacks
|
||||
if: always()
|
||||
run: |
|
||||
if [ -f build/platform/scripts/ci-sweep.sh ]; then
|
||||
bash build/platform/scripts/ci-sweep.sh --job
|
||||
fi
|
||||
|
||||
- name: Build and verify required redistribution assets
|
||||
env:
|
||||
EXPECTED_PACKAGE_SHA256: ${{ steps.canonical.outputs.sha256 }}
|
||||
run: |
|
||||
package="$(find build/release-assets -maxdepth 1 -type f -name 'signage-*-linux-x64-glibc.tar.gz')"
|
||||
pnpm exec ekklesia-corresponding-source acquire \
|
||||
--package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources"
|
||||
pnpm exec ekklesia-corresponding-source build \
|
||||
--package "$package" --cache "$RUNNER_TEMP/signage-corresponding-sources" \
|
||||
--out build/release-assets
|
||||
source="${package%.tar.gz}-corresponding-source.tar.gz"
|
||||
metadata="${package%.tar.gz}.redistribution.json"
|
||||
pnpm exec ekklesia-corresponding-source verify \
|
||||
--package "$package" --source "$source" --metadata "$metadata"
|
||||
python3 ci/release-assets.py verify \
|
||||
build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
|
||||
|
||||
# The write-authorized job receives only the completely proven bundle. Artifact actions v3
|
||||
# are required by Gitea; v4 refuses servers other than github.com.
|
||||
- name: Hand the proven release bundle to the publisher
|
||||
uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
|
||||
with:
|
||||
name: signage-release-assets
|
||||
path: build/release-assets/
|
||||
if-no-files-found: error
|
||||
retention-days: 90
|
||||
|
||||
publish:
|
||||
name: publish
|
||||
needs: release-gate
|
||||
if: github.ref == 'refs/heads/main'
|
||||
permissions:
|
||||
contents: write
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
env:
|
||||
EXPECTED_PACKAGE_SHA256: ${{ needs.release-gate.outputs.sha256 }}
|
||||
RELEASE_VERSION: ${{ inputs.version }}
|
||||
RELEASE_TAG: v${{ inputs.version }}
|
||||
RELEASE_REVISION: ${{ github.sha }}
|
||||
steps:
|
||||
# The checked-out helper is the same reviewed revision the gate proved. Credentials are not
|
||||
# persisted; the automatic token is exposed only to the final API call below.
|
||||
- name: Check out the proven revision
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Receive the proven release bundle
|
||||
uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # v3.1.0-node20
|
||||
with:
|
||||
name: signage-release-assets
|
||||
path: build/release-assets/
|
||||
|
||||
- name: Recheck the received release bundle
|
||||
run: |
|
||||
python3 ci/release-assets.py verify \
|
||||
build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
|
||||
|
||||
# Only this final step can mutate Gitea. It creates v<version> at the selected commit and a
|
||||
# prerelease if absent, then uploads the already-tested bytes. A rerun resumes only identical
|
||||
# state. Every asset is read back without Authorization and checked byte for byte.
|
||||
- name: Create the release and publish the exact tested assets
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
python3 ci/release-assets.py publish \
|
||||
build/release-assets "$RELEASE_TAG" "$RELEASE_REVISION"
|
||||
Reference in New Issue
Block a user