Scheduled Release #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Phillip Cloud | |
| # Licensed under the Apache License, Version 2.0 | |
| name: Scheduled Release | |
| on: | |
| schedule: | |
| - cron: "0 7 * * 0" # Sundays at 3am America/New_York (EDT) | |
| workflow_dispatch: {} | |
| concurrency: | |
| group: scheduled-release | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| jobs: | |
| semantic-release: | |
| name: Semantic Release | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| permissions: | |
| checks: read | |
| contents: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: audit | |
| disable-sudo-and-containers: true | |
| - name: Generate app token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Verify HEAD passed required checks | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| HEAD_SHA: ${{ github.sha }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| sha="$HEAD_SHA" | |
| # Fetch required check names from the branch ruleset | |
| required=$(gh api "repos/$REPO/rules/branches/main" \ | |
| --jq '[.[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context] | | |
| if length == 0 then "::error::No required status checks found for main. Aborting release." | halt_error(1) | |
| else . end') | |
| # Fetch all check runs for HEAD once, then verify each required check | |
| gh api "repos/$REPO/commits/$sha/check-runs" \ | |
| --jq '.check_runs | group_by(.name) | map(sort_by(.completed_at) | last | {name, conclusion})' \ | |
| | jq --argjson required "$required" -e ' | |
| ($required - [.[].name]) as $missing | | |
| if ($missing | length) > 0 then | |
| "::error::Missing checks for \($missing | join(", "))" | halt_error(1) | |
| else . end | | |
| map(select(.name as $n | $required | index($n))) | | |
| map(select(.conclusion != "success")) | | |
| if length > 0 then | |
| map("::error::\(.name) is \(.conclusion // "none"), expected success") | .[] | halt_error(1) | |
| else true end' | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: lts/* | |
| - name: Run semantic-release | |
| run: bash ci/release/run.bash | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} |