123 lines
5.4 KiB
YAML
123 lines
5.4 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
concurrency:
|
|
group: potato-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout public source without a credential
|
|
env:
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
GIT_TERMINAL_PROMPT: '0'
|
|
run: |
|
|
test "${#SOURCE_SHA}" -eq 40
|
|
printf '%s' "$SOURCE_SHA" | grep -Eq '^[a-f0-9]{40}$'
|
|
git init .
|
|
git remote add origin https://git.garvis.dev/dmg/purpur-potato.git
|
|
git config --local credential.helper ''
|
|
git config --local http.extraHeader ''
|
|
git config --local http.followRedirects false
|
|
git fetch --force --tags origin '+refs/heads/*:refs/remotes/origin/*'
|
|
git fetch origin "$SOURCE_SHA"
|
|
git checkout -B main "$SOURCE_SHA"
|
|
- name: Set up Java
|
|
uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: 25
|
|
cache: gradle
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
- name: Build and test before release
|
|
run: ./gradlew clean check jar
|
|
- name: Capture previous tag
|
|
id: previous
|
|
run: |
|
|
previous=$(git describe --tags --abbrev=0 2>/dev/null || true)
|
|
printf 'tag=%s\n' "$previous" >> "$GITHUB_OUTPUT"
|
|
- name: Compute and push semantic release tag
|
|
env:
|
|
RELEASE_CREDENTIAL: ${{ secrets.RELEASE_TOKEN }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
LC_ALL: C
|
|
run: |
|
|
set +x
|
|
test "$REPOSITORY" = dmg/purpur-potato
|
|
test -n "$RELEASE_CREDENTIAL" || { printf '%s\n' 'Missing RELEASE_TOKEN.' >&2; exit 1; }
|
|
# Prevent semantic-release from embedding any recognized token in a Git URL/argv.
|
|
unset GIT_CREDENTIALS GH_TOKEN GITHUB_TOKEN GL_TOKEN GITLAB_TOKEN
|
|
unset BB_TOKEN BITBUCKET_TOKEN BB_TOKEN_BASIC_AUTH BITBUCKET_TOKEN_BASIC_AUTH
|
|
unset DEBUG NODE_DEBUG GIT_TRACE GIT_TRACE_CURL GIT_CURL_VERBOSE GIT_TRACE_PACKET
|
|
unset GIT_TRACE_SETUP GIT_TRACE2 GIT_TRACE2_EVENT GIT_TRACE2_PERF
|
|
# semantic-release forces GIT_ASKPASS=echo. Use a scoped, memory-only helper instead.
|
|
export GIT_TERMINAL_PROMPT=0
|
|
git config --local credential.helper ''
|
|
git config --local --add credential.helper "$GITHUB_WORKSPACE/scripts/git-credential.sh"
|
|
git config --local credential.useHttpPath true
|
|
git config --local http.followRedirects false
|
|
npx -y \
|
|
-p semantic-release@24.2.9 \
|
|
-p @semantic-release/commit-analyzer@13.0.1 \
|
|
-p @semantic-release/release-notes-generator@14.1.0 \
|
|
semantic-release --branches main \
|
|
--repository-url https://git.garvis.dev/dmg/purpur-potato.git \
|
|
--plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator
|
|
- name: Resolve newly created exact-source release
|
|
id: release
|
|
env:
|
|
PREVIOUS_TAG: ${{ steps.previous.outputs.tag }}
|
|
EXPECTED_COMMIT: ${{ github.sha }}
|
|
run: |
|
|
current=$(git describe --tags --exact-match HEAD 2>/dev/null || true)
|
|
if [ -n "$current" ] && [ "$current" != "$PREVIOUS_TAG" ]; then
|
|
printf '%s' "$current" | grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
|
|
test "$(git rev-parse "${current}^{commit}")" = "$EXPECTED_COMMIT"
|
|
printf 'created=true\nversion=%s\n' "${current#v}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
printf 'created=false\n' >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: Verify versioned plugin and release tooling
|
|
if: steps.release.outputs.created == 'true'
|
|
env:
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
run: ./gradlew clean check jar -PreleaseVersion="$VERSION"
|
|
- name: Upload release workflow artifact
|
|
if: steps.release.outputs.created == 'true'
|
|
uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
|
|
with:
|
|
name: purpur-potato-${{ steps.release.outputs.version }}
|
|
path: build/libs/purpur-potato-${{ steps.release.outputs.version }}.jar
|
|
if-no-files-found: error
|
|
- name: Publish verified JAR through a draft release
|
|
if: steps.release.outputs.created == 'true'
|
|
env:
|
|
RELEASE_CREDENTIAL: ${{ secrets.RELEASE_TOKEN }}
|
|
RELEASE_COMMIT: ${{ github.sha }}
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
PREVIOUS_TAG: ${{ steps.previous.outputs.tag }}
|
|
run: |
|
|
set +x
|
|
unset GIT_CREDENTIALS GH_TOKEN GITHUB_TOKEN GL_TOKEN GITLAB_TOKEN
|
|
unset BB_TOKEN BITBUCKET_TOKEN BB_TOKEN_BASIC_AUTH BITBUCKET_TOKEN_BASIC_AUTH
|
|
unset DEBUG NODE_DEBUG GIT_TRACE GIT_TRACE_CURL GIT_CURL_VERBOSE GIT_TRACE_PACKET
|
|
unset GIT_TRACE_SETUP GIT_TRACE2 GIT_TRACE2_EVENT GIT_TRACE2_PERF
|
|
if [ -n "$PREVIOUS_TAG" ]; then
|
|
RELEASE_NOTES=$(git log --pretty='format:- %s (%h)' "${PREVIOUS_TAG}..HEAD")
|
|
else
|
|
RELEASE_NOTES=$(git log --pretty='format:- %s (%h)' HEAD)
|
|
fi
|
|
export RELEASE_NOTES
|
|
node build/release-tools/publish-release.js
|