Fix release-notes generation and publish pipeline (#169)

*migrate github cli from hub to gh (hub is deprecated) see annoncement actions/runner-images#8362 * github actions: bump checkout action from v2 to v4 * github actions / test workflow: remove fail-fast strategy=false. it's only apply to matrix build which has been remove in previous version * github actions bump gradle/wrapper-validation-action to v1.1.0 * github actions bump actions/setup-java to v4 * github actions: use gradle/gradle-build-action to setup gradle and remove cache action (too big so never loaded) * github actions: set publish channel as secret to avoid publish release when testing workflow * github actions: remove test before publish as it executed in previous pipeline Signed-off-by: Vincent Gramer <vgramer@gmail.com>
open-policy-agent · Feb 8, 2024 · 30ea778 · 30ea778
1 parent 63ddf24
commit 30ea778
Show file tree

Hide file tree

Showing 7 changed files with 45 additions and 68 deletions.
diff --git a/.github/release-notes-pr-description.md b/.github/release-notes-pr-description.md
@@ -1,5 +1,3 @@
-Update changelog
-
 # Description
 This PR is generated by the GitHub action and automatically updated when
 Pr(s) are merged on master.

diff --git a/.github/workflows/release_and_pulbish_plugin_on_tag.yml b/.github/workflows/release_and_pulbish_plugin_on_tag.yml
@@ -7,34 +7,32 @@ jobs:
   check-gradle-wrapper:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: actions/checkout@v4
+      - uses: gradle/wrapper-validation-action@v1.1.0
 
   publish_plugin:
     runs-on: ubuntu-latest
     needs: [check-gradle-wrapper]
     env:
-      ORG_GRADLE_PROJECT_publishChannel: stable
+      ORG_GRADLE_PROJECT_publishChannel: ${{ secrets.PUBLISH_CHANNEL }}
       ORG_GRADLE_PROJECT_publishToken: ${{ secrets.PUBLISH_TOKEN }}
     steps:
-#      # Cache gradle dependencies
-#      - uses: actions/cache@v2
-#        with:
-#          path: |
-#            ~/.gradle/caches
-#            ~/.gradle/wrapper
-#          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
-#          restore-keys: |
-#            ${{ runner.os }}-gradle-
+      - uses: actions/checkout@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: corretto
 
-      - uses: actions/checkout@v2
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@v2
+        with:
+          gradle-home-cache-cleanup: true
 
       - name: publish plugin
         run: |
           export ORG_GRADLE_PROJECT_pluginVersion="${GITHUB_REF/refs\/tags\//}"
-          ./gradlew clean :test :plugin:publishPlugin
+          ./gradlew :plugin:publishPlugin
 
       - name: Upload artifact
         uses: actions/upload-artifact@v2.2.2
@@ -48,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     needs : [ publish_plugin ]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Download Artifact
         uses: actions/download-artifact@v2
         id: download
@@ -58,15 +56,11 @@ jobs:
 
       - name: create or update release note PR
         env:
-          # Required for the `hub` CLI
+          # Required for the `gh` CLI
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="${GITHUB_REF/refs\/tags\//}"
           echo -e "${VERSION}\n" > gh_release_description.md
           sed -e '0,/Release notes for v/d' -e '/Release notes for v/,$d' CHANGELOG.md >> gh_release_description.md
 
-          assets=''
-          for file in $(ls ./artifacts/); do assets="${assets} -a ./artifacts/${file}"; done
-          echo "assets=${assets}"
-
-          hub release create -F gh_release_description.md ${assets} "${VERSION}"
+          gh release create -F gh_release_description.md "${VERSION}" ./artifacts/.*
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -14,41 +14,33 @@ jobs:
   check-license:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - run: ./hack/check-license.sh
 
   check-gradle-wrapper:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: actions/checkout@v4
+      - uses: gradle/wrapper-validation-action@v1.1.0
 
   build:
-    strategy:
-      fail-fast: false
     timeout-minutes: 60
     runs-on: ubuntu-latest
     needs: check-gradle-wrapper
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: 17
         distribution: corretto
 
-    # Cache gradle dependencies
-    - uses: actions/cache@v2
+    # Setup Gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2
       with:
-        path: |
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
+        gradle-home-cache-cleanup: true
 
     - name: Download OPA
       run: |
@@ -71,31 +63,24 @@ jobs:
     needs: [check-gradle-wrapper, build ]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: 17
           distribution: corretto
 
-      # Cache gradle dependencies
-      - uses: actions/cache@v2
+      # Setup Gradle
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@v2
         with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
+          gradle-home-cache-cleanup: true
 
       - uses: actions/cache@v2
         with:
           path: ~/.pluginVerifier/ides
           key: ${{ runner.os }}-plugin-verifier-ides
 
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
-
       - name: Verify plugin binary compatibility
         run: ./gradlew :plugin:runPluginVerifier
 

diff --git a/.github/workflows/upset_release_notes_pr_on_push_on_master.yml b/.github/workflows/upset_release_notes_pr_on_push_on_master.yml
@@ -10,7 +10,7 @@ jobs:
   upset_release_notes_pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           # needed to be able to resolve commit of previous version
           fetch-depth: 0

diff --git a/hack/create_or_update_release_notes_pr.sh b/hack/create_or_update_release_notes_pr.sh
@@ -8,7 +8,7 @@
 # This script is intended to be run in github action but can run in local.
 # The following requirements must be satisfied:
 #  * same requirement as hack/generate_release_notes.sh
-#  * the github cli: hub must be installed (https://hub.github.com/)
+#  * the github cli: gh must be installed (https://cli.github.com/)
 ########################################################################################################################
 
 set -o errexit
@@ -18,20 +18,20 @@ set -o pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 source "${ROOT}/hack/util.sh"
 
-util::require-hub
+util::require-gh
 
 release_note_branch='update-release-notes'
 base_branch='master'
-pr_number="$(hub pr list -h update-release-notes --format '%I')"
+pr_number="$(gh pr list -H update-release-notes --limit 1 --json number --jq '.[].number')"
 
 if [[ -z "${pr_number}" ]]; then
   pr_exist=false
   echo "release notes pr does note already exist"
   git checkout -b "${release_note_branch}"
 else
   pr_exist=true
-  echo "release notes pr already exist (#pr_number)"
-  hub pr checkout "${pr_number}"
+  echo "release notes pr already exist (pr_number=${pr_number})"
+  gh pr checkout "${pr_number}"
   git reset --hard "${base_branch}"
 fi
 
@@ -68,5 +68,5 @@ git push origin "${release_note_branch}" -f
 
 if [[ "${pr_exist}" == false ]]; then
 echo "create release note PR"
-  hub pull-request --base master --head "${release_note_branch}" --file "${ROOT}/.github/release-notes-pr-description.md"
+  gh pr create --base master --head "${release_note_branch}" --title "Update changelog" --body-file "${ROOT}/.github/release-notes-pr-description.md"
 fi
diff --git a/hack/generate_release_notes.sh b/hack/generate_release_notes.sh
@@ -9,7 +9,7 @@
 # This script is intended to be run in github action but can run in local.
 #
 # The following tools must be installed and be in the PATH
-#  * hub: the github cli (https://hub.github.com/)
+#  * gh: the github cli (https://cli.github.com/)
 #  * release-notes: the k8s release-notes-generator tools (https://github.com/kubernetes/release#release-notes)
 #                   can be install thanks to go get command:
 #                   GO111MODULE=on go get k8s.io/release/cmd/release-notes@<version>
@@ -51,7 +51,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 source "${ROOT}/hack/util.sh"
 
 function check_environment() {
-  util::require-hub
+  util::require-gh
   util::command_exists "release-notes" || util::fatal 'release-notes not found in path. Please install it before running script. "GO111MODULE=on go get k8s.io/release/cmd/release-notes@<version>"'
 
   set +o nounset
@@ -74,7 +74,7 @@ check_environment
 echo "org=${org} repo=${repo}"
 
 # format '%pI %T%n' -> "publish_date_ISO_8601 tag\n". eg:2 021-03-24T20:10:00Z v3.0.0
-last_release_tag="$(hub release -f '%pI %T%n' | sort -nr | head -1 | cut -d ' ' -f 2)"
+last_release_tag="$(gh api -t '{{.tag_name}}' -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "/repos/${org}/${repo}/releases/latest")"
 
 if [[ -z "${last_release_tag}" ]]; then
   echo "no release found on repository. fallback to first commit"

diff --git a/hack/util.sh b/hack/util.sh
@@ -40,7 +40,7 @@ function util::fatal() {
 	exit 1
 }
 
-# Check "hub" command exist and exit with error message if does not.
-function util::require-hub() {
-  util::command_exists "hub" || util::fatal 'hub not found in path. please install it before running script. see instruction at https://hub.github.com/'
+# Check "gh" command exist and exit with error message if does not.
+function util::require-gh() {
+  util::command_exists "gh" || util::fatal 'gh not found in path. please install it before running script. see instruction at https://cli.github.com/'
 }