Skip to content

Commit 8bb768a

Browse files
pcjpcj
authored
Merge pull request #2 from stackb/feat/bcr-publish
Add BCR publish workflow
2 parents 698b487 + adb10c8 commit 8bb768a

10 files changed

Lines changed: 191 additions & 2 deletions

File tree

‎.bcr/metadata.template.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"homepage": "https://github.com/stackb/jvm_image",
3+
"maintainers": [
4+
{
5+
"name": "Paul Johnston",
6+
"email": "pcj@stack.build",
7+
"github": "pcj",
8+
"github_user_id": 50580
9+
}
10+
],
11+
"repository": [
12+
"github:stackb/jvm_image"
13+
],
14+
"versions": [],
15+
"yanked_versions": {}
16+
}

‎.bcr/presubmit.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
bcr_test_module:
2+
module_path: "example/hello"
3+
matrix:
4+
platform: ["macos", "ubuntu2204"]
5+
bazel: ["8.*"]
6+
tasks:
7+
build_example:
8+
name: "Build example image"
9+
platform: ${{ platform }}
10+
bazel: ${{ bazel }}
11+
build_targets:
12+
- "//:image"

‎.bcr/source.template.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"integrity": "",
3+
"strip_prefix": "{REPO}-{VERSION}",
4+
"url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
5+
}

‎.github/workflows/publish.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Publish to BCR
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
tag_name:
7+
required: true
8+
type: string
9+
secrets:
10+
BCR_PUBLISH_TOKEN:
11+
required: false
12+
publish_token:
13+
required: true
14+
workflow_dispatch:
15+
inputs:
16+
tag_name:
17+
description: Existing release tag to publish
18+
required: true
19+
type: string
20+
21+
jobs:
22+
publish:
23+
uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@c316f1611511a40423572303f66c80bb30bfe2f8 # v1.4.1
24+
with:
25+
tag_name: ${{ inputs.tag_name }}
26+
registry_fork: stackb/bazel-central-registry
27+
draft: true
28+
permissions:
29+
attestations: write
30+
contents: write
31+
id-token: write
32+
secrets:
33+
publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
workflow_dispatch:
8+
inputs:
9+
tag_name:
10+
description: Existing tag to release
11+
required: true
12+
type: string
13+
14+
permissions:
15+
attestations: write
16+
contents: write
17+
id-token: write
18+
19+
jobs:
20+
release:
21+
uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@1d798ff015ed0696433e01e2c3ccbb2abefadad7 # v7.7.0
22+
with:
23+
release_files: jvm_image-*.tar.gz
24+
prerelease: false
25+
draft: true
26+
tag_name: ${{ inputs.tag_name || github.ref_name }}
27+
28+
publish:
29+
needs: release
30+
uses: ./.github/workflows/publish.yml
31+
with:
32+
tag_name: ${{ inputs.tag_name || github.ref_name }}
33+
secrets:
34+
publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
35+
36+
finalize:
37+
needs: publish
38+
runs-on: ubuntu-latest
39+
steps:
40+
- name: Publish GitHub release
41+
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
42+
with:
43+
tag_name: ${{ inputs.tag_name || github.ref_name }}

‎.github/workflows/release_prep.sh‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/usr/bin/env bash
2+
3+
set -o errexit -o nounset -o pipefail
4+
5+
readonly TAG="${1:?release tag is required}"
6+
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
7+
echo "release tag must be a semantic version prefixed with v: $TAG" >&2
8+
exit 1
9+
fi
10+
11+
if [[ ! -f LICENSE && ! -f LICENSE.txt && ! -f LICENSE.md ]]; then
12+
echo "a repository license is required before publishing a release" >&2
13+
exit 1
14+
fi
15+
16+
readonly VERSION="${TAG#v}"
17+
readonly PREFIX="jvm_image-${VERSION}"
18+
readonly ARCHIVE="jvm_image-${TAG}.tar.gz"
19+
20+
git archive --format=tar --prefix="${PREFIX}/" "$TAG" | gzip -n >"$ARCHIVE"
21+
SHA256="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
22+
readonly SHA256
23+
24+
cat <<EOF
25+
## Bzlmod
26+
27+
Add the module dependency to your \`MODULE.bazel\`:
28+
29+
\`\`\`starlark
30+
bazel_dep(name = "jvm_image", version = "${VERSION}")
31+
\`\`\`
32+
33+
Release archive SHA-256: \`${SHA256}\`
34+
EOF

‎MODULE.bazel‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
module(
44
name = "jvm_image",
5-
version = "0.1.0",
65
)
76

87
bazel_dep(name = "bazel_skylib", version = "1.9.0")

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,10 @@ bazel build //:image
104104

105105
The example in [`example/hello`](example/hello) demonstrates `jvm_jar_layers`
106106
with `rules_img`.
107+
108+
## Releasing
109+
110+
Before onboarding a client, pin a green commit, choose and add a repository
111+
license, and publish a matching `v0.1.x` tag. A license is intentionally not
112+
inferred by this repository. See [`RELEASING.md`](RELEASING.md) for the GitHub
113+
release and Bazel Central Registry process.

‎RELEASING.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Releasing
2+
3+
Releases are created from semantic-version tags such as `v0.1.0`. The release
4+
workflow creates an attested source archive, opens a Bazel Central Registry
5+
(BCR) pull request, and publishes the draft GitHub release after the BCR publish
6+
job succeeds.
7+
8+
## One-time setup
9+
10+
1. Choose and add the repository license before the first public release.
11+
2. Keep the `stackb/bazel-central-registry` fork synchronized with
12+
`bazelbuild/bazel-central-registry`.
13+
3. Add an Actions secret named `BCR_PUBLISH_TOKEN`. Use a classic personal
14+
access token belonging to the account that can push to the fork and open a
15+
pull request against the upstream BCR. It needs `repo` and `workflow` scopes.
16+
4. Review `.bcr/metadata.template.json`, especially the maintainer email, before
17+
the first publication.
18+
19+
## Cut a release
20+
21+
1. Ensure CI is green and the checkout is clean.
22+
2. Confirm the release notes and public API are ready.
23+
3. Create and push the tag:
24+
25+
```sh
26+
git tag -a v0.1.0 -m "v0.1.0"
27+
git push origin v0.1.0
28+
```
29+
30+
The tag starts `.github/workflows/release.yml`. If BCR publication needs to be
31+
retried without recreating the GitHub release, run the **Publish to BCR**
32+
workflow manually and supply the existing tag.
33+
34+
The BCR pull request is intentionally opened as a draft. The token owner must
35+
mark it ready for review, which serves as the maintainer approval recognized by
36+
the BCR.
37+
38+
The release preparation step rejects malformed tags and refuses to publish
39+
until a `LICENSE`, `LICENSE.txt`, or `LICENSE.md` file exists.

‎example/hello/MODULE.bazel‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ module(
1010
bazel_dep(name = "rules_img", version = "0.3.4")
1111
bazel_dep(name = "rules_java", version = "9.6.1")
1212
bazel_dep(name = "rules_jvm_external", version = "6.7")
13-
bazel_dep(name = "jvm_image", version = "0.1.0")
13+
14+
bazel_dep(name = "jvm_image", version = "0.0.0", dev_dependency = True)
1415
local_path_override(
1516
module_name = "jvm_image",
1617
path = "../..",

0 commit comments

Comments
 (0)