fix(edgecache): purge on unreadable probe, cap the hold #137
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| # release-please reads Conventional Commits on main and maintains a release | |
| # PR that bumps version.txt + CHANGELOG.md. Merging that PR cuts the git tag | |
| # + GitHub Release, sets release_created, and triggers the publish job below. | |
| # bump-minor-pre-major (config) keeps the pre-1.0 "MINOR may break" caveat. | |
| release-please: | |
| name: Maintain release PR | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| outputs: | |
| release_created: ${{ steps.rp.outputs.release_created }} | |
| version: ${{ steps.rp.outputs.version }} | |
| major: ${{ steps.rp.outputs.major }} | |
| minor: ${{ steps.rp.outputs.minor }} | |
| sha: ${{ steps.rp.outputs.sha }} | |
| steps: | |
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token | |
| with: | |
| app-id: ${{ vars.RELEASE_PLEASE_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }} | |
| - id: rp | |
| uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| build-and-push: | |
| name: Build & Push Image | |
| needs: release-please | |
| if: needs.release-please.outputs.release_created == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Build the exact commit release-please tagged, not the branch HEAD, | |
| # so the image content matches the published tag + GitHub Release. | |
| ref: ${{ needs.release-please.outputs.sha }} | |
| # Full history: `set_commits: auto` derives the commit range from it, | |
| # and the default shallow clone carries none. | |
| fetch-depth: 0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3 | |
| - name: Log in to the GHCR | |
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Derive image tags | |
| id: meta | |
| uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5 | |
| with: | |
| images: ghcr.io/freecodecamp/artemis | |
| # Registry tags are bare semver (no leading "v") per OCI convention; | |
| # release-please's `version`/`major`/`minor` outputs are already | |
| # v-stripped (the git tag keeps the "v": vX.Y.Z). sha-<full-sha> is | |
| # the immutable audit anchor; latest tracks the newest release. | |
| # | |
| # sha- and the revision label MUST name the checked-out ref, not | |
| # github.sha. They differ whenever release-please tags on a later | |
| # push than the one it failed on: v1.10.1 published as | |
| # sha-a4773a53 while containing 3ad8291. | |
| tags: | | |
| type=raw,value=${{ needs.release-please.outputs.version }} | |
| type=raw,value=${{ needs.release-please.outputs.major }}.${{ needs.release-please.outputs.minor }} | |
| type=raw,value=sha-${{ needs.release-please.outputs.sha }} | |
| type=raw,value=latest | |
| labels: | | |
| org.opencontainers.image.revision=${{ needs.release-please.outputs.sha }} | |
| org.opencontainers.image.version=${{ needs.release-please.outputs.version }} | |
| - name: Cache Docker layers | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-artemis-${{ needs.release-please.outputs.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-artemis- | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| # VERSION = bare semver, COMMIT = the tagged release commit SHA. | |
| # Embedded via -X main.version / -X main.commit (startup log line | |
| # `artemis: starting version=X.Y.Z commit=<sha>`). | |
| build-args: | | |
| VERSION=${{ needs.release-please.outputs.version }} | |
| COMMIT=${{ needs.release-please.outputs.sha }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=local,src=/tmp/.buildx-cache | |
| cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max | |
| - name: Move cache | |
| run: | | |
| rm -rf /tmp/.buildx-cache | |
| mv /tmp/.buildx-cache-new /tmp/.buildx-cache | |
| - name: Register Sentry release | |
| uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3.7.0 | |
| continue-on-error: true | |
| env: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SENTRY_ORG: freecodecamp | |
| SENTRY_PROJECT: artemis | |
| with: | |
| release: artemis@${{ needs.release-please.outputs.version }}+${{ needs.release-please.outputs.sha }} | |
| set_commits: skip | |
| finalize: true | |
| # Commit association is a second, failure-tolerant step on purpose. It | |
| # needs freeCodeCamp/artemis linked to the Sentry org through the GitHub | |
| # integration, and `auto` errors when that link is absent. Doing it here | |
| # rather than as `set_commits: auto` above means a missing integration | |
| # costs the suspect-commit data, never the release registration itself. | |
| - name: Associate commits with the Sentry release | |
| uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3.7.0 | |
| continue-on-error: true | |
| env: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SENTRY_ORG: freecodecamp | |
| SENTRY_PROJECT: artemis | |
| with: | |
| release: artemis@${{ needs.release-please.outputs.version }}+${{ needs.release-please.outputs.sha }} | |
| set_commits: auto | |
| finalize: false |