Skip to content

Commit 8bc338a

Browse files
raboofraboof
committed
chore: stage release candidates from CI
1 parent afef79d commit 8bc338a

File tree

1 file changed

+341
-0
lines changed

1 file changed

+341
-0
lines changed

‎.github/workflows/stage-release-candidate.yml‎

Lines changed: 341 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,341 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
name: Stage release candidate
19+
20+
on:
21+
workflow_dispatch:
22+
inputs:
23+
source-tar-to-svn:
24+
description: "Stage the source tarball to svn (old)"
25+
default: true
26+
type: boolean
27+
source-tar-to-atr:
28+
description: "Stage the source tarball to ATR (new)"
29+
default: true
30+
type: boolean
31+
jars:
32+
description: "Stage the binary jars to nexus"
33+
default: true
34+
type: boolean
35+
email-template:
36+
description: "Generate vote email template"
37+
default: true
38+
type: boolean
39+
40+
permissions:
41+
contents: read
42+
43+
jobs:
44+
# Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate
45+
# Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml
46+
stage-release-candidate-to-svn:
47+
runs-on: ubuntu-24.04
48+
if: ${{ inputs.source-tar-to-svn }}
49+
steps:
50+
- name: Check version parameter
51+
run: |-
52+
# To be enabled after this workflow has been tested:
53+
#if [[ "$REF" != "v"* ]]; then
54+
# echo "Trigger this workflow on a version tag"
55+
# exit 1
56+
#fi
57+
if [[ "$REF" != *"-RC"* ]]; then
58+
echo "Trigger this workflow on an RC tag"
59+
exit 1
60+
fi
61+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
62+
export RC_VERSION=$(echo $REF | tail -c +2)
63+
echo "Version: $VERSION"
64+
echo "RC Version: $RC_VERSION"
65+
env:
66+
REF: ${{ github.ref_name }}
67+
68+
- name: Checkout
69+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5.0.1
70+
with:
71+
fetch-depth: 0
72+
fetch-tags: true
73+
persist-credentials: false
74+
75+
- name: Generate source archive
76+
run: |-
77+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
78+
PREFIX=apache-pekko-http-$VERSION
79+
DATE=$(git log -n1 --format=%cs | tr -d -)
80+
TARBALL=$PREFIX-src-$DATE.tgz
81+
82+
mkdir archive
83+
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL
84+
cd archive
85+
sha512sum $TARBALL > $TARBALL.sha512
86+
env:
87+
REF: ${{ github.ref_name }}
88+
89+
- name: Sign source archive
90+
run: |-
91+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
92+
gpg -ab archive/*.tgz
93+
env:
94+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
95+
96+
- name: Install Apache Subversion
97+
run: |-
98+
sudo apt-get update
99+
sudo apt-get install -y subversion
100+
101+
- name: Upload source dist
102+
run: |-
103+
svn checkout https://dist.apache.org/repos/dist/dev/pekko dist
104+
cd dist
105+
106+
export RC_VERSION=$(echo $REF | tail -c +2)
107+
108+
mkdir $RC_VERSION
109+
cp ../archive/* $RC_VERSION
110+
svn add $RC_VERSION
111+
svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko $RC_VERSION" $RC_VERSION
112+
env:
113+
PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }}
114+
PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }}
115+
REF: ${{ github.ref_name }}
116+
117+
stage-release-candidate-to-atr:
118+
permissions:
119+
id-token: write
120+
contents: read
121+
runs-on: ubuntu-24.04
122+
if: ${{ inputs.source-tar-to-atr }}
123+
steps:
124+
- name: Check version parameter
125+
run: |-
126+
# To be enabled after this workflow has been tested:
127+
#if [[ "$REF" != "v"* ]]; then
128+
# echo "Trigger this workflow on a version tag"
129+
# exit 1
130+
#fi
131+
if [[ "$REF" != *"-RC"* ]]; then
132+
echo "Trigger this workflow on an RC tag"
133+
exit 1
134+
fi
135+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
136+
export RC_VERSION=$(echo $REF | tail -c +2)
137+
echo "Version: $VERSION"
138+
echo "RC Version: $RC_VERSION"
139+
env:
140+
REF: ${{ github.ref_name }}
141+
142+
- name: Checkout
143+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5.0.1
144+
with:
145+
fetch-depth: 0
146+
fetch-tags: true
147+
persist-credentials: false
148+
149+
- name: Generate source archive
150+
run: |-
151+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
152+
PREFIX=apache-pekko-http-$VERSION
153+
DATE=$(git log -n1 --format=%cs | tr -d -)
154+
TARBALL=$PREFIX-src-$DATE.tgz
155+
156+
mkdir dist
157+
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL
158+
cd dist
159+
sha512sum $TARBALL > $TARBALL.sha512
160+
env:
161+
REF: ${{ github.ref_name }}
162+
163+
- name: Sign source archive
164+
run: |-
165+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
166+
gpg -ab dist/*.tgz
167+
env:
168+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
169+
170+
- name: Upload source dist
171+
uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f
172+
with:
173+
project: pekko-http
174+
version: ${{ env.VERSION }}
175+
176+
stage-jars-to-nexus:
177+
runs-on: ubuntu-24.04
178+
if: ${{ inputs.jars }}
179+
steps:
180+
- name: Check version parameter
181+
run: |-
182+
# To be enabled after this workflow has been tested:
183+
#if [[ "$REF" != "v"* ]]; then
184+
# echo "Trigger this workflow on a version tag"
185+
# exit 1
186+
#fi
187+
if [[ "$REF" != *"-RC"* ]]; then
188+
echo "Trigger this workflow on an RC tag"
189+
exit 1
190+
fi
191+
export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/")
192+
export RC_VERSION=$(echo $REF | tail -c +2)
193+
echo "Version: $VERSION"
194+
echo "RC Version: $RC_VERSION"
195+
env:
196+
REF: ${{ github.ref_name }}
197+
198+
- name: Checkout
199+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5.0.1
200+
with:
201+
fetch-depth: 0
202+
fetch-tags: true
203+
persist-credentials: false
204+
205+
- name: Setup Java 17
206+
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
207+
with:
208+
distribution: temurin
209+
java-version: 17
210+
211+
- name: Install sbt
212+
uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1.1.14
213+
214+
# We intentionally do not use the Coursier cache for release candiates,
215+
# to reduce attack surface
216+
217+
# It would be better to split this into 3 steps, where only the first
218+
# uses sbt and the signing/staging are done with well-known tools
219+
# reducing attack surface, but this seems to be the state of the art:
220+
- name: Build, sign and stage artifacts
221+
run: |-
222+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
223+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
224+
225+
sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned"
226+
sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose"
227+
env:
228+
REF: ${{ github.ref_name }}
229+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
230+
SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
231+
SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }}
232+
233+
email-template:
234+
runs-on: ubuntu-24.04
235+
if: ${{ inputs.email-template }}
236+
steps:
237+
- name: Generate vote email template
238+
run: |-
239+
export MODULE="Pekko HTTP"
240+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
241+
export RC_VERSION=$(echo $REF | tail -c +2)
242+
echo "VERSION=$VERSION"
243+
echo "RC_VERSION=$RC_VERSION"
244+
245+
export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \")
246+
echo "DISCUSS=$DISCUSS"
247+
export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \")
248+
echo "DISCUSS_THREAD=$DISCUSS_THREAD"
249+
250+
export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1)
251+
echo "RELEASE_NOTES=$RELEASE_NOTES"
252+
253+
export SENDER=$(curl "https://api.github.com/users/$ACTOR" | jq .name | tr -d \")
254+
echo "SENDER=$SENDER"
255+
256+
echo "This template can be used to start a vote, either via manual email or via https://release-test.apache.org/compose/pekko/$VERSION"
257+
echo
258+
cat <<EOF;
259+
Subject: [VOTE] Release Apache $MODULE $RC_VERSION
260+
261+
Hello Pekko Community,
262+
263+
This is a call for a vote to release Apache $MODULE version $RC_VERSION
264+
265+
The discussion thread:
266+
267+
$DISCUSS_THREAD
268+
269+
The release candidate:
270+
271+
https://dist.apache.org/repos/dist/dev/pekko/$RC_VERSION
272+
https://release-test.apache.org/vote/pekko/$VERSION
273+
274+
This release has been signed with a PGP key available here:
275+
276+
https://downloads.apache.org/pekko/KEYS
277+
278+
Release Notes:
279+
280+
$RELEASE_NOTES
281+
282+
Git branch for the release:
283+
284+
https://github.com/apache/pekko-http/tree/v$RC_VERSION
285+
Git commit ID: $COMMIT_SHA
286+
287+
Please download, verify, and test.
288+
289+
We have also staged jars in the Apache Nexus Repository. These were built with the same code
290+
as appears in this Source Release Candidate. We would appreciate if users could test with these too.
291+
If anyone finds any serious problems with these jars, please also notify us on this thread.
292+
293+
https://repository.apache.org/content/groups/staging/org/apache/pekko/
294+
295+
You can add this resolver to sbt with 'resolvers += Resolver.ApacheMavenStagingRepo'
296+
297+
The VOTE will pass if we have more positive votes than negative votes
298+
and there must be a minimum of 3 approvals from Pekko PMC members.
299+
Anyone voting in favour of the release, could you please provide a list of the checks you have done?
300+
The vote will be left open until [VOTE_ENDS_UTC].
301+
302+
[ ] +1 approve
303+
[ ] +0 no opinion
304+
[ ] -1 disapprove with the reason
305+
306+
To learn more about Apache Pekko, please see https://pekko.apache.org/
307+
308+
Checklist for reference:
309+
310+
[ ] Download links are valid.
311+
[ ] Checksums and signatures.
312+
[ ] LICENSE/NOTICE files exist
313+
[ ] No unexpected binary files
314+
[ ] All source files have ASF headers
315+
[ ] Can compile from source
316+
[ ] Can verify the binary build
317+
318+
To compile from the source, please refer to:
319+
320+
https://github.com/apache/pekko-http/blob/main/README.md#building-from-source
321+
322+
To verify the binary build, please refer to:
323+
324+
https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#verifying-the-binary-build
325+
326+
Some notes about verifying downloads can be found at:
327+
328+
https://pekko.apache.org/download.html#verifying-downloads
329+
330+
You can vote on ATR at https://release-test.apache.org/vote/pekko/$VERSION
331+
or manually by replying to this email.
332+
333+
334+
Thanks,
335+
336+
$SENDER (Apache Pekko PMC member)
337+
EOF
338+
env:
339+
REF: ${{ github.ref_name }}
340+
COMMIT_SHA: ${{ github.sha }}
341+
ACTOR: ${{ github.actor }}

0 commit comments

Comments
 (0)