upstream: fix: convert robot account ID columns and sequence to bigin… #331
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| - "release-[0-9]*.[0-9]*" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| validate-release-ref: | |
| name: Validate Release Ref | |
| runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }} | |
| steps: | |
| - name: Allow only release refs | |
| run: | | |
| if [[ "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" =~ ^release-[0-9]+\.[0-9]+$ ]]; then | |
| exit 0 | |
| fi | |
| echo "::error::Release Please can only run on main or release-X.Y branches. Current ref: ${GITHUB_REF_NAME}" | |
| exit 1 | |
| release-please: | |
| needs: [validate-release-ref] | |
| runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }} | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| version: ${{ steps.release.outputs.version }} | |
| major: ${{ steps.release.outputs.major }} | |
| minor: ${{ steps.release.outputs.minor }} | |
| patch: ${{ steps.release.outputs.patch }} | |
| prs_created: ${{ steps.release.outputs.prs_created }} | |
| prs: ${{ steps.release.outputs.prs }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| id: release | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| target-branch: ${{ github.ref_name }} | |
| config-file: ${{ github.ref_name == 'main' && 'release-please-config.json' || 'release-please-config-maintenance.json' }} | |
| manifest-file: .release-please-manifest.json | |
| - name: Check out release PR branch | |
| if: ${{ github.ref_name == 'main' && steps.release.outputs.prs_created == 'true' && steps.release.outputs.release_created != 'true' }} | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ fromJSON(steps.release.outputs.prs)[0].headBranchName }} | |
| persist-credentials: false | |
| - name: Configure ephemeral Git authentication | |
| if: ${{ github.ref_name == 'main' && steps.release.outputs.prs_created == 'true' && steps.release.outputs.release_created != 'true' }} | |
| run: | | |
| askpass="${RUNNER_TEMP}/git-askpass" | |
| cat > "${askpass}" <<'EOF' | |
| #!/usr/bin/env bash | |
| case "$1" in | |
| *Username*) printf '%s\n' 'x-access-token' ;; | |
| *Password*) printf '%s\n' "${GH_TOKEN}" ;; | |
| *) exit 1 ;; | |
| esac | |
| EOF | |
| chmod 700 "${askpass}" | |
| echo "GIT_ASKPASS=${askpass}" >> "${GITHUB_ENV}" | |
| echo "GIT_TERMINAL_PROMPT=0" >> "${GITHUB_ENV}" | |
| - name: Setup Node | |
| if: ${{ github.ref_name == 'main' && steps.release.outputs.prs_created == 'true' && steps.release.outputs.release_created != 'true' }} | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| package-manager-cache: false | |
| - name: Advance main development version | |
| if: ${{ github.ref_name == 'main' && steps.release.outputs.prs_created == 'true' && steps.release.outputs.release_created != 'true' }} | |
| run: | | |
| release_version=$(node -e "const manifest = require('./.release-please-manifest.json'); const version = manifest['.']; if (!version) { throw new Error('missing root release version'); } console.log(version);") | |
| if [[ ! "${release_version}" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then | |
| echo "::error::Unsupported release version: ${release_version}" | |
| exit 1 | |
| fi | |
| major="${BASH_REMATCH[1]}" | |
| minor="${BASH_REMATCH[2]}" | |
| next_version="${major}.$((minor + 1)).0" | |
| printf '%s\n' "${next_version}" > VERSION | |
| if git diff --quiet -- VERSION; then | |
| echo "VERSION already targets ${next_version}" | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add VERSION | |
| git commit -s -m "chore: target next development version ${next_version}" | |
| git push | |
| preview-release-notes: | |
| name: Preview Release Notes | |
| needs: [release-please] | |
| if: ${{ needs.release-please.outputs.prs_created == 'true' && needs.release-please.outputs.release_created != 'true' }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| uses: ./.github/workflows/release-notes-engine.yml | |
| with: | |
| checkout_ref: ${{ fromJSON(needs.release-please.outputs.prs)[0].headBranchName }} | |
| preview_pr_number: ${{ fromJSON(needs.release-please.outputs.prs)[0].number }} | |
| secrets: | |
| SYNC_APP_PRIVATE_KEY: ${{ secrets.SYNC_APP_PRIVATE_KEY }} | |
| release-please-chart: | |
| name: Release Please (chart) | |
| # Independent release line for the Helm chart, scoped to deploy/chart | |
| # via its own config + manifest. Kept as a SEPARATE release-please | |
| # instance (not a second package in the app manifest) on purpose: | |
| # adding a package to a manifest switches every output to the | |
| # "<path>--<name>" form, which would break the app jobs that read the | |
| # unprefixed release-please outputs. Chart releases run on main only. | |
| needs: [validate-release-ref] | |
| if: ${{ github.ref_name == 'main' }} | |
| runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| outputs: | |
| release_created: ${{ steps.release.outputs['deploy/chart--release_created'] }} | |
| tag_name: ${{ steps.release.outputs['deploy/chart--tag_name'] }} | |
| version: ${{ steps.release.outputs['deploy/chart--version'] }} | |
| steps: | |
| - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| id: release | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| target-branch: ${{ github.ref_name }} | |
| config-file: release-please-config-chart.json | |
| manifest-file: .release-please-manifest-chart.json | |
| create-maintenance-branch: | |
| name: Create Maintenance Branch | |
| needs: [release-please] | |
| if: >- | |
| ${{ | |
| github.ref_name == 'main' && | |
| needs.release-please.outputs.release_created == 'true' && | |
| needs.release-please.outputs.patch == '0' | |
| }} | |
| runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }} | |
| permissions: | |
| contents: write | |
| env: | |
| TAG_NAME: ${{ needs.release-please.outputs.tag_name }} | |
| VERSION: ${{ needs.release-please.outputs.version }} | |
| MAJOR: ${{ needs.release-please.outputs.major }} | |
| MINOR: ${{ needs.release-please.outputs.minor }} | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Configure ephemeral Git authentication | |
| run: | | |
| askpass="${RUNNER_TEMP}/git-askpass" | |
| cat > "${askpass}" <<'EOF' | |
| #!/usr/bin/env bash | |
| case "$1" in | |
| *Username*) printf '%s\n' 'x-access-token' ;; | |
| *Password*) printf '%s\n' "${GH_TOKEN}" ;; | |
| *) exit 1 ;; | |
| esac | |
| EOF | |
| chmod 700 "${askpass}" | |
| echo "GIT_ASKPASS=${askpass}" >> "${GITHUB_ENV}" | |
| echo "GIT_TERMINAL_PROMPT=0" >> "${GITHUB_ENV}" | |
| - name: Create branch for patch releases | |
| run: | | |
| branch="release-${MAJOR}.${MINOR}" | |
| if git ls-remote --exit-code --heads origin "${branch}" >/dev/null 2>&1; then | |
| echo "${branch} already exists" | |
| exit 0 | |
| fi | |
| git fetch --depth=1 origin "refs/tags/${TAG_NAME}:refs/tags/${TAG_NAME}" | |
| sha=$(git rev-list -n 1 "${TAG_NAME}") | |
| git switch --detach "${sha}" | |
| printf '%s\n' "${VERSION}" > VERSION | |
| if git diff --quiet -- VERSION; then | |
| git push origin "${sha}:refs/heads/${branch}" | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add VERSION | |
| git commit -s -m "chore: initialize ${branch} version" | |
| git push origin "HEAD:refs/heads/${branch}" | |
| publish-images: | |
| name: Publish Release Images | |
| needs: [release-please] | |
| if: ${{ needs.release-please.outputs.release_created == 'true' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| uses: ./.github/workflows/publish-images.yml | |
| with: | |
| checkout_ref: ${{ needs.release-please.outputs.tag_name }} | |
| image_tag: ${{ needs.release-please.outputs.tag_name }} | |
| version: ${{ needs.release-please.outputs.version }} | |
| artifact_prefix: release-${{ needs.release-please.outputs.tag_name }} | |
| registry_address: ${{ vars.REGISTRY_ADDRESS || '8gears.container-registry.com' }} | |
| registry_project: ${{ vars.REGISTRY_PROJECT || '8gcr' }} | |
| secrets: inherit | |
| update-release-notes: | |
| name: Update Release Notes | |
| needs: [release-please, publish-images] | |
| if: ${{ needs.release-please.outputs.release_created == 'true' }} | |
| permissions: | |
| contents: write | |
| uses: ./.github/workflows/release-notes-engine.yml | |
| with: | |
| tag_name: ${{ needs.release-please.outputs.tag_name }} | |
| secrets: | |
| SYNC_APP_PRIVATE_KEY: ${{ secrets.SYNC_APP_PRIVATE_KEY }} | |
| chart: | |
| name: Publish Helm Chart | |
| # Driven by the chart's own release-please line (release-please-chart), | |
| # not the app release. The chart references Harbor images by its | |
| # appVersion (Chart.yaml), which a prior app release must already have | |
| # published — so this job does NOT depend on the image build/merge. | |
| needs: [release-please-chart] | |
| if: ${{ needs.release-please-chart.outputs.release_created == 'true' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| uses: ./.github/workflows/publish-chart.yml | |
| with: | |
| tag_name: ${{ needs.release-please-chart.outputs.tag_name }} | |
| secrets: | |
| REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} |