Release/v1.8.7 #254
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Triggered by: a release/* → main pull request being merged. | |
| # | |
| # The build only runs after main has the code, so the review on the release-branch PR (enforced | |
| # by main's branch protection) is the gate that controls what ships. | |
| # | |
| # Flow: | |
| # PR merged into main from release/vX.Y.Z | |
| # │ | |
| # ▼ | |
| # compute-release-tag (read version from package.json on the merge commit) | |
| # │ | |
| # ▼ | |
| # check-release-not-published (guard: fail if vX.Y.Z release is already published) | |
| # │ | |
| # ▼ | |
| # create-signed-tag (push vX.Y.Z-signed tag on the merge commit) | |
| # │ | |
| # ├─► run-release (Mac) | |
| # │ uses release_mac.yml | |
| # │ | |
| # ├─► run-release-linux | |
| # │ uses release_linux.yml | |
| # │ | |
| # └─► run-release-win | |
| # uses release_win.yml | |
| name: Production Release | |
| on: | |
| pull_request: | |
| types: [closed] | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| actions: write # required by calculate-and-update-version.yml to re-dispatch CI for the version-bump commit | |
| # Each release PR has a unique number, so concurrent releases for different | |
| # PRs run independently. Re-runs for the same PR queue rather than cancel. | |
| concurrency: | |
| group: production-release-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| compute-release-tag: | |
| # Only act on merged (not just closed) PRs whose source branch is release/*. | |
| # Hotfixes follow the same pattern — branch named release/vX.Y.Z. | |
| if: > | |
| github.event.pull_request.merged == true && | |
| startsWith(github.event.pull_request.head.ref, 'release/') | |
| runs-on: ubuntu-latest | |
| outputs: | |
| release_tag: ${{ steps.compute-tag.outputs.release_tag }} | |
| signed_tag: ${{ steps.compute-tag.outputs.signed_tag }} | |
| merge_sha: ${{ steps.compute-tag.outputs.merge_sha }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.event.pull_request.merge_commit_sha }} | |
| fetch-depth: 0 | |
| - name: Read version from merged package.json | |
| id: compute-tag | |
| run: | | |
| # The version bump is set on the release branch by bump-release-version.yml | |
| # before the PR is opened, and lands on main as part of the merged diff. | |
| # CI just reads what's there. | |
| VERSION=$(node -p "require('./package.json').version") | |
| # Git tag is vX.Y.Z-signed (for audit); electron-builder publishes | |
| # the GitHub Release at the unsuffixed vX.Y.Z. | |
| echo "release_tag=v${VERSION}" | tee -a "$GITHUB_OUTPUT" | |
| echo "signed_tag=v${VERSION}-signed" | tee -a "$GITHUB_OUTPUT" | |
| echo "merge_sha=${{ github.event.pull_request.merge_commit_sha }}" | tee -a "$GITHUB_OUTPUT" | |
| check-release-not-published: | |
| needs: compute-release-tag | |
| uses: ./.github/workflows/check-release-not-published.yml | |
| with: | |
| release_tag: ${{ needs.compute-release-tag.outputs.release_tag }} | |
| secrets: inherit | |
| create-signed-tag: | |
| needs: [compute-release-tag, check-release-not-published] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ needs.compute-release-tag.outputs.merge_sha }} | |
| fetch-depth: 0 | |
| - name: Configure git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Create and push -signed tag on the merge commit | |
| run: | | |
| SIGNED_TAG="${{ needs.compute-release-tag.outputs.signed_tag }}" | |
| # Idempotency: if the workflow is re-run (e.g. cancelled and restarted | |
| # before the build jobs ran), recreate the tag cleanly. A tag whose | |
| # release has already been published is rejected upstream by | |
| # check-release-not-published.yml. | |
| git tag -d "$SIGNED_TAG" 2>/dev/null || true | |
| git push origin --delete "$SIGNED_TAG" 2>/dev/null || true | |
| git tag -a "$SIGNED_TAG" -m "Production Release $SIGNED_TAG" | |
| git push origin "$SIGNED_TAG" | |
| ensure-draft-release: | |
| needs: [compute-release-tag, create-signed-tag] | |
| uses: ./.github/workflows/ensure-draft-release.yml | |
| with: | |
| release_tag: ${{ needs.compute-release-tag.outputs.release_tag }} | |
| secrets: inherit | |
| run-release: | |
| needs: [compute-release-tag, create-signed-tag, ensure-draft-release] | |
| uses: ./.github/workflows/release_mac.yml | |
| with: | |
| tag: ${{ needs.compute-release-tag.outputs.signed_tag }} | |
| secrets: inherit | |
| run-release-linux: | |
| needs: [compute-release-tag, create-signed-tag, ensure-draft-release] | |
| uses: ./.github/workflows/release_linux.yml | |
| with: | |
| tag: ${{ needs.compute-release-tag.outputs.signed_tag }} | |
| secrets: inherit | |
| run-release-win: | |
| needs: [compute-release-tag, create-signed-tag, ensure-draft-release] | |
| uses: ./.github/workflows/release_win.yml | |
| with: | |
| tag: ${{ needs.compute-release-tag.outputs.signed_tag }} | |
| secrets: inherit | |
| merge-latest-mac-yml: | |
| needs: [compute-release-tag, run-release] | |
| uses: ./.github/workflows/merge-latest-mac-yml.yml | |
| with: | |
| tag: ${{ needs.compute-release-tag.outputs.signed_tag }} | |
| secrets: inherit | |
| summary: | |
| needs: [compute-release-tag, run-release, run-release-win, run-release-linux, merge-latest-mac-yml] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Create summary | |
| run: | | |
| echo "## Release Created Successfully :rocket:" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Tag:** ${{ needs.compute-release-tag.outputs.signed_tag }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**PR:** #${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "The draft GitHub Release for **${{ needs.compute-release-tag.outputs.release_tag }}** is ready." >> $GITHUB_STEP_SUMMARY | |
| echo "QA: please test the installers on macOS / Windows / Linux." >> $GITHUB_STEP_SUMMARY | |
| echo "Once QA passes, click **Publish** on the draft release in GitHub." >> $GITHUB_STEP_SUMMARY |