[stable2506] Fix Publish Release Draft flow (#10550)

EgorPopelyaev · web-flow · commit cc59097adb4c · 2025-12-05T07:27:43.000+01:00
diff --git a/.github/workflows/release-30_publish_release_draft.yml b/.github/workflows/release-30_publish_release_draft.yml
@@ -70,7 +70,7 @@ jobs:
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Validate inputs
         id: validate_inputs
@@ -80,22 +80,11 @@ jobs:
           RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
-  build-runtimes:
-    needs: [ validate-inputs ]
-    uses: "./.github/workflows/release-srtool.yml"
-    with:
-       excluded_runtimes: "asset-hub-rococo bridge-hub-rococo coretime-rococo people-rococo rococo rococo-parachain substrate-test bp cumulus-test kitchensink minimal-template parachain-template penpal polkadot-test seedling shell frame-try sp solochain-template polkadot-sdk-docs-first pallet-staking-async-parachain pallet-staking-async-rc frame-storage-access-test yet-another-parachain"
-       build_opts: "--features on-chain-release-build"
-       profile: production
-    permissions:
-      id-token: write
-      attestations: write
-      contents: read
 
   publish-release-draft:
     runs-on: ubuntu-latest
     environment: release
-    needs: [ validate-inputs, build-runtimes ]
+    needs: [ validate-inputs ]
     outputs:
       release_url: ${{ steps.create-release.outputs.html_url }}
       asset_upload_url: ${{ steps.create-release.outputs.upload_url }}
@@ -132,13 +121,13 @@ jobs:
         id: draft
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ASSET_HUB_WESTEND_DIGEST: ${{ github.workspace}}/asset-hub-westend-runtime/asset-hub-westend-srtool-digest.json
-          BRIDGE_HUB_WESTEND_DIGEST: ${{ github.workspace}}/bridge-hub-westend-runtime/bridge-hub-westend-srtool-digest.json
-          COLLECTIVES_WESTEND_DIGEST: ${{ github.workspace}}/collectives-westend-runtime/collectives-westend-srtool-digest.json
-          CORETIME_WESTEND_DIGEST: ${{ github.workspace}}/coretime-westend-runtime/coretime-westend-srtool-digest.json
-          GLUTTON_WESTEND_DIGEST: ${{ github.workspace}}/glutton-westend-runtime/glutton-westend-srtool-digest.json
-          PEOPLE_WESTEND_DIGEST: ${{ github.workspace}}/people-westend-runtime/people-westend-srtool-digest.json
-          WESTEND_DIGEST: ${{ github.workspace}}/westend-runtime/westend-srtool-digest.json
+          ASSET_HUB_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/asset-hub-westend-runtime/asset-hub-westend-srtool-digest.json
+          BRIDGE_HUB_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/bridge-hub-westend-runtime/bridge-hub-westend-srtool-digest.json
+          COLLECTIVES_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/collectives-westend-runtime/collectives-westend-srtool-digest.json
+          CORETIME_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/coretime-westend-runtime/coretime-westend-srtool-digest.json
+          GLUTTON_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/glutton-westend-runtime/glutton-westend-srtool-digest.json
+          PEOPLE_WESTEND_DIGEST: ${{ github.workspace}}/runtimes/people-westend-runtime/people-westend-srtool-digest.json
+          WESTEND_DIGEST: ${{ github.workspace}}/runtimes/westend-runtime/westend-srtool-digest.json
           RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
           NO_RUNTIMES: ${{ inputs.no_runtimes }}
           CRATES_ONLY: ${{ inputs.crates_only }}
@@ -168,22 +157,13 @@ jobs:
           ./scripts/release/build-changelogs.sh
 
       - name: Archive artifact context.json
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: release-notes-context
           path: |
             scripts/release/context.json
             **/*-srtool-digest.json
 
-      - name: Generate content write token for the release automation
-        id: generate_write_token
-        uses: actions/create-github-app-token@v2
-        with:
-            app-id: ${{ vars.POLKADOT_SDK_RELEASE_RW_APP_ID }}
-            private-key: ${{ secrets.POLKADOT_SDK_RELEASE_RW_APP_KEY }}
-            owner: paritytech
-            repositories: polkadot-sdk
-
       - name: Create draft release
         id: create-release
         env:
@@ -202,32 +182,42 @@ jobs:
     continue-on-error: true
     runs-on: ubuntu-latest
     strategy:
-      matrix: ${{ fromJSON(needs.build-runtimes.outputs.published_runtimes) }}
+      matrix: ${{ fromJSON(inputs.runtimes) }}
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Download artifacts
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-
-      - name: Get runtime info
-        env:
-          JSON: release-notes-context/${{ matrix.chain }}-runtime/${{ matrix.chain }}-srtool-digest.json
-        run: |
-          >>$GITHUB_ENV echo ASSET=$(find ${{ matrix.chain }}-runtime -name '*.compact.compressed.wasm')
-          >>$GITHUB_ENV echo SPEC=$(<${JSON} jq -r .runtimes.compact.subwasm.core_version.specVersion)
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
 
       - name: Generate content write token for the release automation
         id: generate_write_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
             app-id: ${{ vars.POLKADOT_SDK_RELEASE_RW_APP_ID }}
             private-key: ${{ secrets.POLKADOT_SDK_RELEASE_RW_APP_KEY }}
             owner: paritytech
             repositories: polkadot-sdk
 
+      - name: Download runtimes
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+        run: |
+          mkdir -p ${{ github.workspace}}/runtimes/
+          gh run download ${{ inputs.build_run_id }} --dir ${{ github.workspace}}/runtimes
+          ls -la ${{ github.workspace}}/runtimes
+
+      - name: Get runtime info
+        env:
+          JSON: ${{ github.workspace}}/release-notes-context/runtimes/${{ matrix.chain }}-runtime/${{ matrix.chain }}-srtool-digest.json
+        run: |
+          cd ${{ github.workspace}}/runtimes
+          >>$GITHUB_ENV echo ASSET=$(find ${{ matrix.chain }}-runtime -name '*.compact.compressed.wasm')
+          >>$GITHUB_ENV echo SPEC=$(<${JSON} jq -r .runtimes.compact.subwasm.core_version.specVersion)
+
       - name: Upload compressed ${{ matrix.chain }} v${{ env.SPEC }} wasm
+        working-directory: ${{ github.workspace}}/runtimes
         env:
           GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
         run: |
@@ -250,7 +240,7 @@ jobs:
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Fetch binaries from s3 based on version
         run: |
@@ -273,7 +263,7 @@ jobs:
 
       - name: Generate content write token for the release automation
         id: generate_write_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
             app-id: ${{ vars.POLKADOT_SDK_RELEASE_RW_APP_ID }}
             private-key: ${{ secrets.POLKADOT_SDK_RELEASE_RW_APP_KEY }}
