-
Notifications
You must be signed in to change notification settings - Fork 2
232 lines (194 loc) · 7.98 KB
/
release.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
name: Release
on:
workflow_dispatch:
permissions: {}
jobs:
release-perform:
name: Release - Perform
runs-on: ubuntu-22.04
timeout-minutes: 300
permissions:
contents: write # To be able to publish a GitHub release
issues: write # To be able to comment on released issues
pull-requests: write # To be able to comment on released pull requests
outputs:
release-tag: ${{ steps.release.outputs.tag }}
env:
CHANGELOG_FILE: ${{ github.workspace }}/docs/CHANGELOG.md
steps:
- name: Harden runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
github.com:443
api.github.com:443
objects.githubusercontent.com:443
uploads.github.com:443
repo.maven.apache.org:443
jitpack.io:443
repo.papermc.io:443
api.nuget.org:443
registry.npmjs.org:443
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0 # Required by semantic-release
- name: Config Git user as release bot
env:
# https://github.com/orgs/community/discussions/26560#discussioncomment-3252339
RELEASE_BOT_NAME: 'github-actions[bot]'
RELEASE_BOT_EMAIL: '41898282+github-actions[bot]@users.noreply.github.com'
run: |
git config --global user.name "${RELEASE_BOT_NAME}"
git config --global user.email "${RELEASE_BOT_EMAIL}"
- name: Setup Node.js
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
with:
node-version: lts/iron
cache: npm
cache-dependency-path: .github/package-lock.json
- name: Setup Java
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
with:
java-version: 17
distribution: temurin
- name: Install semantic-release
working-directory: .github/
run: npm clean-install
- name: Release
id: release
env:
GITHUB_TOKEN: ${{ github.token }}
TMP_TAG_VERSION_NAME_FILE: ${{ runner.temp }}/tag_version_name
working-directory: .github/
run: |
npx --no-install semantic-release --ci
echo "tag=$(cat "${TMP_TAG_VERSION_NAME_FILE}")" >> "${GITHUB_OUTPUT}"
- name: Create a PR for creating/updating the CHANGELOG file
env:
GITHUB_TOKEN: ${{ github.token }}
CHANGELOG_BRANCH_NAME: changelog/${{ steps.release.outputs.tag }}
run: |
git switch --create "${CHANGELOG_BRANCH_NAME}"
git commit --message='docs(changelog): release ${{ steps.release.outputs.tag }}' "${CHANGELOG_FILE}"
git push --set-upstream origin "${CHANGELOG_BRANCH_NAME}"
gh pr create --fill \
--label 't:release' \
--base ${{ github.ref_name }} \
--head "${CHANGELOG_BRANCH_NAME}"
release-sign:
name: Release - Sign
runs-on: ubuntu-22.04
timeout-minutes: 120
needs: release-perform
permissions:
contents: write
id-token: write
env:
TAG_NAME: ${{ needs.release-perform.outputs.release-tag }}
ASSETS_DIR: ${{ github.workspace }}/assets
SIGNATURES_DIR: ${{ github.workspace }}/signatures
steps:
- name: Harden runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
github.com:443
api.github.com:443
uploads.github.com:443
objects.githubusercontent.com:443
fulcio.sigstore.dev:443
rekor.sigstore.dev:443
tuf-repo-cdn.sigstore.dev:443
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
persist-credentials: false
- name: Input validation
run: |
if [[ ! "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
echo "Invalid tag name '${TAG_NAME}'"
echo 'Aborting...'
exit 1
fi
echo "The provided tag name '${TAG_NAME}' is valid"
- name: Download release assets
env:
GITHUB_TOKEN: ${{ github.token }}
run: gh release download "${TAG_NAME}" --dir "${ASSETS_DIR}"
- name: Install Cosign
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
- name: Sign blob files
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
mkdir --parents "${SIGNATURES_DIR}"
for ASSET_FILE in "${ASSETS_DIR}"/*; do
ASSET_NAME="$(basename "${ASSET_FILE}")"
ASSET_FILE_NAME="${ASSETS_DIR}/${ASSET_NAME}"
CERT_FILE_NAME="${ASSET_NAME}-keyless.pem"
SIG_FILE_NAME="${ASSET_NAME}-keyless.sig"
if [[ "${ASSET_FILE_NAME}" =~ keyless\.(pem|sig)$ ]]; then
echo "Signature file '${ASSET_FILE_NAME}' found among assets"
echo 'Skipping asset...'
continue
fi
if [[ -f "${ASSETS_DIR}/${CERT_FILE_NAME}" && -f "${ASSETS_DIR}/${SIG_FILE_NAME}" ]]; then
echo "Signature files already exist for asset '${ASSET_FILE_NAME}'"
echo 'Skipping asset...'
continue
fi
if [[ -f "${ASSETS_DIR}/${CERT_FILE_NAME}" || -f "${ASSETS_DIR}/${SIG_FILE_NAME}" ]]; then
echo 'Error: only one signing file found over the two expected ones'
echo 'Manual investigation required, please check!'
echo 'Aborting...'
exit 1
fi
echo "The asset '${ASSET_FILE_NAME}' is going to be signed..."
cosign sign-blob "${ASSET_FILE}" --yes \
--output-certificate="${SIGNATURES_DIR}/${CERT_FILE_NAME}" \
--output-signature="${SIGNATURES_DIR}/${SIG_FILE_NAME}"
done
- name: Verify signatures
env:
CERTIFICATE_IDENTITY: ${{ github.server_url }}/${{ github.workflow_ref }}
CERTIFICATE_OIDC_ISSUER: https://token.actions.githubusercontent.com
run: |
for ASSET_FILE in "${ASSETS_DIR}"/*; do
ASSET_NAME="$(basename "${ASSET_FILE}")"
ASSET_FILE_NAME="${ASSETS_DIR}/${ASSET_NAME}"
CERT_FILE_NAME="${ASSET_NAME}-keyless.pem"
SIG_FILE_NAME="${ASSET_NAME}-keyless.sig"
if [[ "${ASSET_FILE_NAME}" =~ keyless\.(pem|sig)$ ]]; then
echo "Signature file '${ASSET_FILE_NAME}' found among assets"
echo 'Skipping asset...'
continue
fi
if [[ -f "${ASSETS_DIR}/${CERT_FILE_NAME}" && -f "${ASSETS_DIR}/${SIG_FILE_NAME}" ]]; then
echo "Signature files already exist for asset '${ASSET_FILE_NAME}'"
echo 'Skipping asset...'
continue
fi
cosign verify-blob "${ASSET_FILE}" \
--signature="${SIGNATURES_DIR}/${SIG_FILE_NAME}" \
--certificate="${SIGNATURES_DIR}/${CERT_FILE_NAME}" \
--certificate-identity="${CERTIFICATE_IDENTITY}" \
--certificate-oidc-issuer="${CERTIFICATE_OIDC_ISSUER}"
done
- name: Upload signature assets in release
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
if [[ -z "$(ls --almost-all "${SIGNATURES_DIR}" 2>/dev/null)" ]]; then
echo 'No asset to be uploaded in the GitHub release'
echo 'Aborting...'
exit 1
fi
echo "Uploading the following files in the GitHub release '${TAG_NAME}'"
ls --almost-all "${SIGNATURES_DIR}"
gh release upload "${TAG_NAME}" "${SIGNATURES_DIR}"/*
echo 'Files uploaded successfully'