Skip to content

Commit e7b5392

Browse files
josecorellajosecorella
authored
chore(CI/CD): add semantic release automation (#647)
1 parent 10daadf commit e7b5392

File tree

4 files changed

+275
-0
lines changed

4 files changed

+275
-0
lines changed

‎.github/workflows/sem_ver.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# This workflow tests the installation of semantic release
2+
name: Semantic Release Test Installation
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
semantic-release:
9+
runs-on: macos-latest
10+
permissions:
11+
id-token: write
12+
contents: read
13+
steps:
14+
- name: Support longpaths on Git checkout
15+
run: |
16+
git config --global core.longpaths true
17+
18+
- uses: actions/checkout@v3
19+
with:
20+
submodules: recursive
21+
# We need access to the role that is able to get CI Bot Creds
22+
- name: Configure AWS Credentials for Release
23+
uses: aws-actions/configure-aws-credentials@v2
24+
with:
25+
aws-region: us-west-2
26+
role-to-assume: arn:aws:iam::587316601012:role/GitHub-CI-CI-Bot-Credential-Access-Role-us-west-2
27+
role-session-name: CI_Bot_Release
28+
29+
- name: Upgrade Node
30+
uses: actions/setup-node@v4
31+
with:
32+
node-version: 21
33+
34+
# Use AWS Secrets Manger GHA to retrieve CI Bot Creds
35+
- name: Get CI Bot Creds Secret
36+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
37+
with:
38+
secret-ids: Github/aws-crypto-tools-ci-bot
39+
parse-json-secrets: true
40+
41+
# Log in as the CI Bot
42+
- name: Log in as CI Bot
43+
run: |
44+
echo ${{env.GITHUB_AWS_CRYPTO_TOOLS_CI_BOT_ESDK_RELEASE_TOKEN}} > token.txt
45+
gh auth login --with-token < token.txt
46+
rm token.txt
47+
gh auth status
48+
49+
# Test to see if we can setup semantic release
50+
- name: Test Semantic Release Installation
51+
uses: actions/checkout@v4
52+
- run: |
53+
make setup_semantic_release

‎.github/workflows/semantic_release.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# This workflow runs semantic release, bumps, generates changelog, and tags the project
2+
name: Semantic Release
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry-run:
8+
description: "Is this a dry run to validate semantic-release behaves as expected? (y/n)"
9+
required: true
10+
type: string
11+
12+
jobs:
13+
semantic-release:
14+
# there is no easy way in gha to check if the actor is part of the team, running semantic release is a more
15+
# privileged operation, so we must make sure this list of users is a subset of the users labeled as maintainers of
16+
# https://github.com/orgs/aws/teams/aws-crypto-tools
17+
if: contains('["seebees","texastony","ShubhamChaturvedi7","lucasmcdonald3","josecorella","imabhichow","rishav-karanjit","antonf-amzn","justplaz","ajewellamz","RitvikKapila"]', github.actor)
18+
runs-on: macos-latest
19+
permissions:
20+
id-token: write
21+
contents: write
22+
steps:
23+
- name: Support longpaths on Git checkout
24+
run: |
25+
git config --global core.longpaths true
26+
- uses: actions/checkout@v3
27+
# We only pull in the submodules we need to build the library
28+
- run: git submodule update --init libraries
29+
30+
# We need access to the role that is able to get CI Bot Creds
31+
- name: Configure AWS Credentials for Release
32+
uses: aws-actions/configure-aws-credentials@v2
33+
with:
34+
aws-region: us-west-2
35+
role-to-assume: arn:aws:iam::587316601012:role/GitHub-CI-CI-Bot-Credential-Access-Role-us-west-2
36+
role-session-name: CI_Bot_Release
37+
38+
- name: Upgrade Node
39+
uses: actions/setup-node@v4
40+
with:
41+
node-version: 21
42+
43+
# Use AWS Secrets Manger GHA to retrieve CI Bot Creds
44+
- name: Get CI Bot Creds Secret
45+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
46+
with:
47+
secret-ids: Github/aws-crypto-tools-ci-bot
48+
parse-json-secrets: true
49+
50+
# Log in as the CI Bot
51+
- name: Log in as CI Bot
52+
run: |
53+
echo ${{env.GITHUB_AWS_CRYPTO_TOOLS_CI_BOT_ESDK_RELEASE_TOKEN}} > token.txt
54+
gh auth login --with-token < token.txt
55+
rm token.txt
56+
gh auth status
57+
58+
# Set up semantic release
59+
- name: Setup Semantic Release
60+
run: |
61+
make setup_semantic_release
62+
63+
# Run semantic release in dry run mode if input matches
64+
- name: Run Semantic Release in dry run mode
65+
env:
66+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
67+
if: ${{inputs.dry-run == 'y'}}
68+
run: |
69+
make dry_run_semantic_release
70+
71+
# Run semantic release if input matches
72+
- name: Run Semantic Release
73+
env:
74+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
75+
if: ${{inputs.dry-run == 'n'}}
76+
run: |
77+
make run_semantic_release

‎.releaserc.cjs

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
/*
5+
First run `make setup_semantic_release` to install the required dependencies.
6+
7+
Using this config semantic-release will search for the latest tag
8+
evaluate all commits after that tag
9+
generate release notes and a version bump.
10+
It will commit these changes, push these changes, and publish a new version tag.
11+
12+
This file requires a `--branches` option to function.
13+
This is to facilitate point releases if needed.
14+
15+
`npx semantic-release --branches main`
16+
*/
17+
18+
// This project has several runtimes
19+
// each one has files that need to be updated.
20+
// We model all the files and the runtimes here in this structure
21+
const Runtimes = {
22+
net: {
23+
"AwsEncryptionSDK/runtimes/net/ESDK.csproj": {
24+
dependencies: [],
25+
assemblyInfo: []
26+
}
27+
},
28+
};
29+
30+
/**
31+
* @type {import('semantic-release').GlobalConfig}
32+
*/
33+
module.exports = {
34+
branches: ["mainline"],
35+
repositoryUrl:
36+
"[email protected]:aws/aws-encryption-sdk-dafny.git",
37+
plugins: [
38+
// Check the commits since the last release
39+
["@semantic-release/commit-analyzer",
40+
{
41+
"preset": "conventionalcommits",
42+
"parserOpts": {
43+
"noteKeywords": ["BREAKING CHANGE", "BREAKING CHANGES"]
44+
},
45+
"presetConfig": {
46+
"types": [
47+
{"type": "feat", "section": "Features"},
48+
{"type": "fix", "section": "Fixes"},
49+
{"type": "chore", "section": "Maintenance"},
50+
{"type": "docs", "section": "Maintenance"},
51+
{"type": "revert", "section": "Fixes"},
52+
{"type": "style", "hidden": true},
53+
{"type": "refactor", "hidden": true},
54+
{"type": "perf", "hidden": true},
55+
{"type": "test", "hidden": true}
56+
]
57+
},
58+
"releaseRules": [
59+
{"type": "docs", "release": "patch"},
60+
{"type": "revert", "release": "patch"},
61+
{"type": "chore", "release": "patch"}
62+
]
63+
},
64+
],
65+
// Based on the commits generate release notes
66+
["@semantic-release/release-notes-generator",
67+
{
68+
"preset": "conventionalcommits",
69+
"parserOpts": {
70+
"noteKeywords": ["BREAKING CHANGE", "BREAKING CHANGES"]
71+
},
72+
"presetConfig": {
73+
"types": [
74+
{"type": "feat", "section": "Features"},
75+
{"type": "fix", "section": "Fixes"},
76+
{"type": "chore", "section": "Maintenance"},
77+
{"type": "docs", "section": "Maintenance"},
78+
{"type": "revert", "section": "Fixes"},
79+
{"type": "style", "hidden": true},
80+
{"type": "refactor", "hidden": true},
81+
{"type": "perf", "hidden": true},
82+
{"type": "test", "hidden": true}
83+
]
84+
}
85+
}
86+
],
87+
// Update the change log with the generated release notes
88+
[
89+
"@semantic-release/changelog",
90+
{
91+
changelogFile: "CHANGELOG.md",
92+
changelogTitle: "# Changelog",
93+
},
94+
],
95+
96+
// Bump the various versions
97+
[
98+
"semantic-release-replace-plugin",
99+
{
100+
replacements: [
101+
// Update the version for all DotNet projects
102+
// Does not update the dependencies
103+
{
104+
files: Object.keys(Runtimes.net),
105+
from: "<Version>.*</Version>",
106+
to: "<Version>${nextRelease.version}</Version>",
107+
results: Object.keys(Runtimes.net).map(CheckResults),
108+
countMatches: true,
109+
},
110+
],
111+
},
112+
],
113+
// Commit and push changes the changelog and versions bumps
114+
[
115+
"@semantic-release/git",
116+
{
117+
assets: [
118+
"CHANGELOG.md",
119+
...Object.values(Runtimes).flatMap((r) => Object.keys(r)),
120+
...Object.values(Runtimes.net).flatMap((r) => r.assemblyInfo),
121+
],
122+
message:
123+
"chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
124+
},
125+
],
126+
],
127+
};
128+
129+
function CheckResults(file) {
130+
return {
131+
file,
132+
hasChanged: true,
133+
numMatches: 1,
134+
numReplacements: 1,
135+
};
136+
}

‎Makefile

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,12 @@ duvet_report:
2929
--source-pattern "AwsCryptographicMaterialProviders/compliance_exceptions/**/*.txt" \
3030
--source-pattern "(# //=,# //#).github/workflows/duvet.yaml" \
3131
--html specification_compliance_report.html
32+
33+
setup_semantic_release:
34+
npm i --no-save semantic-release @semantic-release/changelog semantic-release-replace-plugin conventional-changelog-conventionalcommits @semantic-release/git
35+
36+
run_semantic_release:
37+
npx semantic-release --no-ci
38+
39+
dry_run_semantic_release:
40+
npx semantic-release --dry-run

0 commit comments

Comments
 (0)