mirror of
https://github.com/edera-dev/sprout.git
synced 2026-11-04 20:52:20 +00:00
alex
fe3de401ff
Dispatching the release workflow again for the same tag cancelled the running release, which could stop it in the middle of uploading assets and leave the release with only some of them. Queue the new run behind the running one instead.
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
name: release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release-tag:
|
|
description: 'Release Tag'
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read # Needed to checkout the repository.
|
|
|
|
concurrency:
|
|
group: "${{ github.workflow }}-${{ github.event.inputs.release-tag }}"
|
|
# Let a running release finish, so its assets are never left partially uploaded.
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
name: release
|
|
permissions:
|
|
contents: write # Needed to upload release assets.
|
|
id-token: write # Needed for attestation.
|
|
attestations: write # Needed for attestations.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: harden runner
|
|
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Build the tagged commit, not whichever ref the workflow was dispatched on.
|
|
ref: "refs/tags/${{ github.event.inputs.release-tag }}"
|
|
persist-credentials: false
|
|
|
|
- name: 'install rust toolchain'
|
|
run: |
|
|
cargo version
|
|
|
|
- name: 'assemble release artifacts'
|
|
run: ./hack/assemble.sh
|
|
|
|
- name: 'attest release artifacts'
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
|
|
with:
|
|
subject-path: target/assemble/*
|
|
|
|
- name: 'generate cultivator token'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
|
|
id: generate-token
|
|
with:
|
|
app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
|
|
private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
|
|
# Scope to what uploading assets and `gh release edit` need: write to
|
|
# release contents.
|
|
permission-contents: write
|
|
if: ${{ github.event.inputs.release-tag != '' }}
|
|
|
|
- name: 'upload release artifacts'
|
|
run: ./hack/ci/upload-release-assets.sh
|
|
env:
|
|
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
|
|
RELEASE_TAG: "${{ github.event.inputs.release-tag }}"
|
|
if: ${{ github.event.inputs.release-tag != '' }}
|
|
|
|
- name: 'mark release as published'
|
|
run: gh release edit "${RELEASE_TAG}" --draft=false --verify-tag
|
|
env:
|
|
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
|
|
RELEASE_TAG: "${{ github.event.inputs.release-tag }}"
|
|
if: ${{ github.event.inputs.release-tag != '' }}
|