Skip to content

Commit 28668ed

Browse files
mcasimirmcasimir
authored
chore(ci): move draft releases to github actions (#634)
* chore(ci): move draft releases to gh actions * use dropdown * fix local action name * test * test * set env * add shell where missing, cleanup, add additional validations * add shell * set segment key * nicer error * update contributing docs * fix name
1 parent 88ffb48 commit 28668ed

File tree

7 files changed

+267
-1985
lines changed

7 files changed

+267
-1985
lines changed

‎.github/workflows/actions/test-and-build/action.yaml

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
name: Run test and build
2+
description: Test and build action, reused among workflows
3+
inputs:
4+
SEGMENT_KEY:
5+
required: true
6+
ARTIFACTORY_HOST:
7+
required: true
8+
ARTIFACTORY_PASSWORD:
9+
required: true
10+
ARTIFACTORY_USERNAME:
11+
required: true
12+
GARASIGN_PASSWORD:
13+
required: true
14+
GARASIGN_USERNAME:
15+
required: true
16+
SNYK_TOKEN:
17+
required: true
18+
JIRA_API_TOKEN:
19+
required: true
20+
21+
runs:
22+
using: "composite"
23+
# Steps represent a sequence of tasks that will be executed as part of the job
24+
steps:
25+
- name: Install Deps Ubuntu
26+
if: ${{ runner.os == 'Linux' }}
27+
run: sudo apt-get update -y && sudo apt-get -y install libkrb5-dev libsecret-1-dev net-tools libstdc++6 gnome-keyring
28+
shell: bash
29+
30+
# Default Python (3.12) doesn't have support for distutils because of
31+
# which the dep install fails constantly on macos
32+
# https://github.com/nodejs/node-gyp/issues/2869
33+
- uses: actions/setup-python@v4
34+
with:
35+
python-version: '3.11'
36+
37+
- name: Run node-gyp bug workaround script
38+
run: |
39+
curl -sSfLO https://raw.githubusercontent.com/mongodb-js/compass/42e6142ae08be6fec944b80ff6289e6bcd11badf/.evergreen/node-gyp-bug-workaround.sh && bash node-gyp-bug-workaround.sh
40+
shell: bash
41+
42+
- name: Set SEGMENT_KEY
43+
env:
44+
SEGMENT_KEY: ${{ inputs.SEGMENT_KEY }}
45+
run: |
46+
echo "SEGMENT_KEY=${SEGMENT_KEY}" >> $GITHUB_ENV
47+
shell: bash
48+
49+
- name: Validate SEGMENT_KEY
50+
run: |
51+
if [ -z "${SEGMENT_KEY}" ]; then
52+
echo "SEGMENT_KEY is not set or is empty"
53+
exit 1
54+
fi
55+
shell: bash
56+
57+
- name: Install npm
58+
run: npm install -g [email protected]
59+
shell: bash
60+
61+
- name: Install Dependencies
62+
shell: bash
63+
run: |
64+
npm ci --omit=optional
65+
66+
- name: Run Checks
67+
run: npm run check
68+
# the glob here just fails
69+
if: ${{ runner.os != 'Windows' }}
70+
shell: bash
71+
72+
- name: Run Tests
73+
run: |
74+
npm run test
75+
shell: bash
76+
77+
- name: Build .vsix
78+
env:
79+
NODE_OPTIONS: "--require ./scripts/no-npm-list-fail.js"
80+
# NOTE: --githubBranch is "The GitHub branch used to infer relative links in README.md."
81+
run: |
82+
npx vsce package --githubBranch main
83+
shell: bash
84+
85+
- name: Check .vsix filesize
86+
run: npm run check-vsix-size
87+
shell: bash
88+
89+
- name: Sign .vsix
90+
if: runner.os == 'Linux'
91+
env:
92+
ARTIFACTORY_HOST: ${{ inputs.ARTIFACTORY_HOST }}
93+
ARTIFACTORY_PASSWORD: ${{ inputs.ARTIFACTORY_PASSWORD }}
94+
ARTIFACTORY_USERNAME: ${{ inputs.ARTIFACTORY_USERNAME }}
95+
GARASIGN_PASSWORD: ${{ inputs.GARASIGN_PASSWORD }}
96+
GARASIGN_USERNAME: ${{ inputs.GARASIGN_USERNAME }}
97+
run: |
98+
bash scripts/sign-vsix.sh
99+
ls *.vsix.sig
100+
shell: bash
101+
102+
- name: Upload artifacts
103+
uses: actions/upload-artifact@v2
104+
with:
105+
name: VSIX built on ${{ runner.os }}
106+
path: |
107+
*.vsix
108+
*.vsix.sig
109+
110+
- name: Run Snyk Test
111+
if: runner.os == 'Linux'
112+
shell: bash
113+
env:
114+
SNYK_TOKEN: ${{ inputs.SNYK_TOKEN }}
115+
run: |
116+
npm run snyk-test > /dev/null 2>&1
117+
118+
- name: Create Jira Tickets
119+
if: >
120+
runner.os == 'Linux' &&
121+
(
122+
github.event_name == 'push' && github.ref == 'refs/heads/main' ||
123+
github.event_name == 'workflow_dispatch' ||
124+
github.event_name == 'schedule'
125+
)
126+
shell: bash
127+
env:
128+
JIRA_API_TOKEN: ${{ inputs.JIRA_API_TOKEN }}
129+
JIRA_BASE_URL: "https://jira.mongodb.org"
130+
JIRA_PROJECT: "VSCODE"
131+
JIRA_VULNERABILITY_BUILD_INFO: "- [GitHub Run|https://github.com/mongodb-js/vscode/actions/runs/${{github.run_id}}/jobs/${{github.job}}]"
132+
run: |
133+
npm run create-vulnerability-tickets > /dev/null
134+
135+
- name: Generate Vulnerability Report (Fail on >= High)
136+
if: runner.os == 'Linux'
137+
continue-on-error: ${{ github.event_name == 'pull_request' }}
138+
shell: bash
139+
run: |
140+
# The standard output is suppressed since Github Actions logs are
141+
# available for everyone with read access to the repo, which is everyone that is
142+
# logged in for public repos.
143+
# This command is only here to fail on failures for `main` and tags.
144+
npm run generate-vulnerability-report > /dev/null

‎.github/workflows/draft-release.yaml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: Draft release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
versionBump:
7+
description: 'Version bump'
8+
type: choice
9+
required: true
10+
default: 'patch'
11+
options:
12+
- patch
13+
- minor
14+
- major
15+
- exact-version
16+
17+
exactVersion:
18+
description: 'Exact version: (Only effective selecting "exact-version" as version bump)'
19+
required: false
20+
21+
jobs:
22+
prepare-release:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v3
27+
with:
28+
# NOTE: this is necessary to get the full history
29+
# and check if tags are already present
30+
fetch-depth: 0
31+
32+
- name: Setup Node.js Environment
33+
uses: actions/setup-node@v3
34+
with:
35+
node-version: 16.x
36+
37+
- name: Determine Next Version
38+
shell: bash
39+
env:
40+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
run: |
42+
set -e
43+
44+
VERSION_BUMP=${{ github.event.inputs.versionBump }}
45+
46+
if [[ "$VERSION_BUMP" == "major" || "$VERSION_BUMP" == "minor" || "$VERSION_BUMP" == "patch" ]]; then
47+
PREV_VERSION_TAG=$(gh api repos/:owner/:repo/releases --jq '. | map(select(.draft == false)) | .[0] | .tag_name')
48+
PREV_VERSION=$(npx semver --coerce ${PREV_VERSION_TAG})
49+
50+
NEXT_VERSION=$(npx semver -i $VERSION_INPUT $PREV_VERSION)
51+
else
52+
NEXT_VERSION=${{ github.event.inputs.exactVersion }}
53+
fi
54+
55+
# Remove the 'v' prefix from NEXT_VERSION if it exists
56+
NEXT_VERSION="${NEXT_VERSION#v}"
57+
58+
# Validates the version before using it
59+
npx semver v"${NEXT_VERSION}"
60+
61+
npm version "${NEXT_VERSION}" --no-git-tag-version
62+
echo "RELEASE_TAG=v${NEXT_VERSION}" >> $GITHUB_ENV
63+
64+
- name: Validate release tag
65+
shell: bash
66+
run: |
67+
RELEASE_TAG=${{ inputs.RELEASE_TAG }}
68+
69+
if [ -z "${RELEASE_TAG}" ]; then
70+
echo "RELEASE_TAG is not set or is empty"
71+
exit 1
72+
fi
73+
74+
if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
75+
echo "Error: Tag $RELEASE_TAG already existing"
76+
echo "If you are trying to re-create a draft release with this version, please delete the release and the tag first."
77+
echo "If this version has already been release consider using a different one."
78+
exit 1
79+
fi
80+
81+
- name: Run tests and build
82+
uses: ./.github/workflows/actions/test-and-build
83+
with:
84+
SEGMENT_KEY: ${{ secrets.SEGMENT_KEY_PROD }}
85+
ARTIFACTORY_HOST: ${{ secrets.ARTIFACTORY_HOST }}
86+
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
87+
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
88+
GARASIGN_PASSWORD: ${{ secrets.GARASIGN_PASSWORD }}
89+
GARASIGN_USERNAME: ${{ secrets.GARASIGN_USERNAME }}
90+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
91+
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
92+
93+
- name: Create Draft Release
94+
run: |
95+
set -e
96+
echo Creating draft release for: "${RELEASE_TAG}"
97+
ls *.vsix
98+
ls *.vsix.sig
99+
100+
gh release create "${RELEASE_TAG}" \
101+
--title "${RELEASE_VERSION}" \
102+
--notes "Edit the release notes before publishing." \
103+
--target main \
104+
--draft \
105+
*.vsix \
106+
*.vsix.sig
107+
shell: bash
108+
env:
109+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110+

0 commit comments

Comments
 (0)