Release #16
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| release-perform: | |
| name: Release - Perform | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write # Required to publish a GitHub release | |
| issues: write # Required to comment on released issues | |
| pull-requests: write # Required to comment on released pull requests | |
| outputs: | |
| release-tag: ${{ steps.release.outputs.tag }} | |
| env: | |
| CHANGELOG_FILE: ${{ github.workspace }}/docs/CHANGELOG.md | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| github.com:443 | |
| api.github.com:443 | |
| objects.githubusercontent.com:443 | |
| uploads.github.com:443 | |
| repo.maven.apache.org:443 | |
| jitpack.io:443 | |
| repo.papermc.io:443 | |
| api.nuget.org:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| fetch-depth: 0 # Required by semantic-release | |
| - name: Config Git user as release bot | |
| env: | |
| # https://github.com/orgs/community/discussions/26560#discussioncomment-3252339 | |
| RELEASE_BOT_NAME: 'github-actions[bot]' | |
| RELEASE_BOT_EMAIL: '41898282+github-actions[bot]@users.noreply.github.com' | |
| run: | | |
| git config --global user.name "${RELEASE_BOT_NAME}" | |
| git config --global user.email "${RELEASE_BOT_EMAIL}" | |
| - name: Setup Node.js | |
| uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3 | |
| with: | |
| node-version: lts/iron | |
| cache: npm | |
| cache-dependency-path: .github/package-lock.json | |
| - name: Setup Java | |
| uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0 | |
| with: | |
| java-version: 17 | |
| distribution: temurin | |
| - name: Install semantic-release | |
| working-directory: .github/ | |
| run: npm clean-install | |
| - name: Release | |
| id: release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| # Hacky way of retrieving the released version tag name through a temporary file | |
| TMP_TAG_VERSION_NAME_FILE: ${{ runner.temp }}/tag_version_name | |
| working-directory: .github/ | |
| run: | | |
| npx --no-install semantic-release | |
| echo "tag=$(cat "${TMP_TAG_VERSION_NAME_FILE}")" >> "${GITHUB_OUTPUT}" | |
| - name: Create a PR for creating/updating the changelog file | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| CHANGELOG_BRANCH_NAME: changelog/${{ steps.release.outputs.tag }} | |
| run: | | |
| git switch --create "${CHANGELOG_BRANCH_NAME}" | |
| git add "${CHANGELOG_FILE}" | |
| git commit --message='docs(changelog): release ${{ steps.release.outputs.tag }}' "${CHANGELOG_FILE}" | |
| git push --set-upstream origin "${CHANGELOG_BRANCH_NAME}" | |
| gh pr create --fill \ | |
| --label 't:release' \ | |
| --base ${{ github.ref_name }} \ | |
| --head "${CHANGELOG_BRANCH_NAME}" | |
| release-sign: | |
| name: Release - Sign | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 5 | |
| needs: release-perform | |
| permissions: | |
| contents: write # Required to add assets in existing GitHub release | |
| id-token: write # Required for signing through Sigstore | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| github.com:443 | |
| api.github.com:443 | |
| uploads.github.com:443 | |
| objects.githubusercontent.com:443 | |
| fulcio.sigstore.dev:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| persist-credentials: false | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0 | |
| - name: Sign GitHub release assets | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| CERTIFICATE_IDENTITY: ${{ github.server_url }}/${{ github.workflow_ref }} | |
| CERTIFICATE_OIDC_ISSUER: https://token.actions.githubusercontent.com | |
| run: .github/scripts/sign_gh_release_assets.sh ${{ needs.release-perform.outputs.release-tag }} |