docs: Cleaning up changelog for v1.0.3 (#5977)
#72
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| - 'alpha*' | |
| - 'beta*' | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Tag to release (e.g., v0.58.8)' | |
| required: true | |
| type: string | |
| clobber: | |
| description: 'Overwrite existing release assets (--clobber)' | |
| required: false | |
| type: boolean | |
| default: false | |
| jobs: | |
| # Build and sign all binaries (reuses build.yml workflow) | |
| build-and-sign: | |
| name: Build and Sign All Binaries | |
| uses: ./.github/workflows/build.yml | |
| permissions: | |
| contents: write | |
| id-token: write | |
| actions: read | |
| secrets: inherit | |
| # Upload binaries to existing GitHub release | |
| upload-assets: | |
| name: Upload Release Assets | |
| needs: build-and-sign | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| actions: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Get version | |
| id: version | |
| env: | |
| INPUT_TAG: ${{ inputs.tag }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: .github/scripts/release/get-version.sh | |
| - name: Check if release exists | |
| id: check_release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: .github/scripts/release/check-release-exists.sh | |
| - name: Download pre-built signed binaries | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: all-signed-binaries | |
| path: bin/ | |
| - name: Verify binaries downloaded | |
| run: .github/scripts/release/verify-binaries-downloaded.sh bin 7 | |
| - name: Set execution permissions on binaries | |
| run: .github/scripts/release/set-permissions.sh bin | |
| - name: Create ZIP and TAR.GZ archives | |
| run: .github/scripts/release/create-archives.sh bin | |
| - name: Generate SHA256SUMS | |
| run: .github/scripts/release/generate-checksums.sh bin | |
| - name: Import GPG key and export public key | |
| env: | |
| SIGNING_GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }} | |
| run: | | |
| echo "${SIGNING_GPG_PRIVATE_KEY}" | base64 --decode | gpg --batch --import | |
| GPG_FINGERPRINT=$(gpg --list-secret-keys --keyid-format LONG | awk '/^sec/{sub(/.*\//, "", $2); print $2; exit}') | |
| echo "GPG_FINGERPRINT=${GPG_FINGERPRINT}" >> "${GITHUB_ENV}" | |
| gpg --armor --export "${GPG_FINGERPRINT}" > bin/terragrunt-signing-key.asc | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4 | |
| - name: Sign SHA256SUMS | |
| env: | |
| SIGNING_GPG_PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }} | |
| run: .github/scripts/release/sign-checksums.sh bin | |
| - name: Verify signatures before upload | |
| run: .github/scripts/release/verify-files.sh bin | |
| - name: Upload assets to release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| CLOBBER: ${{ github.event_name == 'workflow_dispatch' && inputs.clobber || 'false' }} | |
| run: .github/scripts/release/upload-assets.sh bin | |
| - name: Verify all assets uploaded | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| CLOBBER: ${{ github.event_name == 'workflow_dispatch' && inputs.clobber || 'false' }} | |
| run: .github/scripts/release/verify-assets-uploaded.sh bin | |
| - name: Upload summary | |
| if: always() | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| RELEASE_ID: ${{ steps.check_release.outputs.release_id }} | |
| IS_DRAFT: ${{ steps.check_release.outputs.is_draft }} | |
| run: .github/scripts/release/generate-upload-summary.sh |