-
Notifications
You must be signed in to change notification settings - Fork 1
510 lines (458 loc) · 23.3 KB
/
reusable-release.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
name: Scala Library Release Workflow
on:
workflow_call:
inputs:
GITHUB_APP_ID:
description:
"App ID for a GitHub App that is allowed to push directly to the default branch. Eg, App ID on:
https://github.com/organizations/guardian/settings/apps/gu-scala-library-release"
default: '807361' # Only for use by the Guardian!
required: false # ...but if you're not the Guardian, you'll want to set this explicitly
type: string
SONATYPE_PROFILE_NAME:
description: 'Sonatype account profile name, eg "com.gu", "org.xerial", etc (not your Sonatype username)'
default: 'com.gu' # Only for use by the Guardian!
required: false # Must be supplied if used by a non-Guardian project
type: string
SONATYPE_CREDENTIAL_HOST:
description: 'The host of your SONATYPE_PROFILE_NAME, either "oss.sonatype.org" or "s01.oss.sonatype.org"'
default: 'oss.sonatype.org' # The default host is going to be whatever "com.gu" is using
required: false # ...but if you're not the Guardian, you'll want to set this explicitly
type: string
secrets:
SONATYPE_TOKEN:
description: 'Sonatype authentication token, colon-separated (username:password) - https://central.sonatype.org/publish/generate-token/'
required: true
PGP_PRIVATE_KEY:
description:
"A passphrase-less PGP private key used to sign artifacts, commits, & tags.
Should be in normal plaintext (ASCII-armored) format, starting 'BEGIN PGP PUBLIC KEY BLOCK', with no additional BASE64-encoding.
The passphrase can be removed from an existing key using 'gpg --edit-key <key-id> passwd' : https://unix.stackexchange.com/a/550538/46453"
required: true
GITHUB_APP_PRIVATE_KEY:
description:
"See https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps#generating-private-keys
Should be in normal plaintext format, starting '-----BEGIN RSA PRIVATE KEY-----'"
required: true
outputs:
RELEASE_VERSION:
description: "The un-prefixed version number of the release, eg '3.0.1'"
value: ${{ jobs.push-release-commit.outputs.release_version }}
RELEASE_TYPE:
description: "Either 'FULL_MAIN_BRANCH' or 'PREVIEW_FEATURE_BRANCH' - whether this is a full release or a pre-release"
value: ${{ jobs.init.outputs.release_type }}
env:
LOCAL_ARTIFACTS_STAGING_PATH: /tmp/artifact_staging
COMMITTER_NAME: "@${{github.actor}} using gha-scala-library-release-workflow"
RUN_ATTEMPT_UID: ${{ github.run_id }}-${{ github.run_attempt }}
TEMPORARY_BRANCH: release-workflow/temporary/${{ github.run_id }}
GITHUB_REPO_URL: ${{ github.server_url }}/${{ github.repository }}
jobs:
init:
name: 🔒 Init
runs-on: ubuntu-latest
outputs:
key_fingerprint: ${{ steps.read-identifiers.outputs.key_fingerprint }}
key_email: ${{ steps.read-identifiers.outputs.key_email }}
release_type: ${{ steps.generate-version-suffix.outputs.release_type }}
version_suffix: ${{ steps.generate-version-suffix.outputs.version_suffix }}
steps:
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Read Identifiers from Signing Key
id: read-identifiers
run: |
key_fingerprint_and_email=$(gpg2 --list-secret-keys --list-options show-only-fpr-mbox)
key_fingerprint=$(echo $key_fingerprint_and_email | awk '{print $1}')
key_email=$(echo $key_fingerprint_and_email | awk '{print $2}')
echo "key_fingerprint=$key_fingerprint"
cat << EndOfFile >> $GITHUB_OUTPUT
key_fingerprint=$key_fingerprint
key_email=$key_email
EndOfFile
if ! [[ "$key_fingerprint" =~ ^[[:xdigit:]]{8,}$ ]]; then
echo "::error title=Missing PGP key::Has PGP_PRIVATE_KEY been set correctly? https://github.com/guardian/gha-scala-library-release-workflow/blob/main/docs/credentials/supplying-credentials.md"
exit 1
fi
- name: Check for default branch
id: generate-version-suffix
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
default_branch=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name ${{ github.repository }})
if [[ "$default_branch" = $GITHUB_REF_NAME ]]; then
release_type="FULL_MAIN_BRANCH"
version_suffix=""
else
release_type="PREVIEW_FEATURE_BRANCH"
version_suffix="-PREVIEW.${GITHUB_REF_NAME//[^[:alnum:]-]/}.$(date +%Y-%m-%dT%H%M).${GITHUB_SHA:0:8}"
fi
echo "current branch: $GITHUB_REF_NAME, release_type: $release_type, version_suffix: $version_suffix"
cat << EndOfFile >> $GITHUB_OUTPUT
release_type=$release_type
version_suffix=$version_suffix
EndOfFile
generate-version-update-commits:
name: 🎊 Test & Version
needs: init
runs-on: ubuntu-latest
outputs:
library_build_major_java_version: ${{ steps.establish_java_for_library_build.outputs.library_build_major_java_version }}
steps:
- uses: actions/checkout@v4
- id: establish_java_for_library_build
name: Establish library build Java version
run: |
if [ ! -f .tool-versions ]; then
echo "::error title=Missing .tool-versions file::gha-scala-library-release-workflow requires an asdf-format .tool-versions file to establish the Java version for the build."
exit 1
fi
LIBRARY_BUILD_MAJOR_JAVA_VERSION=$( grep -Eo 'java [[:alnum:]-]+-[[:digit:]]+' .tool-versions | rev | cut -d'-' -f1 | rev )
echo "Using Java $LIBRARY_BUILD_MAJOR_JAVA_VERSION"
if [ -z "${LIBRARY_BUILD_MAJOR_JAVA_VERSION}" ]; then
echo "::error title=Missing Java version in .tool-versions file::Could not establish the library's required Java version - the '.tool-versions' file should have a line like 'java corretto-21.0.3.9.1'."
exit 1
fi
cat << EndOfFile >> $GITHUB_OUTPUT
library_build_major_java_version=$LIBRARY_BUILD_MAJOR_JAVA_VERSION
EndOfFile
- uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is merged
with:
distribution: corretto
java-version: ${{ steps.establish_java_for_library_build.outputs.library_build_major_java_version }}
# - name: Debug MIMA assessment
# run: |
# sbt "show versionPolicyFindIssues"
- name: Use sbt-release to construct version.sbt updates
run: |
git config user.email "${{ needs.init.outputs.key_email }}"
git config user.name "$COMMITTER_NAME"
sbt_commands_file=$(mktemp)
cat << EndOfFile > $sbt_commands_file
set releaseVersion := releaseVersion.value.andThen(_ + "${{ needs.init.outputs.version_suffix }}")
release with-defaults
EndOfFile
cat $sbt_commands_file
sbt ";< $sbt_commands_file"
echo $GITHUB_WORKSPACE
cd `mktemp -d`
git clone --bare $GITHUB_WORKSPACE repo-with-unsigned-version-update-commits.git
rm -Rf $GITHUB_WORKSPACE/*
mv repo-with-unsigned-version-update-commits.git $GITHUB_WORKSPACE/
ls -lR $GITHUB_WORKSPACE
- name: Job summary
run: |
cat << EndOfFile >> $GITHUB_STEP_SUMMARY
# Release $(git describe --tags --abbrev=0)
Library built with Java ${{ steps.establish_java_for_library_build.outputs.library_build_major_java_version }}.
EndOfFile
- uses: actions/cache/save@v4
with:
path: repo-with-unsigned-version-update-commits.git
key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}
push-release-commit:
name: 🔒 Push Release Commit
needs: [generate-version-update-commits, init]
permissions:
contents: write
runs-on: ubuntu-latest
outputs:
release_tag: ${{ steps.create-commit.outputs.release_tag }}
release_version: ${{ steps.create-commit.outputs.release_version }}
release_commit_id: ${{ steps.create-commit.outputs.release_commit_id }}
version_file_path: ${{ steps.create-commit.outputs.version_file_path }}
version_file_release_sha: ${{ steps.create-commit.outputs.version_file_release_sha }}
version_file_post_release_content: ${{ steps.create-commit.outputs.version_file_post_release_content }}
steps:
- id: generate-github-app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ inputs.GITHUB_APP_ID }}
private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
- uses: actions/checkout@v4
with:
path: repo
- uses: actions/cache/restore@v4
with:
path: repo-with-unsigned-version-update-commits.git
key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Create commit
id: create-commit
env:
KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
KEY_EMAIL: ${{ needs.init.outputs.key_email }}
GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
GH_REPO: ${{ github.repository }}
run: |
echo "GITHUB_REF_NAME=$GITHUB_REF_NAME"
echo "GITHUB_REF=$GITHUB_REF"
cd repo-with-unsigned-version-update-commits.git
RELEASE_TAG=$(git describe --tags --abbrev=0)
cd ../repo
git remote add unsigned ../repo-with-unsigned-version-update-commits.git
git fetch unsigned
RELEASE_VERSION=${RELEASE_TAG#"v"}
VERSION_FILE_PATH=$(git diff-tree --no-commit-id --name-only -r $RELEASE_TAG | grep version.sbt)
VERSION_FILE_INITIAL_SHA=$( git rev-parse $GITHUB_REF:$VERSION_FILE_PATH )
VERSION_FILE_RELEASE_SHA=$( git rev-parse $RELEASE_TAG:$VERSION_FILE_PATH )
VERSION_FILE_RELEASE_CONTENT=$( git cat-file blob $RELEASE_TAG:$VERSION_FILE_PATH | base64 -w0)
VERSION_FILE_POST_RELEASE_CONTENT=$( git cat-file blob unsigned/$GITHUB_REF_NAME:$VERSION_FILE_PATH | base64 -w0)
cd ..
cat << EndOfFile > commit-message.txt
$RELEASE_TAG published by ${{github.actor}}
${{github.actor}} published release version $RELEASE_VERSION
using gha-scala-library-release-workflow: https://github.com/guardian/gha-scala-library-release-workflow
Release-Version: $RELEASE_VERSION
Release-Initiated-By: ${{ github.server_url }}/${{github.actor}}
Release-Workflow-Run: $GITHUB_REPO_URL/actions/runs/${{ github.run_id }}
GitHub-Release-Notes: $GITHUB_REPO_URL/releases/tag/$RELEASE_TAG
EndOfFile
# Create temporary branch to push the release commit- required for PREVIEW releases
gh api --method POST /repos/:owner/:repo/git/refs -f ref="refs/heads/$TEMPORARY_BRANCH" -f sha="$GITHUB_SHA"
release_commit_id=$(gh api --method PUT /repos/:owner/:repo/contents/$VERSION_FILE_PATH \
--field branch="$TEMPORARY_BRANCH" \
--field message="@commit-message.txt" \
--field sha="$VERSION_FILE_INITIAL_SHA" \
--field content="$VERSION_FILE_RELEASE_CONTENT" --jq '.commit.sha')
cat << EndOfFile >> $GITHUB_OUTPUT
release_tag=$RELEASE_TAG
release_version=$RELEASE_VERSION
release_commit_id=$release_commit_id
version_file_path=$VERSION_FILE_PATH
version_file_release_sha=$VERSION_FILE_RELEASE_SHA
version_file_post_release_content=$VERSION_FILE_POST_RELEASE_CONTENT
EndOfFile
create-artifacts:
name: 🎊 Create artifacts
needs: [init, generate-version-update-commits, push-release-commit]
runs-on: ubuntu-latest
outputs:
ARTIFACT_SHA256SUMS: ${{ steps.record-hashes.outputs.ARTIFACT_SHA256SUMS }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
- uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is resolved
with:
distribution: corretto
java-version: ${{ needs.generate-version-update-commits.outputs.library_build_major_java_version }}
- name: Generate artifacts
run: |
cat << EndOfFile > sbt-commands.txt
set every sonatypeProjectHosting := Some(xerial.sbt.Sonatype.GitHubHosting("$GITHUB_REPOSITORY_OWNER", "${GITHUB_REPOSITORY#*/}", "${{ needs.init.outputs.key_email }}"))
set ThisBuild / publishTo := Some(Resolver.file("foobar", file("$LOCAL_ARTIFACTS_STAGING_PATH")))
EndOfFile
cat sbt-commands.txt
sbt ";< sbt-commands.txt; +publish"
- name: Record SHA-256 hashes of artifacts
id: record-hashes
run: |
sudo apt-get install hashdeep -q > /dev/null
cd $LOCAL_ARTIFACTS_STAGING_PATH
{
echo 'ARTIFACT_SHA256SUMS<<EOF'
sha256deep -r -l .
echo EOF
} >> "$GITHUB_OUTPUT"
- uses: actions/cache/save@v4
id: cache
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: unsigned-${{ env.RUN_ATTEMPT_UID }}
sign:
name: 🔒 Sign
needs: [init, push-release-commit, create-artifacts]
runs-on: ubuntu-latest
env:
KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
steps:
- id: generate-github-app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ inputs.GITHUB_APP_ID }}
private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
- uses: actions/checkout@v4
with:
path: repo
ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
fetch-depth: 1 # For tag-signing, we only need the release commit - branch operations done with GitHub API
token: ${{ steps.generate-github-app-token.outputs.token }}
persist-credentials: true # Allow us to push as the GitHub App, and bypass branch ruleset
- uses: actions/cache/restore@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: unsigned-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- name: Verify artifact hashes before signing
env:
ARTIFACT_SHA256SUMS: ${{ needs.create-artifacts.outputs.ARTIFACT_SHA256SUMS }}
run: |
sudo apt-get install hashdeep -q > /dev/null
ARTIFACT_SHA256SUMS_FILE=$( mktemp )
printf "$ARTIFACT_SHA256SUMS" > $ARTIFACT_SHA256SUMS_FILE
cd $LOCAL_ARTIFACTS_STAGING_PATH
echo "Checking artifact hashes..."
if [[ $(sha256deep -r -l -X "$ARTIFACT_SHA256SUMS_FILE" .) ]]
then
echo "::error title=Artifact hash verification failed::Artifacts for signing don't match the hash values recorded when they were generated."
exit 1
fi
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
- name: Sign artifacts
run: |
echo "KEY_FINGERPRINT=$KEY_FINGERPRINT"
find $LOCAL_ARTIFACTS_STAGING_PATH -type f -exec gpg -a --local-user "$KEY_FINGERPRINT" --detach-sign {} \;
- name: "Full Main-Branch release: Add release commit (from temporary release branch) to default branch"
if: needs.init.outputs.release_type == 'FULL_MAIN_BRANCH'
env:
GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
GH_REPO: ${{ github.repository }}
RELEASE_COMMIT_ID: ${{ needs.push-release-commit.outputs.release_commit_id }}
run: |
if gh api --silent --method PATCH /repos/:owner/:repo/git/refs/heads/$GITHUB_REF_NAME -f "sha=$RELEASE_COMMIT_ID"; then
echo "...fast-forward of default branch to include release commit succeeded"
else
echo "...fast-forward failed (commits added to default branch while release running?), will attempt a merge instead"
gh api --silent --method POST /repos/:owner/:repo/merges -f "base=$GITHUB_REF_NAME" -f "head=$RELEASE_COMMIT_ID"
fi
- name: Push signed tag
env:
RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
RELEASE_COMMIT_ID: ${{ needs.push-release-commit.outputs.release_commit_id }}
KEY_EMAIL: ${{ needs.init.outputs.key_email }}
ARTIFACT_SHA256SUMS: ${{ needs.create-artifacts.outputs.ARTIFACT_SHA256SUMS }}
run: |
cd $GITHUB_WORKSPACE/repo
git config user.email "$KEY_EMAIL"
git config user.name "$COMMITTER_NAME"
git config tag.gpgSign true
git config user.signingkey "$KEY_FINGERPRINT"
cat << EndOfFile > tag-message.txt
Release $RELEASE_TAG initiated by $COMMITTER_NAME
$ARTIFACT_SHA256SUMS
EndOfFile
echo "Message is..."
cat tag-message.txt
echo "Creating release tag (including artifact hashes)"
git tag -a -F tag-message.txt $RELEASE_TAG $RELEASE_COMMIT_ID
echo "Pushing tag $RELEASE_TAG"
git push origin $RELEASE_TAG
- uses: actions/cache/save@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: signed-${{ env.RUN_ATTEMPT_UID }}
sonatype-release:
name: 🔒 Sonatype Release
needs: [push-release-commit, sign]
runs-on: ubuntu-latest
steps:
- uses: actions/cache/restore@v4
with:
path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
key: signed-${{ env.RUN_ATTEMPT_UID }}
fail-on-cache-miss: true
- name: Create tiny sbt project to perform Sonatype upload
run: |
cat << EndOfFile > build.sbt
sonatypeBundleDirectory := new File("$LOCAL_ARTIFACTS_STAGING_PATH")
sonatypeProfileName := "${{ inputs.SONATYPE_PROFILE_NAME }}"
sonatypeCredentialHost := "${{ inputs.SONATYPE_CREDENTIAL_HOST }}"
version := "${{ needs.push-release-commit.outputs.release_version }}"
EndOfFile
mkdir project
echo 'addSbtPlugin("org.xerial.sbt" % "sbt-sonatype" % "3.10.0")' > project/plugins.sbt
echo 'sbt.version = 1.9.9' > project/build.properties
ls -lR .
- uses: actions/setup-java@v4
with:
distribution: corretto
java-version: 17
cache: sbt # the issue described in https://github.com/actions/setup-java/pull/564 doesn't affect this step (no version.sbt)
- name: Release
env:
SONATYPE_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
run: |
export SONATYPE_USERNAME="${SONATYPE_TOKEN%%:*}" # See https://github.com/xerial/sbt-sonatype/pull/62
export SONATYPE_PASSWORD="${SONATYPE_TOKEN#*:}"
sbt "sonatypeBundleRelease"
github-release:
name: 🔒 Update GitHub
needs: [init, push-release-commit, sign]
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
env:
RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
RELEASE_VERSION: ${{ needs.push-release-commit.outputs.release_version }}
GH_REPO: ${{ github.repository }}
steps:
- id: generate-github-app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ inputs.GITHUB_APP_ID }}
private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
- name: Clean-up temporary branch that was retaining the now-tagged release commit
env:
GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
run: |
gh api --method DELETE /repos/:owner/:repo/git/refs/heads/$TEMPORARY_BRANCH
- name: Common values
run: |
GITHUB_ACTIONS_PATH="$GITHUB_REPO_URL/actions"
GITHUB_WORKFLOW_FILE="release.yml" # Could be derived from $GITHUB_WORKFLOW_REF
GITHUB_WORKFLOW_URL="$GITHUB_ACTIONS_PATH/workflows/$GITHUB_WORKFLOW_FILE"
cat << EndOfFile >> $GITHUB_ENV
GITHUB_WORKFLOW_FILE=$GITHUB_WORKFLOW_FILE
GITHUB_WORKFLOW_LINK=[GitHub UI]($GITHUB_WORKFLOW_URL)
GITHUB_WORKFLOW_RUN_LINK=[#${{ github.run_number }}]($GITHUB_ACTIONS_PATH/runs/${{ github.run_id }})
EndOfFile
- name: Create Github Release and update version.sbt post-release
if: needs.init.outputs.release_type == 'FULL_MAIN_BRANCH'
env:
GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
run: |
gh release create $RELEASE_TAG --verify-tag --generate-notes --notes "Release run: $GITHUB_WORKFLOW_RUN_LINK"
echo "GitHub Release notes: [$RELEASE_TAG]($GITHUB_REPO_URL/releases/tag/$RELEASE_TAG)" >> $GITHUB_STEP_SUMMARY
cat << EndOfFile > commit-message.txt
Post-release of $RELEASE_TAG by @${{github.actor}}: set snapshot version
Setting snapshot version after @${{github.actor}} published $GITHUB_REPO_URL/releases/tag/$RELEASE_TAG
EndOfFile
gh api --method PUT /repos/:owner/:repo/contents/${{ needs.push-release-commit.outputs.version_file_path }} \
--field message="@commit-message.txt" \
--field sha="${{ needs.push-release-commit.outputs.version_file_release_sha }}" \
--field content="${{ needs.push-release-commit.outputs.version_file_post_release_content }}"
- name: Update PR with comment
if: needs.init.outputs.release_type == 'PREVIEW_FEATURE_BRANCH'
env:
GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
run: |
cat << EndOfFile > comment_body.txt
@${{github.actor}} has published a preview version of this PR with release workflow run $GITHUB_WORKFLOW_RUN_LINK, based on commit ${{ github.sha }}:
$RELEASE_VERSION
<details>
<summary>Want to make another preview release?</summary>
Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, specifying the $GITHUB_REF_NAME branch, or use the [GitHub CLI](https://cli.github.com/) command:
gh workflow run $GITHUB_WORKFLOW_FILE --ref $GITHUB_REF_NAME
</details>
<details>
<summary>Want to make a full release after this PR is merged?</summary>
Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, leaving the branch as the default, or use the [GitHub CLI](https://cli.github.com/) command:
gh workflow run $GITHUB_WORKFLOW_FILE
</details>
EndOfFile
cat comment_body.txt
gh pr comment ${{ github.ref_name }} --body-file comment_body.txt >> $GITHUB_STEP_SUMMARY