ci: align workflow structure with hriv reference implementation (#13) #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-please | |
| on: | |
| push: | |
| branches: [main] | |
| # Least-privilege default: only `checkout` needs read access. | |
| # Each job elevates permissions to just what that job requires. | |
| permissions: | |
| contents: read | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| outputs: | |
| releases_created: ${{ steps.rp.outputs.releases_created }} | |
| tag_name: ${{ steps.rp.outputs['.--tag_name'] }} | |
| steps: | |
| - uses: googleapis/release-please-action@v4 | |
| id: rp | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # `release-as` per-package is a one-shot: once the release PR it | |
| # triggered has merged and the manifest has caught up, the override | |
| # must be removed, otherwise every subsequent release-please run | |
| # keeps pinning the same version and blocks normal semver bumps | |
| # from feat:/fix: commits. This guard runs *after* release-please | |
| # and is skipped whenever `releases_created=true`, so the | |
| # tag/release finalization that happens on the merge-of-chore-PR | |
| # push (where manifest has just caught up to release-as) isn't | |
| # blocked. On any subsequent push where the state is still stale | |
| # and there's nothing to release, the workflow fails loudly to | |
| # force the cleanup PR. | |
| - uses: actions/checkout@v6 | |
| if: steps.rp.outputs.releases_created != 'true' | |
| - name: Guard against stale `release-as` entries | |
| if: steps.rp.outputs.releases_created != 'true' | |
| run: | | |
| python3 - <<'PY' | |
| import json, sys | |
| with open("release-please-config.json") as f: | |
| cfg = json.load(f) | |
| with open(".release-please-manifest.json") as f: | |
| manifest = json.load(f) | |
| stale = [] | |
| for pkg, conf in cfg.get("packages", {}).items(): | |
| ra = conf.get("release-as") | |
| if ra is not None and manifest.get(pkg) == ra: | |
| stale.append((pkg, ra)) | |
| if stale: | |
| print("::error::Stale `release-as` entries in release-please-config.json:") | |
| for pkg, ra in stale: | |
| print(f"::error:: packages.{pkg}.release-as={ra} already matches .release-please-manifest.json — remove this field so release-please can resume normal semver bumps.") | |
| sys.exit(1) | |
| PY | |
| # Releases created via GITHUB_TOKEN do NOT trigger workflows that listen | |
| # on `release: published` or `push: tags:`. Dispatch helm-publish and | |
| # release-retag explicitly for the released tag. | |
| dispatch-publish: | |
| needs: release | |
| if: needs.release.outputs.releases_created == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: write | |
| contents: read | |
| steps: | |
| - name: Dispatch downstream workflows for the released tag | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| TAG: ${{ needs.release.outputs.tag_name }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${TAG}" ]]; then | |
| echo "::warning::release-please reported a release but no tag_name output; skipping dispatch" | |
| exit 0 | |
| fi | |
| echo "Dispatching helm-publish.yaml for ${TAG}" | |
| gh workflow run helm-publish.yaml \ | |
| --ref "${TAG}" \ | |
| -f tag_name="${TAG}" | |
| echo "Dispatching release-retag.yaml for ${TAG}" | |
| gh workflow run release-retag.yaml \ | |
| --ref "${TAG}" \ | |
| -f tag_name="${TAG}" |