Skip to content

Commit 0e39ef9

Browse files
liquibase-terraform[bot]liquibase-terraform[bot]
authored
Add .github/workflows/dry-run-release.yml
1 parent 1d452b6 commit 0e39ef9

File tree

1 file changed

+173
-0
lines changed

1 file changed

+173
-0
lines changed

‎.github/workflows/dry-run-release.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
name: Dry run release
2+
3+
on:
4+
workflow_dispatch: # Trigger on demand
5+
schedule: # Trigger weekly all Wednesdays at midnight UTC
6+
# Trigger weekly on Wednesday at midnight Austin time (Standard Time)
7+
- cron: "0 6 * * 3"
8+
9+
permissions:
10+
contents: write
11+
actions: read
12+
packages: write
13+
pull-requests: write
14+
15+
jobs:
16+
dry-run-attach-artifact-to-release:
17+
uses: liquibase/build-logic/.github/workflows/extension-attach-artifact-release.yml@main
18+
secrets: inherit
19+
with:
20+
dry_run: true
21+
dry_run_version: "0.0.${{ github.run_number }}"
22+
23+
dry-run-get-draft-release:
24+
needs: dry-run-attach-artifact-to-release
25+
runs-on: ubuntu-latest
26+
outputs:
27+
dry_run_release_id: ${{ steps.get_draft_release_id.outputs.release_id }}
28+
steps:
29+
30+
- name: Configure AWS credentials for vault access
31+
uses: aws-actions/configure-aws-credentials@v4
32+
with:
33+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
34+
aws-region: us-east-1
35+
36+
- name: Get secrets from vault
37+
id: vault-secrets
38+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
39+
with:
40+
secret-ids: |
41+
,/vault/liquibase
42+
parse-json-secrets: true
43+
44+
- name: Get GitHub App token
45+
id: get-token
46+
uses: actions/create-github-app-token@v2
47+
with:
48+
app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }}
49+
private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }}
50+
owner: ${{ github.repository_owner }}
51+
52+
- name: Get Draft Release ID
53+
id: get_draft_release_id
54+
run: |
55+
release_name="v0.0.${{ github.run_number }}"
56+
response=$(curl -s -H "Authorization: token ${{ steps.get-token.outputs.token }}" \
57+
-H "Accept: application/vnd.github.v3+json" \
58+
"https://api.github.com/repos/${{ github.repository }}/releases")
59+
draft_release=$(echo "$response" | jq -r --arg name "$release_name" '.[] | select(.name == $name and .draft == true)')
60+
if [ -z "$draft_release" ]; then
61+
echo "No draft release found with the name '$release_name'"
62+
exit 1
63+
else
64+
echo "$draft_release" | jq .
65+
release_id=$(echo "$draft_release" | jq -r '.id')
66+
echo "release_id=$release_id" >> $GITHUB_OUTPUT
67+
fi
68+
69+
dry-run-release-published:
70+
needs: dry-run-get-draft-release
71+
uses: liquibase/build-logic/.github/workflows/extension-release-published.yml@main
72+
secrets: inherit
73+
permissions:
74+
id-token: write
75+
contents: write
76+
packages: write
77+
pull-requests: write
78+
with:
79+
dry_run: true
80+
dry_run_version: "0.0.${{ github.run_number }}"
81+
dry_run_release_id: ${{ needs.dry-run-get-draft-release.outputs.dry_run_release_id }}
82+
deployToMavenCentral: false
83+
84+
cleanup:
85+
runs-on: ubuntu-latest
86+
if: always()
87+
needs: [dry-run-get-draft-release, dry-run-release-published]
88+
permissions:
89+
contents: write
90+
env:
91+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
92+
steps:
93+
- name: Checkout liquibase
94+
uses: actions/checkout@v4
95+
96+
- name: Configure AWS credentials for vault access
97+
uses: aws-actions/configure-aws-credentials@v4
98+
with:
99+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
100+
aws-region: us-east-1
101+
102+
- name: Get secrets from vault
103+
id: vault-secrets
104+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
105+
with:
106+
secret-ids: |
107+
,/vault/liquibase
108+
parse-json-secrets: true
109+
110+
- name: Get GitHub App token
111+
id: get-token
112+
uses: actions/create-github-app-token@v2
113+
with:
114+
app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }}
115+
private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }}
116+
owner: ${{ github.repository_owner }}
117+
permission-contents: read
118+
119+
- name: Set up Git
120+
run: |
121+
git config user.name "liquibot"
122+
git config user.email "[email protected]"
123+
124+
- name: Delete liquibase dry-run tag
125+
if: always()
126+
run: |
127+
git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}
128+
git push origin --delete refs/tags/v0.0.${{ github.run_number }}
129+
echo "Remote tag v0.0.${{ github.run_number }} deleted"
130+
131+
- name: Delete the dry-run draft release
132+
if: always()
133+
run: |
134+
curl -X DELETE -H "Authorization: token ${{ steps.get-token.outputs.token }}" \
135+
-H "Accept: application/vnd.github.v3+json" \
136+
"https://api.github.com/repos/${{ github.repository }}/releases/${{ needs.dry-run-get-draft-release.outputs.dry_run_release_id }}"
137+
138+
notify:
139+
if: failure()
140+
runs-on: ubuntu-latest
141+
needs:
142+
[
143+
dry-run-attach-artifact-to-release,
144+
dry-run-get-draft-release,
145+
dry-run-release-published,
146+
cleanup,
147+
]
148+
steps:
149+
- name: Configure AWS credentials for vault access
150+
uses: aws-actions/configure-aws-credentials@v4
151+
with:
152+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
153+
aws-region: us-east-1
154+
155+
- name: Get secrets from vault
156+
id: vault-secrets
157+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
158+
with:
159+
secret-ids: |
160+
,/vault/liquibase
161+
parse-json-secrets: true
162+
163+
- name: Notify Slack on Build Failure
164+
uses: rtCamp/action-slack-notify@v2
165+
env:
166+
SLACK_COLOR: failure
167+
SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U040C8J8143> <@U04P39MS2SW> <@UHHJ6UAEQ> <@U042HRTL4DT>" # Jandro, Sailee, Jake, Filipe
168+
SLACK_TITLE: "❌ ${{ github.repository }} ❌ Build failed on branch ${{ github.ref }} for commit ${{ github.sha }} in repository ${{github.repository}}"
169+
SLACK_USERNAME: liquibot
170+
SLACK_WEBHOOK: ${{ env.DRY_RUN_RELEASE_SLACK_WEBHOOK }}
171+
SLACK_ICON_EMOJI: ":robot_face:"
172+
SLACK_FOOTER: "${{ github.repository }}"
173+
SLACK_LINK_NAMES: true

0 commit comments

Comments
 (0)