fix(ci): Update release workflow to use pre-generated artifacts. (#61)

Author: calavera

.github/workflows/release.yml

@@ -13,7 +13,7 @@ env:
   CI: "true"
 
 jobs:
-  release:
+  release_github:
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -59,6 +59,14 @@ jobs:
         run: npx projen install:ci
       - name: release
         run: npx projen release
+      - name: Backup artifact permissions
+        run: cd dist && getfacl -R . > permissions-backup.acl
+        continue-on-error: true
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
       - name: Release GitHub
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -67,20 +75,30 @@ jobs:
         run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_REF 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
   release_npm:
     name: Publish to npm
-    needs: release
+    needs: release_github
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
+      - name: Download build artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Prepare Repository
+        run: mv dist .repo
       - name: Install Dependencies
-        run: cd npx projen install:ci
+        run: cd .repo && npx projen install:ci
       - name: Create JS artifact
-        run: npx projen package:js
+        run: cd .repo && npx projen package:js
+      - name: Collect js Artifact
+        run: mv .repo/dist dist
       - name: Release JS Artifact
         env:
           NPM_DIST_TAG: latest
@@ -89,24 +107,34 @@ jobs:
         run: npx -p publib@latest publib-npm
   release_maven:
     name: Publish to Maven Central
-    needs: release
+    needs: release_github
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: '17.x'
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
+      - name: Download build artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Prepare Repository
+        run: mv dist .repo
       - name: Install Dependencies
-        run: npx projen install:ci
+        run: cd .repo && npx projen install:ci
       - name: Create java artifact
-        run: npx projen package:java
+        run: cd .repo && npx projen package:java
+      - name: Collect java Artifact
+        run: mv .repo/dist dist
       - name: Release
         env:
           MAVEN_SERVER_ID: 'github'
@@ -117,70 +145,100 @@ jobs:
         run: npx -p publib@latest publib-maven
   release_pypi:
     name: Publish to PyPI
-    needs: release
+    needs: release_github
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - uses: actions/setup-python@v5
         with:
           python-version: 3.12.3
+      - name: Download build artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Prepare Repository
+        run: mv dist .repo
       - name: Install Dependencies
-        run: npx projen install:ci
+        run: cd .repo && npx projen install:ci
       - name: Create python artifact
-        run: npx projen package:python
+        run: cd .repo && npx projen package:python
+      - name: Collect python Artifact
+        run: mv .repo/dist dist
       - name: Release
         env:
           TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
           TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
         run: npx -p publib@latest publib-pypi
   release_nuget:
     name: Publish to NuGet Gallery
-    needs: release
+    needs: release_github
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 3.x
+      - name: Download build artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Prepare Repository
+        run: mv dist .repo
       - name: Install Dependencies
-        run: npx projen install:ci
+        run: cd .repo && npx projen install:ci
       - name: Create dotnet artifact
-        run: npx projen package:dotnet
+        run: cd .repo && npx projen package:dotnet
+      - name: Collect dotnet Artifact
+        run: mv .repo/dist dist
       - name: Release
         env:
           NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
         run: npx -p publib@latest publib-nuget
   release_golang:
     name: Publish to GitHub Go Module Repository
-    needs: release
+    needs: release_github
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - uses: actions/setup-go@v4
         with:
           go-version: ^1.16.0
+      - name: Download build artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Prepare Repository
+        run: mv dist .repo
       - name: Install Dependencies
-        run: npx projen install:ci
+        run: cd .repo && npx projen install:ci
       - name: Create go artifact
-        run: npx projen package:go
+        run: cd .repo && npx projen package:go
+      - name: Collect go Artifact
+        run: mv .repo/dist dist
       - name: Release
         env:
           GIT_USER_NAME: github-actions