GHA-120 Add workflow for automating ABD releases (#50)

anton-haubner-sonarsource · web-flow · commit 9a92a4955066 · 2025-10-14T16:59:46.000+02:00
diff --git a/.github/workflows/abd-automated-release.yml b/.github/workflows/abd-automated-release.yml
@@ -0,0 +1,329 @@
+name: ABD Reusable Release Automations
+
+# This workflow automates most of the DBD release process as described at https://xtranet-sonarsource.atlassian.net/wiki/spaces/CodeQualit/pages/2824634385/DBD+Release+Instructions
+#
+# KNOWN LIMITATIONS
+#
+# Steps not yet automated:
+#   - Checking if there are relevant RSPEC pull requests that still need to be merged
+#   - Verify that all analyses on Peach are successful
+#   - Verify that performance is under control
+#   - Posting artifact links comment to Jira release ticket (see TODO in release-in-jira job)
+# All of this is currently handled by manual instructions.
+#
+# Also, this has not yet been tested with the COBOL and JCL analyzers.
+
+env:
+  JIRA_PROJECT_KEY: ${{ inputs.jira-project-key }}
+  USE_JIRA_SANDBOX: ${{ inputs.use-jira-sandbox }}
+
+on:
+  workflow_call:
+    inputs:
+      jira-project-key:
+        description: "Jira project key"
+        required: true
+        type: string
+      project-name:
+        description: "Project name"
+        required: true
+        type: string
+      plugin-artifacts:
+        description: "Plugin artifacts"
+        required: true
+        type: string
+      use-jira-sandbox:
+        description: "Use Jira sandbox"
+        required: false
+        type: boolean
+        default: true
+      is-draft-release:
+        description: "Create draft release"
+        required: false
+        type: boolean
+        default: true
+      pm-email:
+        description: "Product manager email"
+        required: true
+        type: string
+      release-automation-secret-name:
+        description: "Release automation secret name"
+        required: true
+        type: string
+      short-description:
+        description: "A brief summary of what the release contains"
+        required: true
+        type: string
+      rule-props-changed:
+        description: "Did any rule properties change in this release"
+        required: true
+        type: string
+      branch:
+        description: "Branch from which to do the release"
+        required: true
+        type: string
+        default: "master"
+      release-notes:
+        description: "Release notes"
+        required: true
+        type: string
+      new-version:
+        description: "New version to release"
+        required: true
+        type: string
+
+    outputs:
+      new-version:
+        description: "New version to release"
+        value: ${{ jobs.release-in-jira.outputs.new-version }}
+
+jobs:
+  pre-release-checks:
+    name: Pre-release checks
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: read
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      # TODO: Add step to check whether all relevant RSPEC changes have been merged
+      # TODO: Verify that all analyses on Peach are successful
+      # TODO: Verify that performance on Peach is under control
+
+      - name: Check Releasability Status
+        uses: SonarSource/release-github-actions/check-releasability-status@v1
+        with:
+          branch: ${{ inputs.branch }}
+
+      - name: Update Rule Metadata
+        id: update-rule-metadata
+        uses: SonarSource/release-github-actions/update-rule-metadata@v1
+
+      - name: Check Rule Metadata Changes
+        if: steps.update-rule-metadata.outputs.has-changes == 'true'
+        run: |
+          echo "::error::Rule metadata changes detected. The generated PR needs to be merged first before continuing with the release."
+          echo "::error::Pull Request URL: ${{ steps.update-rule-metadata.outputs.pull-request-url }}"
+          echo "::error::Please merge the PR and run this workflow again (Start a new run instead of re-runing failed jobs in the current one)."
+          exit 1
+
+  prepare-release:
+    name: Prepare release
+    runs-on: ubuntu-latest
+    needs: pre-release-checks
+    permissions:
+      statuses: read
+      contents: read
+      id-token: write
+    outputs:
+      release-version: ${{ steps.get-release-version.outputs.release-version }}
+      jira-version-name: ${{ steps.get-jira-version.outputs.jira-version-name }}
+      release-notes: ${{ inputs.release-notes != '' && inputs.release-notes || steps.get-jira-release-notes.outputs.release-notes }}
+      jira-release-notes: ${{ inputs.release-notes != '' && inputs.release-notes || steps.get-jira-release-notes.outputs.jira-release-notes }}
+      jira-release-url: ${{ steps.get-jira-release-notes.outputs.jira-release-url }}
+    steps:
+      - name: Get Release Version
+        id: get-release-version
+        uses: SonarSource/release-github-actions/get-release-version@v1
+        with:
+          branch: ${{ inputs.branch }}
+
+      - name: Get Jira Version
+        id: get-jira-version
+        uses: SonarSource/release-github-actions/get-jira-version@v1
+
+      - name: Get Jira Release Notes
+        id: get-jira-release-notes
+        if: inputs.release-notes == ''
+        uses: SonarSource/release-github-actions/get-jira-release-notes@v1
+
+  create-release-ticket:
+    name: Create release ticket
+    runs-on: ubuntu-latest
+    needs: prepare-release
+    permissions:
+      statuses: read
+      contents: read
+      id-token: write
+    outputs:
+      release-ticket-key: ${{ steps.create-ticket.outputs.release-ticket-key }}
+      release-ticket-url: ${{ steps.create-ticket.outputs.release-ticket-url }}
+    steps:
+      - name: Create Jira Release Ticket
+        id: create-ticket
+        uses: SonarSource/release-github-actions/create-jira-release-ticket@v1
+        with:
+          project-name: ${{ inputs.project-name }}
+          short-description: ${{ inputs.short-description }}
+          rule-props-changed: ${{ inputs.rule-props-changed }}
+          jira-release-url: ${{ needs.prepare-release.outputs.jira-release-url }}
+          start-progress: true
+          version: ${{ needs.prepare-release.outputs.release-version }}
+
+  publish-github-release:
+    name: Publish github release
+    runs-on: ubuntu-latest
+    needs: [ prepare-release, create-release-ticket ]
+    permissions:
+      id-token: write
+      contents: write
+      actions: write
+    outputs:
+      github-release-url: ${{ steps.publish-github-release.outputs.release-url}}
+    steps:
+      - name: Publish GitHub Release
+        id: publish-github-release
+        uses: SonarSource/release-github-actions/publish-github-release@v1
+        with:
+          release-version: ${{ needs.prepare-release.outputs.release-version }}
+          release-notes: ${{ inputs.release-notes != '' && inputs.release-notes || needs.prepare-release.outputs.release-notes }}
+          draft: ${{ inputs.is-draft-release }}
+          branch: ${{ inputs.branch }}
+
+  release-in-jira:
+    name: Release in Jira
+    runs-on: ubuntu-latest
+    needs: [ prepare-release, publish-github-release, create-release-ticket ]
+    permissions:
+      statuses: read
+      contents: read
+      id-token: write
+    outputs:
+      new-version: ${{ steps.create-jira-version.outputs.jira-new-version-name }}
+      sqc-ticket-key: ${{ steps.create-sc-ticket.outputs.ticket-key }}
+      sqc-ticket-url: ${{ steps.create-sc-ticket.outputs.ticket-url }}
+      sqs-ticket-key: ${{ steps.create-sonar-ticket.outputs.ticket-key }}
+      sqs-ticket-url: ${{ steps.create-sonar-ticket.outputs.ticket-url }}
+    steps:
+      - name: Release in Jira
+        uses: SonarSource/release-github-actions/release-jira-version@v1
+        with:
+          jira-version-name: ${{ needs.prepare-release.outputs.jira-version-name }}
+
+      - name: Create new release in jira
+        id: create-jira-version
+        uses: SonarSource/release-github-actions/create-jira-version@v1
+        with:
+          jira-version-name: ${{ needs.prepare-release.outputs.jira-version-name }}
+          jira-new-version-name: ${{ inputs.new-version }}
+
+      - name: Move release ticket to Technical release Done
+        uses: SonarSource/release-github-actions/update-release-ticket-status@v1
+        with:
+          release-ticket-key: ${{ needs.create-release-ticket.outputs.release-ticket-key }}
+          status: "Technical Release Done"
+          assignee: ${{ inputs.pm-email }}
+
+      # TODO: Add step to post artifact links comment to Jira release ticket
+      # Per DBD release instructions: "For clarity, add a comment in the Jira REL ticket with links
+      # pointing to the three artifacts in JFrog"
+      # Required artifacts:
+      #   - sonar-dbd-java-frontend-plugin
+      #   - sonar-dbd-python-frontend-plugin
+      #   - sonar-dbd-plugin
+      # See manual ABD/DBD release instructions on Xtranet
+
+      - name: Create SC Ticket
+        id: create-sc-ticket
+        uses: SonarSource/release-github-actions/create-integration-ticket@v1
+        with:
+          plugin-name: ${{ inputs.project-name }}
+          release-version: ${{ needs.prepare-release.release-version }}
+          release-ticket-key: ${{ needs.create-release-ticket.outputs.release-ticket-key }}
+          target-jira-project: "SC"
+          ticket-description: ${{ inputs.short-description }}
+          jira-release-url: ${{ needs.prepare-release.outputs.jira-release-url }}
+
+      - name: Create SONAR Ticket
+        id: create-sonar-ticket
+        uses: SonarSource/release-github-actions/create-integration-ticket@v1
+        with:
+          plugin-name: ${{ inputs.project-name }}
+          release-version: ${{ needs.prepare-release.release-version }}
+          release-ticket-key: ${{ needs.create-release-ticket.outputs.release-ticket-key }}
+          target-jira-project: "SONAR"
+          ticket-description: ${{ inputs.short-description }}
+          jira-release-url: ${{ needs.prepare-release.outputs.jira-release-url }}
+
+  update-analyzers:
+    name: Update Analyzers in SQS and SQC
+    runs-on: ubuntu-latest
+    needs: [ prepare-release, release-in-jira ]
+    permissions:
+      id-token: write
+    outputs:
+      sqs-pull-request-url: ${{ steps.update-sqs.outputs.pull-request-url }}
+      sqc-pull-request-url: ${{ steps.update-sqc.outputs.pull-request-url }}
+    steps:
+      - name: Update analyzer in SQS
+        id: update-sqs
+        uses: SonarSource/release-github-actions/update-analyzer@v1
+        with:
+          release-version: ${{ needs.prepare-release.outputs.release-version }}
+          ticket-key: ${{ needs.release-in-jira.outputs.sqs-ticket-key }}
+          plugin-name: ${{ inputs.project-name }}
+          secret-name: ${{ inputs.release-automation-secret-name }}
+          plugin-artifacts: ${{inputs.plugin-artifacts }}
+          draft: ${{ inputs.is-draft-release }}
+          reviewers: ${{ github.actor }}
+
+      - name: Update analyzer in SQC
+        id: update-sqc
+        uses: SonarSource/release-github-actions/update-analyzer@v1
+        with:
+          release-version: ${{ needs.prepare-release.outputs.release-version }}
+          ticket-key: ${{ needs.release-in-jira.outputs.sqc-ticket-key }}
+          plugin-name: ${{ inputs.project-name }}
+          secret-name: ${{ inputs.release-automation-secret-name }}
+          plugin-artifacts: ${{inputs.plugin-artifacts }}
+          draft: ${{ inputs.is-draft-release }}
+          reviewers: ${{ github.actor }}
+
+
+  summarize_release:
+    name: Release
+    runs-on: ubuntu-latest
+    if: always()
+    needs: [ pre-release-checks, prepare-release, publish-github-release, create-release-ticket, release-in-jira, update-analyzers ]
+    steps:
+      - name: Post Summary to Workflow
+        run: |
+          ALL_SUCCESS=$([[ "${{ needs.pre-release-checks.result }}" == "success" && \
+                          "${{ needs.prepare-release.result }}" == "success" && \
+                          "${{ needs.publish-github-release.result }}" == "success" && \
+                          "${{ needs.create-release-ticket.result }}" == "success" && \
+                          "${{ needs.release-in-jira.result }}" == "success" && \
+                          "${{ needs.update-analyzers.result }}" == "success" ]] && echo "true" || echo "false")
+          
+          if [[ "$ALL_SUCCESS" == "true" ]]; then
+            echo "### 🎉🚀 Congratulations! Release Successful! 🚀🎉" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Summary of the release:**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌💥 Release Failed! 💥❌" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Summary of the failed release:**" >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          echo "- **Released Version:** ${{ needs.prepare-release.outputs.release-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **New Version:** ${{ needs.release-in-jira.outputs.new-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Jira Release URL:** ${{ needs.prepare-release.outputs.jira-release-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Release Ticket URL:** ${{ needs.create-release-ticket.outputs.release-ticket-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **GitHub Release URL:** ${{ needs.publish-github-release.outputs.github-release-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **SQS Integration Ticket URL:** ${{ needs.release-in-jira.outputs.sqs-ticket-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **SQC Integration Ticket URL:** ${{ needs.release-in-jira.outputs.sqc-ticket-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **SQS Analyzer PR URL:** ${{ needs.update-analyzers.outputs.sqs-pull-request-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **SQC Analyzer PR URL:** ${{ needs.update-analyzers.outputs.sqc-pull-request-url }}" >> $GITHUB_STEP_SUMMARY
+          
+          if [[ "$ALL_SUCCESS" == "true" ]]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "PS: Don't forget to review and merge the bump version, SQS and SQC!" >> $GITHUB_STEP_SUMMARY
+            echo "You should also update the relevant integration ticket statuses (don't forget to set the SQS ticket fix versions!)" >> $GITHUB_STEP_SUMMARY
+            echo "For more information please check the release instructions at:" >> $GITHUB_STEP_SUMMARY
+            echo "https://xtranet-sonarsource.atlassian.net/wiki/spaces/CodeQualit/pages/2824634385/DBD+Release+Instructions#Manual-Release" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "For fixes to common issues and other useful information please check the release instructions at:" >> $GITHUB_STEP_SUMMARY
+            echo "https://xtranet-sonarsource.atlassian.net/wiki/spaces/CodeQualit/pages/2824634385/DBD+Release+Instructions" >> $GITHUB_STEP_SUMMARY
+          fi
