Release v2.14.0 (skip tests: true, use existing tag: false) #208
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "New Release" | |
| run-name: "Release ${{ inputs.version_number }}${{ inputs.base_branch != 'master' && format(' from {0}', inputs.base_branch) || '' }} (skip tests: ${{ inputs.skip_tests }}, use existing tag: ${{ inputs.use_existing_tag}})" | |
| # Used for creating a new release. This workflow will run qa acceptance tests, create a new tag, and generate the release with GoReleaser. | |
| # For backport releases, set base_branch to the appropriate LTS branch. When base_branch is not master, Jira release step is skipped. | |
| # Note: After a backport release, CHANGELOG.md changes from the base branch should be manually merged to master branch. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version_number: | |
| description: 'Version number (e.g., v1.0.0, v1.0.0-pre, v1.0.0-pre1)' | |
| required: true | |
| base_branch: | |
| description: 'Base branch for the release' | |
| required: true | |
| type: choice | |
| default: 'master' | |
| options: | |
| - 'master' | |
| - 'v1-lts' | |
| skip_tests: | |
| description: 'Set value to `true` to skip QA acceptance tests, default is `false`' | |
| default: 'false' | |
| use_existing_tag: | |
| description: 'Set value to `true` to use an existing tag for the release process, default is `false`' | |
| default: 'false' | |
| jobs: | |
| release-config: | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| outputs: | |
| creates_new_tag: ${{ steps.evaluate_inputs.outputs.creates_new_tag }} | |
| is_official_release: ${{ steps.evaluate_inputs.outputs.is_official_release }} | |
| runs_tests: ${{ steps.evaluate_inputs.outputs.runs_tests }} | |
| target_branch: ${{ steps.evaluate_inputs.outputs.target_branch }} | |
| is_backport_release: ${{ steps.evaluate_inputs.outputs.is_backport_release }} | |
| skip_jira: ${{ steps.evaluate_inputs.outputs.skip_jira }} | |
| steps: | |
| - id: evaluate_inputs | |
| env: | |
| BASE_BRANCH: ${{ inputs.base_branch }} | |
| VERSION_NUMBER: ${{ inputs.version_number }} | |
| USE_EXISTING_TAG: ${{ inputs.use_existing_tag }} | |
| SKIP_TESTS: ${{ inputs.skip_tests }} | |
| run: | | |
| TARGET_BRANCH="$BASE_BRANCH" | |
| IS_BACKPORT=$(if [ "$TARGET_BRANCH" != "master" ]; then echo 'true'; else echo 'false'; fi) | |
| IS_OFFICIAL=$(if echo "$VERSION_NUMBER" | grep -q 'pre'; then echo 'false'; else echo 'true'; fi) | |
| # Skip Jira release for backport releases or pre-releases | |
| SKIP_JIRA=$(if [ "$TARGET_BRANCH" != "master" ] || [ "$IS_OFFICIAL" = 'false' ]; then echo 'true'; else echo 'false'; fi) | |
| { | |
| echo "creates_new_tag=$(if [ "$USE_EXISTING_TAG" = 'true' ]; then echo 'false'; else echo 'true'; fi)" | |
| echo "is_official_release=$IS_OFFICIAL" | |
| echo "runs_tests=$(if [ "$SKIP_TESTS" = 'true' ]; then echo 'false'; else echo 'true'; fi)" | |
| echo "target_branch=$TARGET_BRANCH" | |
| echo "is_backport_release=$IS_BACKPORT" | |
| echo "skip_jira=$SKIP_JIRA" | |
| } >> "$GITHUB_OUTPUT" | |
| validate-inputs: | |
| needs: [release-config] | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| steps: | |
| - name: Validate branch exists | |
| env: | |
| BASE_BRANCH: ${{ inputs.base_branch }} | |
| run: | | |
| git ls-remote --exit-code --heads "https://github.com/${{ github.repository }}" "$BASE_BRANCH" || { | |
| echo "Error: Branch '$BASE_BRANCH' does not exist on remote" | |
| exit 1 | |
| } | |
| - name: Validation of version format | |
| env: | |
| VERSION_NUMBER: ${{ inputs.version_number }} | |
| TARGET_BRANCH: ${{ needs.release-config.outputs.target_branch }} | |
| run: | | |
| if [[ "$TARGET_BRANCH" =~ ^v([0-9]+)-lts$ ]]; then | |
| # LTS branch: only allow matching major version (e.g., v1-lts allows v1.x.x) | |
| MAJOR="${BASH_REMATCH[1]}" | |
| echo "$VERSION_NUMBER" | grep -P "^v${MAJOR}\.\d+\.\d+(-pre[A-Za-z0-9-]*)?$" | |
| else | |
| # Standard release from master: allow any version | |
| echo "$VERSION_NUMBER" | grep -P '^v\d+\.\d+\.\d+(-pre[A-Za-z0-9-]*)?$' | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ inputs.use_existing_tag == 'true' && inputs.version_number || needs.release-config.outputs.target_branch }} | |
| - name: Check for Upgrade Guide | |
| run: './scripts/check-upgrade-guide-exists.sh ${{inputs.version_number}}' | |
| update-examples-reference-in-docs: | |
| needs: [ release-config, validate-inputs ] | |
| if: >- | |
| !cancelled() | |
| && !contains(needs.*.result, 'failure') | |
| && needs.release-config.outputs.creates_new_tag == 'true' | |
| && needs.release-config.outputs.is_official_release == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ needs.release-config.outputs.target_branch }} | |
| - uses: ./.github/templates/run-script-and-commit | |
| with: | |
| script_call: './scripts/update-examples-reference-in-docs.sh ${{inputs.version_number}}' | |
| file_to_commit: 'docs/* templates/*' # only docs files are updated | |
| commit_message: 'chore: Update example links in registry docs for ${{ github.event.inputs.version_number }} release' | |
| apix_bot_pat: ${{ secrets.APIX_BOT_PAT }} | |
| remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }} | |
| gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }} | |
| branch: ${{ needs.release-config.outputs.target_branch }} | |
| update-changelog-header: | |
| needs: [ release-config, validate-inputs, update-examples-reference-in-docs ] | |
| if: >- | |
| !cancelled() | |
| && !contains(needs.*.result, 'failure') | |
| && needs.release-config.outputs.creates_new_tag == 'true' | |
| && needs.release-config.outputs.is_official_release == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ needs.release-config.outputs.target_branch }} | |
| - uses: ./.github/templates/run-script-and-commit | |
| with: | |
| script_call: './scripts/update-changelog-header-for-release.sh ${{inputs.version_number}}' | |
| file_to_commit: 'CHANGELOG.md' | |
| commit_message: 'chore: Updates CHANGELOG.md header for ${{ github.event.inputs.version_number }} release' | |
| apix_bot_pat: ${{ secrets.APIX_BOT_PAT }} | |
| remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }} | |
| gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }} | |
| branch: ${{ needs.release-config.outputs.target_branch }} | |
| create-tag: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| needs: [ release-config, validate-inputs, update-examples-reference-in-docs, update-changelog-header ] | |
| if: >- | |
| !cancelled() | |
| && !contains(needs.*.result, 'failure') | |
| && needs.release-config.outputs.creates_new_tag == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ needs.release-config.outputs.target_branch }} | |
| - name: Get the latest commit SHA | |
| id: get-sha | |
| run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| - name: Create release tag | |
| uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72 | |
| with: | |
| tag: ${{ inputs.version_number }} | |
| commit_sha: ${{ steps.get-sha.outputs.sha }} | |
| gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| gpg_passphrase: ${{ secrets.PASSPHRASE }} | |
| run-qa-acceptance-tests: | |
| needs: [ release-config, validate-inputs, update-examples-reference-in-docs, update-changelog-header, create-tag ] | |
| if: >- | |
| !cancelled() | |
| && !contains(needs.*.result, 'failure') | |
| && needs.release-config.outputs.runs_tests == 'true' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| secrets: inherit | |
| uses: ./.github/workflows/acceptance-tests.yml | |
| with: | |
| atlas_cloud_env: "qa" | |
| ref: ${{ inputs.version_number }} | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| needs: [ validate-inputs, update-examples-reference-in-docs, update-changelog-header, create-tag, run-qa-acceptance-tests ] | |
| # Release is skipped if there are failures in previous steps | |
| if: >- | |
| !cancelled() | |
| && !contains(needs.*.result, 'failure') | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ inputs.version_number }} | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Import GPG key | |
| id: import_gpg | |
| uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd | |
| with: | |
| gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.PASSPHRASE }} | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 | |
| with: | |
| version: '~> v2' | |
| args: release --clean | |
| env: | |
| GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| compliance: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| needs: [ release-config, release ] | |
| if: >- | |
| !cancelled() | |
| && needs.release.result == 'success' | |
| && needs.release-config.outputs.is_official_release == 'true' | |
| env: | |
| SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ inputs.version_number }} | |
| - name: Generate SBOM | |
| run: make gen-purls generate-sbom | |
| - name: Upload SBOM to Kondukto | |
| run: make upload-sbom | |
| env: | |
| KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }} | |
| KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }} | |
| KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }} | |
| - name: Upload SBOM as release artifact | |
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b | |
| with: | |
| files: compliance/sbom.json | |
| tag_name: ${{ inputs.version_number }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| generate-ssdlc-report: | |
| needs: [ release-config, release, compliance ] | |
| if: >- | |
| !cancelled() | |
| && needs.release.result == 'success' | |
| && needs.release-config.outputs.is_official_release == 'true' | |
| && needs.compliance.result == 'success' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: ${{ needs.release-config.outputs.target_branch }} | |
| - uses: ./.github/templates/run-script-and-commit | |
| with: | |
| script_call: | | |
| TAG="${{ inputs.version_number }}" | |
| VERSION="${TAG#v}" | |
| AUTHOR="${{ github.actor }}" | |
| export AUTHOR VERSION | |
| ./scripts/compliance/gen-ssdlc-report.sh | |
| file_to_commit: 'compliance/v*/ssdlc-compliance-*.md' | |
| commit_message: "chore: Update SSDLC report for ${{ inputs.version_number }}" | |
| apix_bot_pat: ${{ secrets.APIX_BOT_PAT }} | |
| remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }} | |
| gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }} | |
| branch: ${{ needs.release-config.outputs.target_branch }} | |
| jira-release-version: | |
| needs: [ release-config, release ] | |
| # Jira release is skipped for backport releases and pre-releases | |
| if: >- | |
| !cancelled() | |
| && needs.release.result == 'success' | |
| && needs.release-config.outputs.skip_jira != 'true' | |
| permissions: {} | |
| secrets: inherit | |
| uses: ./.github/workflows/jira-release-version.yml | |
| with: | |
| version_number: ${{ inputs.version_number }} |