Skip to content

Commit 33f1365

Browse files
oarbusioarbusi
authored
chore: Supports backport releases for v1.x (#3732)
* support backport releases * add master-v1 to code health and example GHA
1 parent 05ae166 commit 33f1365

File tree

4 files changed

+246
-1
lines changed

4 files changed

+246
-1
lines changed

‎.github/workflows/code-health.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55
push:
66
branches:
77
- master
8+
- master-v1
89
paths-ignore: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-excluding-paths
910
- '*.md'
1011
- 'examples/**'

‎.github/workflows/examples.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55
push:
66
branches:
77
- master
8+
- master-v1
89
pull_request:
910
workflow_dispatch:
1011

‎.github/workflows/generate-changelog.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Generate Changelog
22
on:
33
pull_request:
44
types: [closed]
5-
branches: [master]
5+
branches: [master, master-v1]
66
paths:
77
- .changelog/**
88
workflow_dispatch:

‎.github/workflows/release-v1.yml‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
name: "New Release (v1 Backport)"
2+
run-name: "Release ${{ inputs.version_number }} from master-v1 (skip tests: ${{ inputs.skip_tests }}, use existing tag: ${{ inputs.use_existing_tag}})"
3+
4+
# Used for creating a new release from the master-v1 branch. This workflow will run qa acceptance tests, create a new tag, and generate the release with GoReleaser.
5+
# Note: After a v1.x release, CHANGELOG.md changes from master-v1 branch should be manually merged to master branch.
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
version_number:
10+
description: "Version number (e.g., v1.0.0, v1.0.0-pre, v1.0.0-pre1)"
11+
required: true
12+
skip_tests:
13+
description: "Set value to `true` to skip QA acceptance tests, default is `false`"
14+
default: "false"
15+
use_existing_tag:
16+
description: "Set value to `true` to use an existing tag for the release process, default is `false`"
17+
default: "false"
18+
19+
jobs:
20+
release-config:
21+
runs-on: ubuntu-latest
22+
permissions: {}
23+
outputs:
24+
creates_new_tag: ${{ steps.evaluate_inputs.outputs.creates_new_tag }}
25+
is_official_release: ${{ steps.evaluate_inputs.outputs.is_official_release }}
26+
runs_tests: ${{ steps.evaluate_inputs.outputs.runs_tests }}
27+
steps:
28+
- id: evaluate_inputs
29+
run: |
30+
{
31+
echo "creates_new_tag=$(if [ '${{ inputs.use_existing_tag }}' = 'true' ]; then echo 'false'; else echo 'true'; fi)"
32+
echo "is_official_release=$(if echo '${{ inputs.version_number }}' | grep -q 'pre'; then echo 'false'; else echo 'true'; fi)"
33+
echo "runs_tests=$(if [ '${{ inputs.skip_tests }}' = 'true' ]; then echo 'false'; else echo 'true'; fi)"
34+
} >> "$GITHUB_OUTPUT"
35+
36+
validate-inputs:
37+
runs-on: ubuntu-latest
38+
permissions: {}
39+
steps:
40+
- name: Validation of version format
41+
run: |
42+
echo "${{ inputs.version_number }}" | grep -P '^v1\.\d+\.\d+(-pre[A-Za-z0-9-]*)?$'
43+
- name: Checkout
44+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
45+
with:
46+
ref: ${{ inputs.use_existing_tag == 'true' && inputs.version_number || 'master-v1' }}
47+
- name: Check for Upgrade Guide
48+
run: "./scripts/check-upgrade-guide-exists.sh ${{inputs.version_number}}"
49+
50+
update-examples-reference-in-docs:
51+
needs: [release-config, validate-inputs]
52+
if: >-
53+
!cancelled()
54+
&& !contains(needs.*.result, 'failure')
55+
&& needs.release-config.outputs.creates_new_tag == 'true'
56+
&& needs.release-config.outputs.is_official_release == 'true'
57+
runs-on: ubuntu-latest
58+
steps:
59+
- name: Checkout
60+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
61+
with:
62+
ref: master-v1
63+
- uses: ./.github/templates/run-script-and-commit
64+
with:
65+
script_call: "./scripts/update-examples-reference-in-docs.sh ${{inputs.version_number}}"
66+
file_to_commit: "docs/* templates/*" # only docs files are updated
67+
commit_message: "chore: Update example links in registry docs for ${{ github.event.inputs.version_number }} release"
68+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
69+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
70+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
71+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}
72+
73+
update-changelog-header:
74+
needs:
75+
[release-config, validate-inputs, update-examples-reference-in-docs]
76+
if: >-
77+
!cancelled()
78+
&& !contains(needs.*.result, 'failure')
79+
&& needs.release-config.outputs.creates_new_tag == 'true'
80+
&& needs.release-config.outputs.is_official_release == 'true'
81+
runs-on: ubuntu-latest
82+
steps:
83+
- name: Checkout
84+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
85+
with:
86+
ref: master-v1
87+
- uses: ./.github/templates/run-script-and-commit
88+
with:
89+
script_call: "./scripts/update-changelog-header-for-release.sh ${{inputs.version_number}}"
90+
file_to_commit: "CHANGELOG.md"
91+
commit_message: "chore: Updates CHANGELOG.md header for ${{ github.event.inputs.version_number }} release"
92+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
93+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
94+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
95+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}
96+
97+
create-tag:
98+
runs-on: ubuntu-latest
99+
permissions:
100+
contents: write
101+
needs:
102+
[
103+
release-config,
104+
validate-inputs,
105+
update-examples-reference-in-docs,
106+
update-changelog-header,
107+
]
108+
if: >-
109+
!cancelled()
110+
&& !contains(needs.*.result, 'failure')
111+
&& needs.release-config.outputs.creates_new_tag == 'true'
112+
steps:
113+
- name: Checkout
114+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
115+
with:
116+
ref: "master-v1"
117+
- name: Get the latest commit SHA
118+
id: get-sha
119+
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
120+
- name: Create release tag
121+
uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72
122+
with:
123+
tag: ${{ inputs.version_number }}
124+
commit_sha: ${{ steps.get-sha.outputs.sha }}
125+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
126+
gpg_passphrase: ${{ secrets.PASSPHRASE }}
127+
128+
run-qa-acceptance-tests:
129+
needs:
130+
[
131+
release-config,
132+
validate-inputs,
133+
update-examples-reference-in-docs,
134+
update-changelog-header,
135+
create-tag,
136+
]
137+
if: >-
138+
!cancelled()
139+
&& !contains(needs.*.result, 'failure')
140+
&& needs.release-config.outputs.runs_tests == 'true'
141+
secrets: inherit
142+
uses: ./.github/workflows/acceptance-tests.yml
143+
with:
144+
atlas_cloud_env: "qa"
145+
ref: ${{ inputs.version_number }}
146+
147+
release:
148+
runs-on: ubuntu-latest
149+
permissions:
150+
contents: write
151+
needs:
152+
[
153+
validate-inputs,
154+
update-examples-reference-in-docs,
155+
update-changelog-header,
156+
create-tag,
157+
run-qa-acceptance-tests,
158+
]
159+
# Release is skipped if there are failures in previous steps
160+
if: >-
161+
!cancelled()
162+
&& !contains(needs.*.result, 'failure')
163+
steps:
164+
- name: Checkout
165+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
166+
with:
167+
ref: ${{ inputs.version_number }}
168+
- name: Set up Go
169+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
170+
with:
171+
go-version-file: "go.mod"
172+
- name: Import GPG key
173+
id: import_gpg
174+
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
175+
with:
176+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
177+
passphrase: ${{ secrets.PASSPHRASE }}
178+
- name: Run GoReleaser
179+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
180+
with:
181+
version: "~> v2"
182+
args: release --clean
183+
env:
184+
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
185+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
186+
187+
compliance:
188+
runs-on: ubuntu-latest
189+
needs: [release-config, release]
190+
if: >-
191+
!cancelled()
192+
&& needs.release.result == 'success'
193+
&& needs.release-config.outputs.is_official_release == 'true'
194+
env:
195+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
196+
steps:
197+
- name: Checkout
198+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
199+
with:
200+
ref: ${{ inputs.version_number }}
201+
- name: Generate SBOM
202+
run: make gen-purls generate-sbom
203+
- name: Upload SBOM to Kondukto
204+
run: make upload-sbom
205+
env:
206+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
207+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
208+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
209+
- name: Upload SBOM as release artifact
210+
uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836
211+
with:
212+
files: compliance/sbom.json
213+
tag_name: ${{ inputs.version_number }}
214+
env:
215+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
216+
217+
generate-ssdlc-report:
218+
needs: [release-config, release, compliance]
219+
if: >-
220+
!cancelled()
221+
&& needs.release.result == 'success'
222+
&& needs.release-config.outputs.is_official_release == 'true'
223+
&& needs.compliance.result == 'success'
224+
runs-on: ubuntu-latest
225+
steps:
226+
- name: Checkout
227+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
228+
with:
229+
ref: master-v1
230+
- uses: ./.github/templates/run-script-and-commit
231+
with:
232+
script_call: |
233+
TAG="${{ inputs.version_number }}"
234+
VERSION="${TAG#v}"
235+
AUTHOR="${{ github.actor }}"
236+
export AUTHOR VERSION
237+
./scripts/compliance/gen-ssdlc-report.sh
238+
file_to_commit: "compliance/v*/ssdlc-compliance-*.md"
239+
commit_message: "chore: Update SSDLC report for ${{ inputs.version_number }}"
240+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
241+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
242+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
243+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}

0 commit comments

Comments
 (0)