138 lines
5.6 KiB
YAML
138 lines
5.6 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
concurrency:
|
|
group: ignis-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ secrets.RELEASE_TOKEN }}
|
|
persist-credentials: false
|
|
|
|
- name: Set up Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: 25
|
|
cache: gradle
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
- name: Build and test before release
|
|
run: ./gradlew clean check
|
|
|
|
- name: Resolve semantic version and tag
|
|
id: release
|
|
env:
|
|
IGNIS_RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ github.server_url }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$IGNIS_RELEASE_TOKEN" || { echo 'RELEASE_TOKEN is required'; exit 1; }
|
|
test "$GITEA_SERVER_URL" = 'https://git.garvis.dev'
|
|
test "$REPOSITORY" = 'dmg/spigot-ignis'
|
|
# Token stays in environment/stdout to Git's protected askpass pipe, not a URL or argv.
|
|
askpass=$(mktemp)
|
|
trap 'rm -f "$askpass"' EXIT
|
|
chmod 700 "$askpass"
|
|
cat > "$askpass" <<'SH'
|
|
#!/bin/sh
|
|
case "$1" in
|
|
*Username*) printf '%s\n' 'x-access-token' ;;
|
|
*Password*) printf '%s\n' "$IGNIS_RELEASE_TOKEN" ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
SH
|
|
export GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0
|
|
git config credential.helper ''
|
|
git remote set-url origin "${GITEA_SERVER_URL}/${REPOSITORY}.git"
|
|
previous=$(git describe --tags --abbrev=0 2>/dev/null || true)
|
|
npx -y \
|
|
-p semantic-release@24.2.9 \
|
|
-p @semantic-release/commit-analyzer@13.0.1 \
|
|
-p @semantic-release/release-notes-generator@14.1.0 \
|
|
semantic-release --branches main \
|
|
--repository-url "${GITEA_SERVER_URL}/${REPOSITORY}.git" \
|
|
--plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator
|
|
current=$(git describe --tags --exact-match HEAD 2>/dev/null || true)
|
|
if [ -n "$current" ] && [ "$current" != "$previous" ]; then
|
|
[[ "$current" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
|
|
echo 'created=true' >> "$GITHUB_OUTPUT"
|
|
echo "tag=$current" >> "$GITHUB_OUTPUT"
|
|
echo "version=${current#v}" >> "$GITHUB_OUTPUT"
|
|
echo "previous=$previous" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo 'created=false' >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build versioned plugin
|
|
if: steps.release.outputs.created == 'true'
|
|
env:
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
run: ./gradlew clean jar -PreleaseVersion="$VERSION"
|
|
|
|
- name: Upload release workflow artifact
|
|
if: steps.release.outputs.created == 'true'
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: spigot-ignis-${{ steps.release.outputs.version }}
|
|
path: build/libs/spigot-ignis-${{ steps.release.outputs.version }}.jar
|
|
if-no-files-found: error
|
|
|
|
- name: Publish versioned Gitea asset
|
|
if: steps.release.outputs.created == 'true'
|
|
env:
|
|
IGNIS_RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ github.server_url }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
TAG: ${{ steps.release.outputs.tag }}
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
PREVIOUS_TAG: ${{ steps.release.outputs.previous }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
test "$GITEA_SERVER_URL" = 'https://git.garvis.dev'
|
|
test "$REPOSITORY" = 'dmg/spigot-ignis'
|
|
api_url="${GITEA_SERVER_URL}/api/v1/repos/${REPOSITORY}/releases"
|
|
jar="build/libs/spigot-ignis-${VERSION}.jar"
|
|
payload=$(mktemp)
|
|
response=$(mktemp)
|
|
trap 'rm -f "$payload" "$response"' EXIT
|
|
export RELEASE_BODY
|
|
if [ -n "$PREVIOUS_TAG" ]; then
|
|
RELEASE_BODY=$(git log --pretty='format:- %s (%h)' "${PREVIOUS_TAG}..HEAD")
|
|
else
|
|
RELEASE_BODY=$(git log --pretty='format:- %s (%h)' HEAD)
|
|
fi
|
|
node -e 'process.stdout.write(JSON.stringify({tag_name: process.env.TAG, name: process.env.TAG,
|
|
body: process.env.RELEASE_BODY, draft: false, prerelease: false}))' > "$payload"
|
|
# printf is a shell builtin. Curl reads the authorization header from stdin, never argv.
|
|
printf 'Authorization: token %s\n' "$IGNIS_RELEASE_TOKEN" | \
|
|
curl --fail --silent --show-error --max-time 60 --proto '=https' \
|
|
--header @- --header 'Content-Type: application/json' \
|
|
--data-binary "@$payload" --output "$response" "$api_url"
|
|
release_id=$(node -e 'const fs=require("node:fs"); const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
|
|
if(!Number.isSafeInteger(r.id)||r.id<=0) process.exit(1); process.stdout.write(String(r.id));' "$response")
|
|
printf 'Authorization: token %s\n' "$IGNIS_RELEASE_TOKEN" | \
|
|
curl --fail --silent --show-error --max-time 120 --proto '=https' \
|
|
--header @- --header 'Content-Type: application/octet-stream' \
|
|
--data-binary "@$jar" --output /dev/null \
|
|
"${api_url}/${release_id}/assets?name=spigot-ignis-${VERSION}.jar"
|