Skip to content

Commit c3cfafe

Browse files
yasen-pavlov-sonarsourceGabinL21
yasen-pavlov-sonarsource
and
GabinL21
authored
SONARPHP-1684 Create AutomateRelease workflow (#1437)
Co-authored-by: GabinL21 <[email protected]>
1 parent b0cc3e3 commit c3cfafe

File tree

5 files changed

+304
-44
lines changed

5 files changed

+304
-44
lines changed

‎.github/workflows/AutomateRelease.yml

Lines changed: 299 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,299 @@
1+
name: Automate release
2+
3+
env:
4+
PROJECT_KEY: "SONARPHP"
5+
PROJECT_NAME: "SonarPHP"
6+
LANGUAGE: "php"
7+
USE_JIRA_SANDBOX: false
8+
DRAFT_RELEASE: false
9+
PM_EMAIL: '[email protected]'
10+
11+
on:
12+
workflow_dispatch:
13+
inputs:
14+
short_description:
15+
description: |
16+
A brief summary of what the release contains.
17+
This will be added directly to the release ticket.
18+
required: true
19+
next_version:
20+
description: |
21+
Specify the version for the next release (e.g., 4.2.0).
22+
If left blank, the minor version will be automatically incremented.
23+
required: false
24+
jira_release_name:
25+
description: |
26+
The name of the release version in Jira.
27+
If blank, the action will try to use the *only* unreleased version in the project.
28+
required: false
29+
sonarlint_changelog:
30+
description: |
31+
A summary of release notes relevant to the SonarQube IDE extensions.
32+
required: false
33+
sqs_fix_versions:
34+
description: |
35+
A comma-separated list of fix versions for the SQS integration ticket.
36+
(e.g., sqs-2025.4, sqcb-25.7)
37+
required: false
38+
integration_prs_reviewers:
39+
description: |
40+
A comma-separated list of GitHub usernames to request as reviewers on integration PRs.
41+
(e.g., gh-username,another-user)
42+
required: false
43+
44+
jobs:
45+
lock_master_branch:
46+
name: Lock master branch
47+
uses: ./.github/workflows/ToggleLockBranch.yml
48+
permissions:
49+
id-token: write
50+
51+
check_releasability:
52+
name: Check releasability
53+
runs-on: ubuntu-latest
54+
needs: lock_master_branch
55+
permissions:
56+
checks: read
57+
outputs:
58+
version: ${{ steps.check_releasability_status.outputs.version }}
59+
steps:
60+
- name: Check Releasability and Get Version
61+
id: check_releasability_status
62+
uses: SonarSource/release-github-actions/check-releasability-status@09c557fb83722adbe2af2ca7e625324e15739362
63+
64+
create_release_ticket:
65+
name: Create release ticket
66+
runs-on: ubuntu-latest
67+
needs: check_releasability
68+
permissions:
69+
contents: read
70+
id-token: write # Required for authenticating to Vault
71+
outputs:
72+
release_name: ${{ steps.create_ticket.outputs.jira_release_name }}
73+
release_ticket_key: ${{ steps.create_ticket.outputs.ticket_key }}
74+
release_url: ${{ steps.create_ticket.outputs.release_url }}
75+
release_ticket_url: ${{ steps.create_ticket.outputs.ticket_url }}
76+
steps:
77+
- name: Get Jira Credentials from Vault
78+
id: secrets
79+
uses: SonarSource/vault-action-wrapper@v3
80+
with:
81+
secrets: |
82+
development/kv/data/jira user | JIRA_USER;
83+
development/kv/data/jira token | JIRA_TOKEN;
84+
85+
- name: Create Jira Release Ticket
86+
id: create_ticket
87+
uses: SonarSource/release-github-actions/create-jira-release-ticket@09c557fb83722adbe2af2ca7e625324e15739362
88+
with:
89+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
90+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
91+
project_key: ${{ env.PROJECT_KEY }}
92+
project_name: ${{ env.PROJECT_NAME }}
93+
version: ${{ needs.check_releasability.outputs.version }}
94+
short_description: ${{ github.event.inputs.short_description }}
95+
sq_compatibility: ">=LTS"
96+
targeted_product: "11.0"
97+
jira_release_name: ${{ github.event.inputs.jira_release_name }}
98+
sonarlint_changelog: ${{ github.event.inputs.sonarlint_changelog }}
99+
use_sandbox: ${{ env.USE_JIRA_SANDBOX }}
100+
101+
- name: Start progress on release ticket
102+
id: rel_ticket_start_progress
103+
uses: SonarSource/release-github-actions/update-release-ticket-status@09c557fb83722adbe2af2ca7e625324e15739362
104+
with:
105+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
106+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
107+
ticket_key: ${{ steps.create_ticket.outputs.ticket_key }}
108+
status: "Start Progress"
109+
use_sandbox: ${{ env.USE_JIRA_SANDBOX }}
110+
111+
publish_release:
112+
name: Publish Release
113+
runs-on: ubuntu-latest
114+
needs: [ check_releasability, create_release_ticket ]
115+
permissions:
116+
contents: write
117+
id-token: write # Required for authenticating to Vault
118+
outputs:
119+
release_url: ${{ steps.publish_github_release.outputs.release_url }}
120+
steps:
121+
- name: Get Jira Credentials from Vault
122+
id: secrets
123+
uses: SonarSource/vault-action-wrapper@v3
124+
with:
125+
secrets: |
126+
development/kv/data/jira user | JIRA_USER;
127+
development/kv/data/jira token | JIRA_TOKEN;
128+
129+
- name: Publish Github release
130+
id: publish_github_release
131+
uses: SonarSource/release-github-actions/publish-github-release@09c557fb83722adbe2af2ca7e625324e15739362
132+
with:
133+
version: ${{ needs.check_releasability.outputs.version }}
134+
jira_project_key: ${{ env.PROJECT_KEY }}
135+
jira_release_name: ${{ needs.create_release_ticket.outputs.release_name }}
136+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
137+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
138+
draft: ${{ env.DRAFT_RELEASE }}
139+
140+
release:
141+
name: Sonar release
142+
needs: publish_release
143+
uses: ./.github/workflows/release.yml
144+
permissions:
145+
id-token: write
146+
contents: write
147+
148+
release_in_jira:
149+
name: Release in Jira
150+
runs-on: ubuntu-latest
151+
needs: [ release, create_release_ticket ]
152+
permissions:
153+
contents: read
154+
id-token: write # Required for authenticating to Vault
155+
outputs:
156+
new_release_version: ${{ steps.jira_release.outputs.new_version_name }}
157+
steps:
158+
- name: Get Jira Credentials from Vault
159+
id: secrets
160+
uses: SonarSource/vault-action-wrapper@v3
161+
with:
162+
secrets: |
163+
development/kv/data/jira user | JIRA_USER;
164+
development/kv/data/jira token | JIRA_TOKEN;
165+
166+
- name: Release in Jira and Create Next Version
167+
id: jira_release
168+
uses: SonarSource/release-github-actions/release-jira-version@09c557fb83722adbe2af2ca7e625324e15739362
169+
with:
170+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
171+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
172+
project_key: ${{ env.PROJECT_KEY }}
173+
jira_release_name: ${{ needs.create_release_ticket.outputs.release_name }}
174+
new_version_name: ${{ github.event.inputs.next_version }}
175+
use_sandbox: ${{ env.USE_JIRA_SANDBOX }}
176+
177+
- name: Move release ticket to done
178+
id: rel_ticket_move_to_done
179+
uses: SonarSource/release-github-actions/update-release-ticket-status@09c557fb83722adbe2af2ca7e625324e15739362
180+
with:
181+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
182+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
183+
ticket_key: ${{ needs.create_release_ticket.outputs.release_ticket_key }}
184+
status: "Technical Release Done"
185+
assignee: ${{ env.PM_EMAIL }}
186+
use_sandbox: ${{ env.USE_JIRA_SANDBOX }}
187+
188+
unlock_master_branch:
189+
name: Unlock master branch
190+
needs: [ lock_master_branch, release_in_jira ]
191+
if: always() && needs.lock_master_branch.result == 'success'
192+
uses: ./.github/workflows/ToggleLockBranch.yml
193+
permissions:
194+
id-token: write
195+
196+
bump_versions:
197+
name: Bump versions
198+
needs: [ unlock_master_branch, release_in_jira ]
199+
uses: ./.github/workflows/bump-versions.yaml
200+
permissions:
201+
contents: write # write for peter-evans/create-pull-request, read for actions/checkout
202+
pull-requests: write # write for peter-evans/create-pull-request
203+
with:
204+
version: ${{ needs.release_in_jira.outputs.new_release_version }}-SNAPSHOT
205+
206+
update-integration-tickets:
207+
name: Update Integration Tickets
208+
runs-on: ubuntu-latest
209+
needs: bump_versions
210+
permissions:
211+
contents: read
212+
id-token: write
213+
outputs:
214+
sqs_ticket_key: ${{ steps.integration_update.outputs.sqs_ticket_key }}
215+
sc_ticket_key: ${{ steps.integration_update.outputs.sc_ticket_key }}
216+
sqs_ticket_url: ${{ steps.integration_update.outputs.sqs_ticket_url}}
217+
sc_ticket_url: ${{ steps.integration_update.outputs.sc_ticket_url }}
218+
steps:
219+
- name: Get Jira Credentials from Vault
220+
id: secrets
221+
uses: SonarSource/vault-action-wrapper@v3
222+
with:
223+
secrets: |
224+
development/kv/data/jira user | JIRA_USER;
225+
development/kv/data/jira token | JIRA_TOKEN;
226+
227+
- name: Find and Update Tickets
228+
id: integration_update
229+
uses: SonarSource/release-github-actions/update-integration-tickets@09c557fb83722adbe2af2ca7e625324e15739362
230+
with:
231+
jira_user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
232+
jira_token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
233+
release_ticket_key: "REL-3639"
234+
sqs_fix_versions: ${{ github.event.inputs.sqs_fix_versions }}
235+
use_sandbox: ${{ env.USE_JIRA_SANDBOX }}
236+
237+
- name: Echo Found Ticket Keys
238+
run: |
239+
echo "Found SQS integration ticket: ${{ steps.integration_update.outputs.sqs_ticket_key }}"
240+
echo "Found SC integration ticket: ${{ steps.integration_update.outputs.sc_ticket_key }}"
241+
242+
update-analyzers:
243+
name: Update Analyzers in SQS and SC
244+
runs-on: ubuntu-latest
245+
needs: [ update-integration-tickets, check_releasability ]
246+
permissions:
247+
id-token: write
248+
outputs:
249+
sqs_pr_url: ${{ steps.update_step_sqs.outputs.pr-url }}
250+
sc_pr_url: ${{ steps.update_step_sc.outputs.pr-url }}
251+
steps:
252+
- name: Get GitHub token from Vault
253+
id: secrets
254+
uses: SonarSource/vault-action-wrapper@v3
255+
with:
256+
secrets: |
257+
development/github/token/SonarSource-sonar-php-release-automation token | GITHUB_TOKEN;
258+
259+
- name: Update analyzer in SQS
260+
id: update_step_sqs
261+
uses: SonarSource/release-github-actions/update-analyzer@09c557fb83722adbe2af2ca7e625324e15739362
262+
with:
263+
version: ${{ needs.check_releasability.outputs.version }}
264+
ticket: ${{ needs.update-integration-tickets.outputs.sqs_ticket_key }}
265+
plugin-language: 'php'
266+
github-token: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
267+
draft: true
268+
reviewers: ${{ github.event.inputs.integration_prs_reviewers }}
269+
270+
- name: Update analyzer in SC
271+
id: update_step_sc
272+
uses: SonarSource/release-github-actions/update-analyzer@09c557fb83722adbe2af2ca7e625324e15739362
273+
with:
274+
version: ${{ needs.check_releasability.outputs.version }}
275+
ticket: ${{ needs.update-integration-tickets.outputs.sc_ticket_key }}
276+
plugin-language: 'php'
277+
github-token: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
278+
draft: true
279+
reviewers: ${{ github.event.inputs.integration_prs_reviewers }}
280+
281+
summarize_release:
282+
name: Release
283+
runs-on: ubuntu-latest
284+
needs: [ check_releasability, create_release_ticket, publish_release, update-integration-tickets, update-analyzers, release_in_jira ]
285+
steps:
286+
- name: Post Summary to Workflow
287+
run: |
288+
echo "### 🎉🚀 Congratulations! Release Successful! 🚀🎉" >> $GITHUB_STEP_SUMMARY
289+
echo "" >> $GITHUB_STEP_SUMMARY
290+
echo "**Summary of the release:**" >> $GITHUB_STEP_SUMMARY
291+
echo "- **Released Version:** ${{ needs.check_releasability.outputs.version }}" >> $GITHUB_STEP_SUMMARY
292+
echo "- **New Version:** ${{ needs.release_in_jira.outputs.new_release_version }}" >> $GITHUB_STEP_SUMMARY
293+
echo "- **Jira Release URL:** ${{ needs.create_release_ticket.outputs.release_url }}" >> $GITHUB_STEP_SUMMARY
294+
echo "- **Release Ticket URL:** ${{ needs.create_release_ticket.outputs.release_ticket_url }}" >> $GITHUB_STEP_SUMMARY
295+
echo "- **GitHub Release URL:** ${{ needs.publish_release.outputs.release_url }}" >> $GITHUB_STEP_SUMMARY
296+
echo "- **SQS Integration Ticket URL:** ${{ needs.update-integration-tickets.outputs.sqs_ticket_url }}" >> $GITHUB_STEP_SUMMARY
297+
echo "- **SQC Integration Ticket URL:** ${{ needs.update-integration-tickets.outputs.sc_ticket_url }}" >> $GITHUB_STEP_SUMMARY
298+
echo "- **SQS Analyzer PR URL:** ${{ needs.update-analyzers.outputs.sqs_pr_url }}" >> $GITHUB_STEP_SUMMARY
299+
echo "- **SQC Analyzer PR URL:** ${{ needs.update-analyzers.outputs.sc_pr_url }}" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/automate_release.yml

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎.github/workflows/bump-versions.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ jobs:
2222
steps:
2323
- uses: actions/checkout@v4
2424
- run: |
25-
sed -i 's/version=.*/version=${{ github.event.inputs.version }}/' gradle.properties
26-
cd php-custom-rules-plugin/maven && mvn versions:set -DgenerateBackupPoms=false -DnewVersion=${{ github.event.inputs.version }}
25+
sed -i 's/version=.*/version=${{ inputs.version }}/' gradle.properties
26+
cd php-custom-rules-plugin/maven && mvn versions:set -DgenerateBackupPoms=false -DnewVersion=${{ inputs.version }}
2727
- uses: peter-evans/create-pull-request@v7
2828
with:
2929
author: ${{ github.actor }} <${{ github.actor }}>

‎.github/workflows/release.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: sonar-release
33
# This workflow is triggered when publishing a new github release
44
# yamllint disable-line rule:truthy
55
on:
6+
workflow_call:
67
release:
78
types:
89
- published

‎.github/workflows/rule-metadata-update.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
name: rule-metadata-update
22
on:
3+
workflow_call:
34
workflow_dispatch:
4-
5+
56
jobs:
67
rule-metadata-update:
78
runs-on: ubuntu-latest-large

0 commit comments

Comments
 (0)