Skip to content

Commit 81a0b9c

Browse files
tstellartstellar
committed
workflows: Factor out artifact attestation and upload into a composite action
Also, switch the release-sources workflow over to use this new action. As a result of this change, the attestation file for the sources will be renamed from attestation.jsonl to $TAG-sources.jsonl.
1 parent 23907a2 commit 81a0b9c

File tree

2 files changed

+102
-22
lines changed

2 files changed

+102
-22
lines changed

‎.github/workflows/release-sources.yml‎

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -79,30 +79,18 @@ jobs:
7979
run: |
8080
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
8181
82-
- name: Check Permissions
83-
if: github.event_name != 'pull_request'
84-
env:
85-
GITHUB_TOKEN: ${{ github.token }}
86-
USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
87-
run: |
88-
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user ${{ github.actor }} --user-token "$USER_TOKEN" check-permissions
8982
- name: Create Tarballs
9083
run: |
9184
./llvm/utils/release/export.sh ${{ needs.inputs.outputs.export-args }}
92-
- name: Attest Build Provenance
93-
if: github.event_name != 'pull_request'
94-
id: provenance
95-
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
96-
with:
97-
subject-path: "*.xz"
98-
- if: github.event_name != 'pull_request'
99-
run: |
100-
mv ${{ steps.provenance.outputs.bundle-path }} .
101-
- name: Create Tarball Artifacts
102-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
103-
with:
104-
path: |
105-
*.xz
106-
attestation.jsonl
10785
86+
- name: Store Tarball Names
87+
id: filenames
88+
run: |
89+
echo "filenames=*.xz" >> $GITHUB_OUTPUT
10890
91+
- name: Upload Artifacts
92+
uses: ./.github/workflows/upload-release-artifact
93+
with:
94+
files: ${{ steps.filenames.outputs.filenames }}
95+
attestation-name: ${{ needs.inputs.outputs.ref }}-sources
96+
upload: false

‎.github/workflows/upload-release-artifact/action.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Upload Release Artifact
2+
description: >-
3+
Upload release artifact along with an attestation. The action assumes that
4+
the llvm-project repository has already been checked out.
5+
inputs:
6+
files:
7+
description: >-
8+
Files to be uploaded. This can contain bash wildcards.
9+
required: true
10+
release-version:
11+
description: >-
12+
The release where the artifact will be attached.
13+
required: true
14+
upload:
15+
description: >-
16+
Whether or not to upload the file and attestation to the release. If this
17+
is set to false, then the atteastion will still be generated and attached as
18+
an artifact to the workflow, but won't be uploaded to the release.
19+
default: true
20+
user-token:
21+
description: >-
22+
Token with premissions to read llvm teams that is used to ensure that
23+
the person who triggred the action has permission to upload artifacts.
24+
This is required if upload is true.
25+
requred: false
26+
attestation-name:
27+
description: >-
28+
This will be used for the artifact name that is attached to the workflow and
29+
will be used as the basename for the attestation file which will be called
30+
$attestation-name.jsonl. If this is not set, it will default
31+
to the falue of `files`.
32+
required: false
33+
34+
35+
runs:
36+
using: "composite"
37+
steps:
38+
- name: Collect Variables
39+
id: vars
40+
shell: bash
41+
env:
42+
INPUTS_ATTESTATION_NAME: ${{ inputs.attestation-name }}
43+
INPUTS_FILES: ${{ inputs.files }}
44+
run: |
45+
if [ -z "$INPUTS_ATTESTATION_NAME" ]; then
46+
name="$INPUTS_FILES"
47+
else
48+
name="$INPUTS_ATTESTATION_NAME"
49+
fi
50+
echo "attestation-name=$name" >> $GITHUB_OUTPUT
51+
- name: Attest Build Provenance
52+
id: provenance
53+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
54+
with:
55+
subject-path: ${{ inputs.files }}
56+
57+
- name: Rename attestation file
58+
shell: bash
59+
run: |
60+
mv ${{ steps.provenance.outputs.bundle-path }} ${{ steps.vars.outputs.attestation-name }}.jsonl
61+
62+
- name: Upload Build Provenance
63+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
64+
with:
65+
name: ${{ steps.vars.outputs.attestation-name }}
66+
path: |
67+
${{ inputs.files }}
68+
${{ steps.vars.outputs.attestation-name }}.jsonl
69+
70+
- name: Install Python Requirements
71+
if: inputs.upload == 'true'
72+
shell: bash
73+
run: |
74+
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
75+
76+
- name: Check Permissions
77+
if: inputs.upload == 'true'
78+
env:
79+
GITHUB_TOKEN: ${{ github.token }}
80+
USER_TOKEN: ${{ inputs.user-token }}
81+
shell: bash
82+
run: |
83+
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user "$GITHUB_ACTOR" --user-token "$USER_TOKEN" check-permissions
84+
- name: Upload Release
85+
shell: bash
86+
if: inputs.upload == 'true'
87+
run: |
88+
./llvm/utils/release/github-upload-release.py \
89+
--token ${{ github.token }} \
90+
--release ${{ inputs.release-version }} \
91+
upload \
92+
--files ${{ inputs.files }} ${{ steps.vars.outputs.attestation-name}}.jsonl

0 commit comments

Comments
 (0)