Skip to content

Commit d7def9d

Browse files
author
Mark R. Tuttle
committed
Add publication to release workflow
1 parent 842a7b6 commit d7def9d

File tree

5 files changed

+173
-19
lines changed

5 files changed

+173
-19
lines changed

‎.github/cloudformation/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
These are
2+
[AWS CloudFormation templates](https://aws.amazon.com/cloudformation/resources/templates/)
3+
for maintaining the Azure DevOps and Microsoft Marketplace credentials
4+
used to publish the CBMC Proof Debugger.

‎.github/cloudformation/azure.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
Description: >
2+
Login credentials for the Azure DevOps account used to manage the
3+
model-checking publisher in the Microsoft Marketplace.
4+
5+
Resources:
6+
7+
AzureDevOpsUsername:
8+
Type: AWS::SecretsManager::Secret
9+
Properties:
10+
Name: AzureDevOpsUsername
11+
Description: >
12+
Username for the Azure DevOps account used to manage the
13+
model-checking publisher in the Microsoft Marketplace.
14+
15+
AzureDevOpsPassword:
16+
Type: AWS::SecretsManager::Secret
17+
Properties:
18+
Name: AzureDevOpsPassword
19+
Description: >
20+
Password for the Azure DevOps account used to manage the
21+
model-checking publisher in the Microsoft Marketplace.
22+
23+
Outputs:
24+
25+
AzureDevOpsUsername:
26+
Value: !Ref AzureDevOpsUsername
27+
Export:
28+
Name: AzureDevOpsUsername
29+
30+
AzureDevOpsPassword:
31+
Value: !Ref AzureDevOpsPassword
32+
Export:
33+
Name: AzureDevOpsPassword

‎.github/cloudformation/oidc.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
Description:
2+
Register the GitHub identity provider with the AWS security token service.
3+
4+
Resources:
5+
GithubIdentityProvider:
6+
Type: AWS::IAM::OIDCProvider
7+
Properties:
8+
Url:
9+
# The GitHub identity provider supporting OIDC
10+
https://token.actions.githubusercontent.com
11+
ThumbprintList:
12+
# The GitHub certification authority (the signature of its certificate)
13+
- 6938fd4d98bab03faadb97b34396831e3780aea1
14+
ClientIdList:
15+
# The AWS security token service
16+
- sts.amazonaws.com
17+
18+
19+
Outputs:
20+
GithubIdentityProvider:
21+
Value: !Ref GithubIdentityProvider
22+
Export:
23+
Name: GithubIdentityProvider

‎.github/cloudformation/token.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
Description: >
2+
The personal access token for the Azure DevOps account used to manage the
3+
model-checking publisher in the Microsoft Marketplace.
4+
Enable storage of the PAT in the AWS Secrets Manager and access to the PAT
5+
from the GitHub workflows in model-checking/cbmc-proof-debugger.
6+
7+
Parameters:
8+
GithubRepoOrganization:
9+
Type: String
10+
Description: GitHub organization for the cbmc-proof-debugger
11+
Default: model-checking
12+
GithubRepoName:
13+
Type: String
14+
Description: GitHub repository for the cbmc-proof-debugger
15+
Default: cbmc-proof-debugger
16+
17+
Resources:
18+
19+
PublisherToken:
20+
Type: AWS::SecretsManager::Secret
21+
Properties:
22+
Name: AzureDevOpsPAT
23+
Description: >
24+
The personal access token for the Azure DevOps account used to
25+
manage the model-checking publisher in the Microsoft Marketplace.
26+
27+
PublisherTokenReader:
28+
Type: AWS::IAM::Role
29+
Properties:
30+
RoleName: PublisherTokenReader
31+
Description: >
32+
This role can retrieve the personal access token for the model
33+
checking publisher in the Microsoft Marketplace.
34+
35+
AssumeRolePolicyDocument:
36+
Version: "2012-10-17"
37+
Statement:
38+
- Effect: Allow
39+
Principal:
40+
Federated: !ImportValue GithubIdentityProvider
41+
Action: sts:AssumeRoleWithWebIdentity
42+
Condition:
43+
StringEquals:
44+
token.actions.githubusercontent.com:aud: sts.amazonaws.com
45+
StringLike:
46+
token.actions.githubusercontent.com:sub:
47+
!Sub repo:${GithubRepoOrganization}/${GithubRepoName}:*
48+
49+
Policies:
50+
- PolicyName: PublisherTokenAccess
51+
PolicyDocument:
52+
Version: "2012-10-17"
53+
Statement:
54+
- Effect: Allow
55+
Action: secretsmanager:GetSecretValue
56+
Resource: !Ref PublisherToken
57+
58+
Outputs:
59+
PublisherToken:
60+
Value: !Ref PublisherToken
61+
Export:
62+
Name: PublisherToken
63+
PublisherTokenReader:
64+
Value: !GetAtt PublisherTokenReader.Arn
65+
Export:
66+
Name: PublisherTokenReader

‎.github/workflows/release.yaml‎

Lines changed: 47 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,58 @@
11
name: Release CBMC proof debugger
22

3-
# A new release is triggered by a new tag of the form debugger-VERSION.
3+
# A new tag of the form debugger-VERSION will trigger a new release,
4+
# upload the package to the release page, and publish the package
5+
# to the Microsoft Marketplace for Visual Studio Code extensions
6+
# using the Model Checking publisher.
47

5-
# GitHub has deprecated actions/create-release
6-
# https://github.com/actions/create-release
8+
# Code checkout notes:
9+
# GitHub has deprecated actions/create-release
10+
# https://github.com/actions/create-release
711
#
8-
# GitHub recommends four actions including
9-
# softprops/action-gh-release is highly rated but includes deprecated code
10-
# https://github.com/softprops/action-gh-release
11-
# ncipollo/release-action@v1
12-
# https://github.com/ncipollo/release-action
12+
# GitHub recommends four actions including
13+
# softprops/action-gh-release is highly rated but includes deprecated code
14+
# https://github.com/softprops/action-gh-release
15+
# ncipollo/release-action@v1
16+
# https://github.com/ncipollo/release-action
17+
18+
# AWS credentials notes:
19+
# GitHub has decprecated Node12 in favor of Node16
20+
# We use the workaround recommended by the AWS credentials package, see
21+
# https://github.com/aws-actions/configure-aws-credentials/issues/489
22+
# #issuecomment-1278145876
1323

1424
on:
1525
push:
1626
tags:
1727
- debugger-*
1828

29+
env:
30+
AWS_ROLE: arn:aws:iam::${{secrets.AWS_ACCOUNT}}:role/PublisherTokenReader
31+
AWS_REGION: us-west-2
32+
PAT_ID: AzureDevOpsPAT
33+
1934
jobs:
2035
Release:
2136
name: Release proof debugger
2237
runs-on: ubuntu-latest
38+
permissions:
39+
id-token: write
40+
contents: write
2341
steps:
2442

2543
- name: Checkout repository
2644
uses: actions/checkout@v3
2745

28-
- name: Get version numbers
46+
- name: Validate release and tagged version numbers
47+
# $GITHUB_REF is refs/tags/debugger-VERSION
2948
run: |
30-
# The environment variable GITHUB_REF is refs/tags/debugger-*
31-
echo "PACKAGE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_ENV
32-
echo "TAG_VERSION=$(echo ${{ github.ref }} | cut -d "/" -f 3 | cut -d "-" -f 2)" >> $GITHUB_ENV
33-
- name: Compare version numbers
34-
run: |
35-
if [[ ${{ env.PACKAGE_VERSION }} != ${{ env.TAG_VERSION }} ]]; then
36-
echo "Package version ${{env.PACKAFGE_VERSION}} does not match tag version ${{env.TAG_VERSION}}"
49+
REL=$(jq -r '.version' package.json)
50+
TAG=$(echo $GITHUB_REF | cut -d "/" -f 3 | cut -d "-" -f 2)
51+
if [[ $REL != $TAG ]]; then
52+
echo Release version $REL does not match tagged version $TAG
3753
exit 1
3854
fi
55+
echo "VERSION=$REL" >> $GITHUB_ENV
3956
4057
- name: Create package
4158
run: make setup-ubuntu package
@@ -46,10 +63,21 @@ jobs:
4663
artifacts: "*.vsix"
4764
artifactContentType: application/zip
4865
body: |
49-
This release is CBMC Proof Debugger version ${{ env.TAG_VERSION }}. For the latest release, go to the [Marketplace](https://marketplace.visualstudio.com/vscode) for Visual Studio Code extensions.
66+
This release is CBMC Proof Debugger version ${{ env.VERSION }}. For the latest release, go to the [Marketplace](https://marketplace.visualstudio.com/vscode) for Visual Studio Code extensions.
5067
51-
To install this release, download the package `proof-debugger-${{ env.TAG_VERSION }}.vsix` below and install it with
68+
To install this release, download the package `proof-debugger-${{ env.VERSION }}.vsix` below and install it with
5269
5370
```
54-
code --install-extension proof-debugger-${{ env.TAG_VERSION }}.vsix
71+
code --install-extension proof-debugger-${{ env.VERSION }}.vsix
5572
```
73+
74+
- name: Authenticate GitHub workflow to AWS
75+
uses: aws-actions/configure-aws-credentials@v1-node16
76+
with:
77+
role-to-assume: ${{ env.AWS_ROLE }}
78+
aws-region: ${{ env.AWS_REGION }}
79+
80+
- name: Publish release
81+
run: |
82+
VSCE_PAT=$(aws secretsmanager get-secret-value --secret-id $PAT_ID | jq -r '.SecretString')
83+
make publish

0 commit comments

Comments
 (0)