Release v6.0.13-dev.2 #2594
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ~~ Generated by projen. To modify, edit .projenrc.ts and run "yarn projen". | |
| name: release | |
| run-name: Release ${{ github.ref_name }} | |
| on: | |
| push: | |
| tags: | |
| - v*.*.* | |
| jobs: | |
| build: | |
| name: Build release package | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| outputs: | |
| dist-tag: ${{ steps.publish-target.outputs.dist-tag }} | |
| latest: ${{ steps.publish-target.outputs.latest }} | |
| github-release: ${{ steps.publish-target.outputs.github-release }} | |
| prerelease: ${{ steps.publish-target.outputs.prerelease }} | |
| env: | |
| CI: "true" | |
| steps: | |
| - name: Checkout | |
| id: checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.sha }} | |
| repository: ${{ github.repository }} | |
| filter: blob:none | |
| - name: Enable corepack | |
| id: enable_corepack | |
| run: corepack enable | |
| - name: Setup Node.js | |
| id: setup_node_js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: lts/* | |
| package-manager-cache: false | |
| - name: Install dependencies | |
| id: install_dependencies | |
| run: yarn install --immutable | |
| - name: Prepare Release | |
| id: prepare_release | |
| env: | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: yarn release "$RELEASE_TAG" | |
| - name: Determine Target | |
| id: publish-target | |
| env: | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: yarn ts-node projenrc/publish-target.ts "$RELEASE_TAG" | |
| - name: Federate to AWS | |
| id: federate_to_aws | |
| if: fromJSON(steps.publish-target.outputs.github-release) | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| aws-region: us-east-1 | |
| role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} | |
| role-session-name: GHA-aws-jsii-rosetta@${{ github.ref_name }} | |
| - name: Sign Tarball | |
| id: sign_tarball | |
| if: fromJSON(steps.publish-target.outputs.github-release) | |
| run: |- | |
| set -eo pipefail | |
| export GNUPGHOME=$(mktemp -d) | |
| echo "charset utf-8" > ${GNUPGHOME}/gpg.conf | |
| echo "no-comments" >> ${GNUPGHOME}/gpg.conf | |
| echo "no-emit-version" >> ${GNUPGHOME}/gpg.conf | |
| echo "no-greeting" >> ${GNUPGHOME}/gpg.conf | |
| secret=$(aws secretsmanager get-secret-value --secret-id=${{ secrets.OPEN_PGP_KEY_ARN }} --query=SecretString --output=text) | |
| privatekey=$(node -p "(${secret}).PrivateKey") | |
| passphrase=$(node -p "(${secret}).Passphrase") | |
| echo "::add-mask::${passphrase}" | |
| unset secret | |
| echo ${passphrase} | gpg --batch --yes --import --armor --passphrase-fd=0 <(echo "${privatekey}") | |
| unset privatekey | |
| for file in $(find dist -type f -not -iname "*.asc"); do | |
| echo ${passphrase} | gpg --pinentry-mode=loopback --batch --yes --local-user="aws-jsii@amazon.com" --detach-sign --armor --passphrase-fd=0 ${file} | |
| done | |
| unset passphrase | |
| find ${GNUPGHOME} -type f -exec shred --remove {} \; | |
| - name: Upload artifact | |
| id: upload_artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-package | |
| path: ${{ github.workspace }}/dist | |
| overwrite: true | |
| include-hidden-files: true | |
| release-to-github: | |
| name: Create GitHub Release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| env: | |
| CI: "true" | |
| if: fromJSON(needs.build.outputs.github-release) | |
| steps: | |
| - name: Download artifact | |
| id: download_artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-package | |
| - name: Verify if release exists | |
| id: release-exists | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: |- | |
| if gh release view "$RELEASE_TAG" --repo=${{ github.repository }} &>/dev/null | |
| then | |
| echo "result=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "result=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create PreRelease | |
| id: create_prerelease | |
| if: "!fromJSON(steps.release-exists.outputs.result) && fromJSON(needs.build.outputs.prerelease)" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: gh release create "$RELEASE_TAG" --repo=${{ github.repository }} --generate-notes --title="$RELEASE_TAG" --verify-tag --prerelease --latest=${{ needs.build.outputs.latest }} | |
| - name: Create Release | |
| id: create_release | |
| if: "!fromJSON(steps.release-exists.outputs.result) && !fromJSON(needs.build.outputs.prerelease)" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: gh release create "$RELEASE_TAG" --repo=${{ github.repository }} --generate-notes --title="$RELEASE_TAG" --verify-tag --latest=${{ needs.build.outputs.latest }} | |
| - name: Attach assets | |
| id: attach_assets | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: gh release upload "$RELEASE_TAG" --repo=${{ github.repository }} --clobber ${{ github.workspace }}/**/* | |
| release-npm-package: | |
| name: Release to registry.npmjs.org | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| env: | |
| CI: "true" | |
| steps: | |
| - name: Download artifact | |
| id: download_artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-package | |
| - name: Enable corepack | |
| id: enable_corepack | |
| run: corepack enable | |
| - name: Setup Node.js | |
| id: setup_node_js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| registry-url: https://registry.npmjs.org/ | |
| - name: Federate to AWS | |
| id: federate_to_aws | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| aws-region: us-east-1 | |
| role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} | |
| role-session-name: GHA-aws-jsii-rosetta@${{ github.ref_name }} | |
| - name: Set NODE_AUTH_TOKEN | |
| id: set_node_auth_token | |
| run: |- | |
| secret=$(aws secretsmanager get-secret-value --secret-id=${{ secrets.NPM_TOKEN_ARN }} --query=SecretString --output=text) | |
| token=$(node -p "(${secret}).token") | |
| unset secret | |
| echo "::add-mask::${token}" | |
| echo "NODE_AUTH_TOKEN=${token}" >> $GITHUB_ENV | |
| unset token | |
| - name: Publish | |
| id: publish | |
| run: npm publish ${{ github.workspace }}/js/jsii-*.tgz --access=public --provenance --tag=${{ needs.build.outputs.dist-tag }} | |
| - name: Tag "latest" | |
| id: tag_latest | |
| if: fromJSON(needs.build.outputs.latest) | |
| env: | |
| RELEASE_TAG: ${{ github.ref_name }} | |
| run: npm dist-tag add "jsii-rosetta@$RELEASE_TAG" latest |