Files
Classic298 40b1c561a5 ci: lock the exact versions of the GitHub Actions our workflows use (#33679)
Our workflows refer to actions by tag, and a tag can be moved to different code after we reviewed it. This adds GitHub's workflow lockfile, which records the exact commit behind each action version, and the workflows now name exact releases (v5.1.0 instead of v5, for example) as the lockfile tool requires. Dependabot already tracks these actions. The regression workflow that follows the tests repo's main branch is not covered.
2026-11-04 05:06:30 +09:00

87 lines
3.3 KiB
YAML

# ─────────────────────────────────────────────────────────────────────────────
# Release — Create GitHub release from CHANGELOG, trigger Docker builds
# Runs on pushes to main when package.json version changes
# ─────────────────────────────────────────────────────────────────────────────
name: Release
on:
push:
branches: [main]
concurrency:
group: release-${{ github.ref }}
cancel-in-progress: false
jobs:
# ── Create release and trigger downstream workflows ──────────────────────
publish:
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: write
actions: write
steps:
- uses: actions/checkout@v5.1.0
- name: Abort if package.json unchanged
run: |
git diff --cached --diff-filter=d package.json || {
echo "package.json not modified — skipping release"
exit 1
}
- name: Read version
id: pkg
run: echo "version=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
- name: Extract release notes from CHANGELOG
run: |
VER="${{ steps.pkg.outputs.version }}"
awk "/^## \[${VER}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" \
CHANGELOG.md > /tmp/release-notes.md
python3 - <<'PY'
import os
from pathlib import Path
path = Path('/tmp/release-notes.md')
notes = path.read_text(encoding='utf-8')
# Leave room below GitHub's 125,000-character limit for the full-notes link.
if len(notes.encode('utf-8')) > 120000:
url = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/blob/{os.environ['GITHUB_SHA']}/CHANGELOG.md"
notes = notes.encode('utf-8')[:120000].decode('utf-8', errors='ignore').rsplit('\n', 1)[0]
path.write_text(notes + f'\n\nRelease notes shortened. [Read the full changelog]({url}).\n', encoding='utf-8')
PY
- name: Publish GitHub release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
if gh release view "v${{ steps.pkg.outputs.version }}" &>/dev/null; then
echo "Release v${{ steps.pkg.outputs.version }} already exists — skipping creation"
else
gh release create "v${{ steps.pkg.outputs.version }}" \
--title "v${{ steps.pkg.outputs.version }}" \
--notes-file /tmp/release-notes.md
fi
- name: Archive source
uses: actions/upload-artifact@v4.6.2
with:
name: release-archive
path: |
.
!.git
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Trigger Docker build
uses: actions/github-script@v8.0.0
with:
script: |
github.rest.actions.createWorkflowDispatch({
owner: context.repo.owner,
repo: context.repo.repo,
workflow_id: 'docker.yaml',
ref: 'v${{ steps.pkg.outputs.version }}',
})