Release Standalone #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Standalone | |
| on: | |
| workflow_run: | |
| workflows: [Build and Push Docker Image] | |
| types: [completed] | |
| branches: [main] | |
| concurrency: | |
| group: release-standalone | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| check: | |
| name: Check for new version | |
| if: github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| outputs: | |
| version: ${{ steps.v.outputs.version }} | |
| release: ${{ steps.v.outputs.release }} | |
| sha: ${{ github.event.workflow_run.head_sha }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| - id: v | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| WEBAPP=$(node -p "require('./standalone/webapp/package.json').version") | |
| SERVER=$(node -p "require('./standalone/server/package.json').version") | |
| if [ "$WEBAPP" != "$SERVER" ]; then | |
| echo "::error::standalone/webapp is $WEBAPP but standalone/server is $SERVER" | |
| exit 1 | |
| fi | |
| if [[ "$WEBAPP" == *-* || "$WEBAPP" == *+* ]]; then | |
| echo "::error::standalone version $WEBAPP is not strict SemVer MAJOR.MINOR.PATCH." | |
| exit 1 | |
| fi | |
| if gh release view "v$WEBAPP" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then | |
| echo "release=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "release=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| echo "version=$WEBAPP" >> "$GITHUB_OUTPUT" | |
| release: | |
| name: Retag, sign, release, deploy | |
| needs: [check] | |
| if: needs.check.outputs.release == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write # tag + GitHub Release | |
| packages: write # retag images in GHCR | |
| id-token: write # OIDC for keyless cosign signing | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ needs.check.outputs.sha }} | |
| # Full history so extract-changelog.mjs can resolve each changelog | |
| # entry's commit type (feat/fix/...) to group the release notes. | |
| fetch-depth: 0 | |
| # Pin Node for the changelog-extraction step in "Create GitHub Release" | |
| # rather than relying on the runner's ambient version. | |
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 | |
| with: | |
| node-version-file: ".nvmrc" | |
| - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 | |
| with: | |
| # Pin cosign itself — cosign-installer@v3.x defaults to a | |
| # cosign v2.x release and we sign / publish-verify against | |
| # the v2 CLI surface. Cosign v3 changed the verify bundle | |
| # format; bumping requires cosign-installer@v4 AND updating | |
| # the verify instructions in the release-notes body below. | |
| cosign-release: v2.4.3 | |
| - name: Retag and sign images | |
| env: | |
| VERSION: ${{ needs.check.outputs.version }} | |
| COMMIT_SHA: ${{ needs.check.outputs.sha }} | |
| run: | | |
| for IMAGE in \ | |
| ghcr.io/ls1intum/apollon/webapp \ | |
| ghcr.io/ls1intum/apollon/server; do | |
| docker buildx imagetools create --tag "$IMAGE:$VERSION" "$IMAGE:sha-$COMMIT_SHA" | |
| DIGEST=$(docker buildx imagetools inspect "$IMAGE:$VERSION" --format '{{.Manifest.Digest}}') | |
| cosign sign --yes "$IMAGE@$DIGEST" | |
| done | |
| - name: Ensure release tag exists | |
| env: | |
| VERSION: ${{ needs.check.outputs.version }} | |
| COMMIT_SHA: ${{ needs.check.outputs.sha }} | |
| run: | | |
| TAG="v${VERSION}" | |
| if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then | |
| echo "Tag $TAG already exists on origin" | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git tag "$TAG" "$COMMIT_SHA" | |
| git push origin "refs/tags/$TAG" | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ needs.check.outputs.version }} | |
| COMMIT_SHA: ${{ needs.check.outputs.sha }} | |
| run: | | |
| set -euo pipefail | |
| # Body = the Changesets-owned CHANGELOG sections for the paired webapp | |
| # + server, merged (a server-only changeset lands only in the server | |
| # file; dupes from a library cascade collapse to one) and regrouped by | |
| # category (Features/Bug Fixes/...) from each entry's commit type, plus | |
| # the Docker + cosign footer. Fall back to GitHub's --generate-notes | |
| # only when neither package has a section for this version. | |
| CHANGELOG=$(node scripts/extract-changelog.mjs "$VERSION" standalone/webapp standalone/server) | |
| { | |
| if [ -n "$CHANGELOG" ]; then printf '%s\n\n' "$CHANGELOG"; fi | |
| cat <<EOF | |
| ## Docker images | |
| - \`ghcr.io/ls1intum/apollon/webapp:${VERSION}\` | |
| - \`ghcr.io/ls1intum/apollon/server:${VERSION}\` | |
| Signed with [Sigstore cosign](https://docs.sigstore.dev/cosign/verifying/verify/) (keyless, GitHub OIDC). Verify with: | |
| \`\`\`sh | |
| cosign verify ghcr.io/ls1intum/apollon/webapp:${VERSION} \\ | |
| --certificate-identity-regexp='^https://github\\.com/ls1intum/Apollon/\\.github/workflows/release-standalone\\.yml@refs/heads/main\$' \\ | |
| --certificate-oidc-issuer=https://token.actions.githubusercontent.com | |
| \`\`\` | |
| EOF | |
| } > release-notes.md | |
| GENERATE=() | |
| [ -z "$CHANGELOG" ] && GENERATE=(--generate-notes) | |
| gh release create "v${VERSION}" \ | |
| --title "v${VERSION}" \ | |
| --target "$COMMIT_SHA" \ | |
| --verify-tag \ | |
| --latest \ | |
| "${GENERATE[@]}" \ | |
| --notes-file release-notes.md |