Added: Release actions

David Elner · David Elner · commit 5d6537ca02d2 · 2026-06-01T12:25:39.000Z
diff --git a/actions/release/create-github-release/action.yml b/actions/release/create-github-release/action.yml
@@ -0,0 +1,44 @@
+name: Create GitHub Release
+description: >
+  Creates a GitHub release with generated release notes.
+  In dry run mode, previews the release notes without creating anything.
+
+inputs:
+  release_tag:
+    description: "The release tag (e.g. v0.3.2)"
+    required: true
+  sha:
+    description: "The commit SHA the release points to"
+    required: true
+  notes:
+    description: "Base64-encoded release notes body from prepare action"
+    required: false
+    default: ''
+  dry_run:
+    description: "Preview release notes without creating the release"
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: Create GitHub release
+      if: ${{ inputs.dry_run == 'false' }}
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        TAG: ${{ inputs.release_tag }}
+      run: |
+        echo "${{ inputs.notes }}" | base64 -d 2>/dev/null > /tmp/release-notes.md
+        gh release create "$TAG" \
+          --title "$TAG" \
+          --notes-file /tmp/release-notes.md \
+          --target "${{ inputs.sha }}"
+
+    - name: Release notes preview
+      if: ${{ inputs.dry_run == 'true' }}
+      shell: bash
+      run: |
+        echo "DRY RUN: would create GitHub release ${{ inputs.release_tag }}"
+        echo "--- Release notes preview ---"
+        echo "${{ inputs.notes }}" | base64 -d 2>/dev/null || echo "(unavailable)"
diff --git a/actions/release/notify-pending/action.yml b/actions/release/notify-pending/action.yml
@@ -0,0 +1,136 @@
+name: Notify Release Pending
+description: >
+  Posts the pre-approval job summary and Slack notification.
+  Called before the environment gate — reviewer sees this before approving.
+
+inputs:
+  sha:
+    description: "Commit SHA being released"
+    required: true
+  release_tag:
+    description: "The release tag (e.g. v0.3.2)"
+    required: true
+  prev_tag:
+    description: "Previous release tag"
+    required: false
+    default: ''
+  branch:
+    description: "Branch containing the SHA"
+    required: true
+  on_main:
+    description: "Whether the SHA is on the main branch"
+    required: true
+  commit_message:
+    description: "Commit message at the SHA"
+    required: true
+  pr_list:
+    description: "x1f-delimited PR list from prepare action"
+    required: false
+    default: ''
+  notes:
+    description: "Base64-encoded release notes from prepare action"
+    required: false
+    default: ''
+  dry_run:
+    description: "Whether this is a dry run"
+    required: false
+    default: 'false'
+  slack_token:
+    description: "Slack bot token for posting messages"
+    required: true
+  slack_channel:
+    description: "Slack channel ID to post to"
+    required: true
+  emoji:
+    description: "Emoji prefix for Slack messages"
+    required: false
+    default: ':package:'
+
+runs:
+  using: composite
+  steps:
+    - name: Post release summary
+      shell: bash
+      env:
+        TAG: ${{ inputs.release_tag }}
+      run: |
+        NOTES=$(echo "${{ inputs.notes }}" | base64 -d 2>/dev/null)
+        if [ -z "$NOTES" ]; then NOTES="_Release notes unavailable._"; fi
+
+        BRANCH_LABEL="[${{ inputs.branch }}]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/tree/${{ inputs.branch }})"
+        if [ "${{ inputs.on_main }}" = "false" ]; then
+          BRANCH_LABEL="$BRANCH_LABEL ⚠️"
+        fi
+
+        echo "## $GITHUB_REPOSITORY $TAG" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        if [ "${{ inputs.dry_run }}" = "true" ]; then
+          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+          echo "> Dry run: Nothing will be tagged or published." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        if [ "${{ inputs.on_main }}" = "false" ]; then
+          echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+          echo "> Release SHA is not on main: Is this a special release? (e.g. beta, backport, etc)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        echo "**SHA:** [${{ inputs.sha }}]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/${{ inputs.sha }})" >> $GITHUB_STEP_SUMMARY
+        echo "**Commit:** ${{ inputs.commit_message }}" >> $GITHUB_STEP_SUMMARY
+        echo "**Branch:** $BRANCH_LABEL" >> $GITHUB_STEP_SUMMARY
+
+        if [ -n "${{ inputs.prev_tag }}" ]; then
+          DIFF_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/${{ inputs.prev_tag }}...${{ inputs.sha }}"
+          echo "**Diff:** [${{ inputs.prev_tag }}...$TAG]($DIFF_URL)" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "$NOTES" >> $GITHUB_STEP_SUMMARY
+
+    - name: Notify Slack
+      shell: bash
+      env:
+        SLACK_BOT_TOKEN: ${{ inputs.slack_token }}
+        SLACK_CHANNEL: ${{ inputs.slack_channel }}
+        TAG: ${{ inputs.release_tag }}
+        APPROVE_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |
+        BRANCH_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/tree/${{ inputs.branch }}"
+        BRANCH_LINK="<$BRANCH_URL|${{ inputs.branch }}>"
+        if [ "${{ inputs.on_main }}" = "false" ]; then
+          BRANCH_INFO="> ⚠️ NOT on main: $BRANCH_LINK"
+        else
+          BRANCH_INFO="$BRANCH_LINK"
+        fi
+
+        DIFF_PART=""
+        if [ -n "${{ inputs.prev_tag }}" ]; then
+          DIFF_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/${{ inputs.prev_tag }}...${{ inputs.sha }}"
+          DIFF_PART=" · <$DIFF_URL|${{ inputs.prev_tag }}...$TAG>"
+        fi
+
+        PR_LIST=$(echo "${{ inputs.pr_list }}" | tr $'\x1f' '\n' | sed '/^$/d')
+
+        TEXT="${{ inputs.emoji }} *$GITHUB_REPOSITORY $TAG* awaiting approval"
+
+        if [ "${{ inputs.dry_run }}" = "true" ]; then
+          TEXT="$TEXT\n> :information_source: _Dry run: nothing will be tagged or published._"
+        fi
+
+        TEXT="$TEXT\n${BRANCH_INFO}${DIFF_PART}"
+
+        if [ -n "$PR_LIST" ]; then
+          TEXT="$TEXT\n$PR_LIST"
+        fi
+
+        TEXT="$TEXT\n<$APPROVE_URL|View changes & approve>"
+
+        # jq --arg passes strings literally, so \n must be real newlines before encoding
+        TEXT=$(printf '%b' "$TEXT")
+        curl -s -X POST "https://slack.com/api/chat.postMessage" \
+          -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+          -H "Content-Type: application/json; charset=utf-8" \
+          -d "$(jq -n --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \
+            '{channel: $channel, text: $text}')"
diff --git a/actions/release/notify-published/action.yml b/actions/release/notify-published/action.yml
@@ -0,0 +1,87 @@
+name: Notify Release Complete
+description: >
+  Posts the post-publish Slack notification with release link and PR list.
+
+inputs:
+  release_tag:
+    description: "The release tag (e.g. v0.3.2)"
+    required: true
+  prev_tag:
+    description: "Previous release tag"
+    required: false
+    default: ''
+  branch:
+    description: "Branch the release was made from"
+    required: true
+  on_main:
+    description: "Whether the release was from main"
+    required: true
+  pr_list:
+    description: "x1f-delimited PR list from prepare action"
+    required: false
+    default: ''
+  dry_run:
+    description: "Whether this was a dry run"
+    required: false
+    default: 'false'
+  slack_token:
+    description: "Slack bot token for posting messages"
+    required: true
+  slack_channel:
+    description: "Slack channel ID to post to"
+    required: true
+  emoji:
+    description: "Emoji prefix for Slack messages"
+    required: false
+    default: ':package:'
+
+runs:
+  using: composite
+  steps:
+    - name: Notify Slack
+      shell: bash
+      env:
+        SLACK_BOT_TOKEN: ${{ inputs.slack_token }}
+        SLACK_CHANNEL: ${{ inputs.slack_channel }}
+        TAG: ${{ inputs.release_tag }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |
+        RELEASE_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$TAG"
+
+        DIFF_PART=""
+        if [ -n "${{ inputs.prev_tag }}" ]; then
+          DIFF_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/${{ inputs.prev_tag }}...$TAG"
+          DIFF_PART="<$DIFF_URL|${{ inputs.prev_tag }}...$TAG>  ·  "
+        fi
+
+        PR_LIST=$(echo "${{ inputs.pr_list }}" | tr $'\x1f' '\n' | sed '/^$/d')
+
+        if [ "${{ inputs.dry_run }}" = "true" ]; then
+          TEXT="${{ inputs.emoji }} *$GITHUB_REPOSITORY $TAG* complete"
+          TEXT="$TEXT\n> :information_source: _Dry run: gem built, nothing tagged or published._"
+        else
+          TEXT="${{ inputs.emoji }} *$GITHUB_REPOSITORY $TAG* published"
+        fi
+
+        if [ "${{ inputs.on_main }}" = "false" ]; then
+          BRANCH_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/tree/${{ inputs.branch }}"
+          TEXT="$TEXT\n> ⚠️ NOT on main: <$BRANCH_URL|${{ inputs.branch }}>"
+        fi
+
+        if [ "${{ inputs.dry_run }}" = "true" ]; then
+          TEXT="$TEXT\n${DIFF_PART}<$RUN_URL|View dry run>"
+        else
+          TEXT="$TEXT\n${DIFF_PART}<$RELEASE_URL|View release>"
+        fi
+
+        if [ -n "$PR_LIST" ]; then
+          TEXT="$TEXT\n$PR_LIST"
+        fi
+
+        # jq --arg passes strings literally, so \n must be real newlines before encoding
+        TEXT=$(printf '%b' "$TEXT")
+        curl -s -X POST "https://slack.com/api/chat.postMessage" \
+          -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+          -H "Content-Type: application/json; charset=utf-8" \
+          -d "$(jq -n --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \
+            '{channel: $channel, text: $text}')"
diff --git a/actions/release/prepare/action.yml b/actions/release/prepare/action.yml
@@ -0,0 +1,55 @@
+name: Prepare Release
+description: >
+  Fetches release notes and formats the PR list for notifications.
+  Requires contents:write permission on the calling job (for generate-notes API).
+
+inputs:
+  release_tag:
+    description: "The release tag (e.g. v0.3.2)"
+    required: true
+  sha:
+    description: "The commit SHA being released"
+    required: true
+  prev_tag:
+    description: "The previous release tag"
+    required: false
+    default: ''
+
+outputs:
+  pr_list:
+    description: "Formatted PR list (x1f-delimited for safe job output passing)"
+    value: ${{ steps.fetch.outputs.pr_list }}
+  notes:
+    description: "Base64-encoded full release notes body"
+    value: ${{ steps.fetch.outputs.notes }}
+
+runs:
+  using: composite
+  steps:
+    - name: Fetch PR list and release notes
+      id: fetch
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        PREV_TAG="${{ inputs.prev_tag }}"
+        BODY=$(gh api "repos/$GITHUB_REPOSITORY/releases/generate-notes" \
+          --method POST \
+          --field tag_name="${{ inputs.release_tag }}" \
+          --field target_commitish="${{ inputs.sha }}" \
+          ${PREV_TAG:+--field previous_tag_name="$PREV_TAG"} \
+          --jq '.body' 2>/dev/null || echo "")
+
+        PR_LIST=$(echo "$BODY" \
+          | grep "^\* " \
+          | grep -v "made their first contribution" \
+          | grep -v "Full Changelog" \
+          | head -10 \
+          | sed 's|^\* ||' \
+          | sed 's| by @[^ ]*||' \
+          | sed 's@ in \(https://[^ ]*/pull/\([0-9]*\)\)@ (<\1|#\2>)@' \
+          | sed 's/^/• /' \
+          | tr '\n' $'\x1f' || echo "")
+
+        echo "pr_list=$PR_LIST" >> $GITHUB_OUTPUT
+        echo "notes=$(echo "$BODY" | base64 -w 0)" >> $GITHUB_OUTPUT
diff --git a/actions/release/validate/action.yml b/actions/release/validate/action.yml
@@ -0,0 +1,68 @@
+name: Validate Release
+description: >
+  Validates a release SHA and computes release metadata.
+  Requires the repository to be checked out at the target SHA.
+
+inputs:
+  version:
+    description: "Version string read from the language-specific version file"
+    required: true
+  sha:
+    description: "Commit SHA being released"
+    required: true
+  dry_run:
+    description: "Skip tag existence failure in dry runs"
+    required: false
+    default: 'false'
+
+outputs:
+  release_tag:
+    description: "The release tag (e.g. v0.3.2)"
+    value: ${{ steps.validate.outputs.release_tag }}
+  prev_tag:
+    description: "The previous release tag"
+    value: ${{ steps.validate.outputs.prev_tag }}
+  branch:
+    description: "The branch containing the SHA"
+    value: ${{ steps.validate.outputs.branch }}
+  on_main:
+    description: "Whether the SHA is on the main branch"
+    value: ${{ steps.validate.outputs.on_main }}
+  commit_message:
+    description: "The commit message at the SHA"
+    value: ${{ steps.validate.outputs.commit_message }}
+
+runs:
+  using: composite
+  steps:
+    - name: Validate release
+      id: validate
+      shell: bash
+      run: |
+        TAG="v${{ inputs.version }}"
+        COMMIT_MSG=$(git log -1 --format="%s" HEAD)
+        BRANCH=$(git branch -r --contains HEAD --format="%(refname:short)" | sed 's|origin/||' | head -1)
+
+        if git rev-parse "$TAG" >/dev/null 2>&1; then
+          if [ "${{ inputs.dry_run }}" = "true" ]; then
+            echo "Warning: Tag $TAG already exists — skipping in dry run"
+          else
+            echo "Error: Tag $TAG already exists — has the version been bumped?"
+            exit 1
+          fi
+        fi
+
+        if git merge-base --is-ancestor HEAD origin/main 2>/dev/null; then
+          ON_MAIN=true
+        else
+          ON_MAIN=false
+        fi
+
+        PREV_TAG=$(git describe --tags --abbrev=0 --match='v[0-9]*.[0-9]*.[0-9]*' HEAD^ 2>/dev/null || echo "")
+
+        echo "release_tag=$TAG" >> $GITHUB_OUTPUT
+        echo "commit_message=$COMMIT_MSG" >> $GITHUB_OUTPUT
+        echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+        echo "on_main=$ON_MAIN" >> $GITHUB_OUTPUT
+        echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
+        echo "Validated $TAG @ ${{ inputs.sha }} ($COMMIT_MSG)"
