Add metafile.json to track version and checksum of artifacts

Author: harrryr

.github/workflows/post-release-version-bump.yml

@@ -27,8 +27,8 @@ jobs:
 
       - name: Extract Major.Minor Version and setup Env variable
         run: |
-          echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
+          echo "VERSION=0.3.0" >> $GITHUB_ENV
+          echo "MAJOR_MINOR=$(echo 0.3.0 | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
 
       - name: Get current major.minor version from main branch
         id: get_version
@@ -85,8 +85,8 @@ jobs:
 
       - name: Extract Major.Minor Version and setup Env variable
         run: |
-          echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
+          echo "VERSION=0.3.0" >> $GITHUB_ENV
+          echo "MAJOR_MINOR=$(echo 0.3.0 | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
 
       - name: Determine release branch and checkout
         run: |
@@ -101,28 +101,47 @@ jobs:
 
       - name: Update version to next development version in main
         run: |
-          DEV_VERSION="${{ github.event.inputs.version }}-dev0"
+          DEV_VERSION="0.3.0-dev0"
           sed -i'' -e "s/\"version\": \".*\"/\"version\": \"${DEV_VERSION}\"/" aws-distro-opentelemetry-node-autoinstrumentation/package.json
           sed -i'' -e "s/\"version\": \".*\"/\"version\": \"${DEV_VERSION}\"/" docker-utils/package.json
           sed -i'' -e "s/\"version\": \".*\"/\"version\": \"${DEV_VERSION}\"/" package.json
-          VERSION="${{ github.event.inputs.version }}"
+          VERSION="0.3.0"
           npm install
           sed -i  "s|\(/aws-observability/adot-autoinstrumentation-node:\)v[0-9]\+\.[0-9]\+\.[0-9]\+|\1v${{github.event.inputs.version}}|g" .github/workflows/daily-scan.yml
           git add .
-          git status
+
+      - name: Append latest release checksum to release-build-metadata.json
+        run: |
+          ARTIFACT_NAME="aws-aws-distro-opentelemetry-node-autoinstrumentation-0.3.0.tgz"
+          curl -L -o $ARTIFACT_NAME https://github.com/aws-observability/aws-otel-js-instrumentation/releases/download/v0.3.0/$ARTIFACT_NAME
+
+          CHECKSUM=$(shasum -a 256 $ARTIFACT_NAME | awk '{ print $1 }')
+
+          FILE="release-build-metadata.json"
+          UPDATED_JSON=$(jq --arg version "${{ env.VERSION }}" \
+                            --arg name "$ARTIFACT_NAME" \
+                            --arg checksum "$CHECKSUM" \
+                            '.release += [{"version": $version, "checksum": [{"name": $name, "checksum": $checksum}]}]' "$FILE")
+
+          echo "$UPDATED_JSON" > "$FILE"
+          git add release-build-metadata.json
+
+      - name: Push changes to Github
+        run: |
           git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
           git push --set-upstream origin "prepare-main-for-next-dev-cycle-${VERSION}"
 
       - name: Create Pull Request to main
         env:
           GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
         run: |
-          DEV_VERSION="${{ github.event.inputs.version }}-dev0"
+          DEV_VERSION="0.3.0-dev0"
           gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
                        --body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
           
           This PR should only be merge when release for version v$VERSION is success.
           
           By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
                        --head prepare-main-for-next-dev-cycle-${VERSION} \
-                       --base main
+                       --base main
+                       

.github/workflows/release-build.yml

@@ -104,5 +104,26 @@ jobs:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
           NPM_CONFIG_PROVENANCE: true
         run: npx lerna publish from-package --no-push --no-private --no-git-tag-version --no-verify-access --yes
+
+      - name: Get SHA256 checksum of wheel file
+        id: get_sha256
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          checksum=$(shasum -a 256 aws-distro-opentelemetry-node-autoinstrumentation/aws-aws-distro-opentelemetry-node-autoinstrumentation-${{ github.event.inputs.version }}.tgz | awk '{ print $1 }')
+          echo "CHECKSUM=$checksum" >> $GITHUB_OUTPUT
+
+      - name: Append checksum and update version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "aws-aws-distro-opentelemetry-node-autoinstrumentation-${{ github.event.inputs.version }}.tgz ${{ steps.get_sha256.outputs.CHECKSUM }}" >> checksum.txt
+          echo "${{ github.event.inputs.version }}" > version.txt
+
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "GitHub Action Release Workflow"
+          git add checksum.txt version.txt
+          git commit -m "Update latest version and append checksum"
+          git push
     
 

checksum.txt

@@ -0,0 +1,14 @@
+{
+    "release": [
+        {
+            "version": "0.3.0",
+            "checksum": [
+                {
+                    "name": "aws-aws-distro-opentelemetry-node-autoinstrumentation-0.3.0.tgz",
+                    "checksum": "22f0aabe7a24f57769c994acd57031caafbdbde46b3ca396372499055a7cb76c"
+                }
+            ]
+        }
+    ]
+}
+