grafana-foundation-sdk/.github/workflows/release.yaml at c276cc4c011ceb0f8027e75ec11938494641d9d6 · grafana/grafana-foundation-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: Release
on:
  push:
    branches: ["main"]
  workflow_dispatch: ~

env:
  DEVBOX_VERSION: '0.16.0'

# Grant GITHUB_TOKEN the permissions required to make a release
permissions:
  contents: write # to push new branches
  pull-requests: write # to open PRs
  id-token: write # to retrieve vault secrets

# Allow only one concurrent release, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these releases to complete.
concurrency:
  group: "release"
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  release:
    name: Prepare and perform a release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Setup cog
        uses: ./.github/actions/setup-cog

      - name: Install devbox
        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 #v0.14.0
        with:
          enable-cache: 'true'
          devbox-version: ${{ env.DEVBOX_VERSION }}

      - name: Get secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@75804962c1ba608148988c1e2dc35fbb0ee21746
        with:
          repo_secrets: |
            GITHUB_APP_ID=github_app:app-id
            GITHUB_APP_PRIVATE_KEY=github_app:private-key

      - name: Generate github private token
        id: generate_github_token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ env.GITHUB_APP_ID }}
          private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - name: Prepare a release
        run: |
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
          git config --global url."https://x-access-token:${{ env.GENERATED_GITHUB_TOKEN }}@github.com/".insteadOf "git@github.com:"

          devbox run ./scripts/prepare-release.sh
        env:
          TERM: 'xterm'
          LOG_LEVEL: '7' # debug
          GOGC: 'off'
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # to be used by `gh`
          DRY_RUN: 'no'
          SKIP_VALIDATION: 'no'
          GENERATED_GITHUB_TOKEN: ${{ steps.generate_github_token.outputs.token }}

      - name: Release
        run: |
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
          git config --global url."https://x-access-token:${{ env.GENERATED_GITHUB_TOKEN }}@github.com/".insteadOf "git@github.com:"

          devbox run ./scripts/release.sh
        env:
          TERM: 'xterm'
          LOG_LEVEL: '7' # debug
          GOGC: 'off'
          DRY_RUN: 'no'
          GENERATED_GITHUB_TOKEN: ${{ steps.generate_github_token.outputs.token }}