Tag a new release #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tag a new release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: | | |
| The release version in <Major>.<minor> format. | |
| 0.0 means new minor version on the latest major version. | |
| default: '0.0' | |
| type: string | |
| dry-run: | |
| description: Do not push anything | |
| default: true | |
| type: boolean | |
| jobs: | |
| determine-version: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| major: ${{ steps.final-values.outputs.major }} | |
| minor: ${{ steps.final-values.outputs.minor }} | |
| patch: ${{ steps.patch-version.outputs.value || '0' }} | |
| release-type: ${{ steps.final-values.outputs.type }} | |
| stackrox-major: ${{ steps.stackrox.outputs.major }} | |
| stackrox-minor: ${{ steps.stackrox.outputs.minor }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| fetch-depth: 0 | |
| - name: Parse required release | |
| id: required-release | |
| run: | | |
| if [[ "${{ inputs.version }}" =~ ^([[:digit:]]+)\.([[:digit:]]+)$ ]]; then | |
| echo "major=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT" | |
| echo "minor=${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo >&2 "Invalid version ${{ inputs.version }}. The expected format is <Major>.<minor>" | |
| exit 1 | |
| fi | |
| - name: Get closest tag to master | |
| id: latest-tag | |
| uses: ./.github/actions/get-latest-version | |
| with: | |
| required-major: ${{ steps.required-release.outputs.major }} | |
| - name: Determine release type and version | |
| id: final-values | |
| env: | |
| LATEST_MAJOR: ${{ steps.latest-tag.outputs.major }} | |
| LATEST_MINOR: ${{ steps.latest-tag.outputs.minor }} | |
| REQUIRED_MAJOR: ${{ steps.required-release.outputs.major }} | |
| REQUIRED_MINOR: ${{ steps.required-release.outputs.minor }} | |
| run: | | |
| function add_outputs() { | |
| cat << EOF >> "$GITHUB_OUTPUT" | |
| major=$1 | |
| minor=$2 | |
| type=$3 | |
| EOF | |
| } | |
| if ((REQUIRED_MAJOR==0)); then | |
| add_outputs "${LATEST_MAJOR}" "$((LATEST_MINOR+1))" "minor" | |
| elif ((REQUIRED_MAJOR > LATEST_MAJOR)); then | |
| add_outputs "$((LATEST_MAJOR+1))" "0" "major" | |
| elif ((REQUIRED_MAJOR == LATEST_MAJOR && REQUIRED_MINOR > LATEST_MINOR)); then | |
| add_outputs "${LATEST_MAJOR}" "$((LATEST_MINOR+1))" "minor" | |
| else | |
| add_outputs "${REQUIRED_MAJOR}" "${REQUIRED_MINOR}" "patch" | |
| fi | |
| - name: Get patch version | |
| id: patch-version | |
| if: steps.final-values.outputs.type == 'patch' | |
| env: | |
| MAJOR: ${{ steps.final-values.outputs.major }} | |
| MINOR: ${{ steps.final-values.outputs.minor }} | |
| run: | | |
| git checkout "release-${MAJOR}.${MINOR}" | |
| git pull --ff-only | |
| patch=0 | |
| while read -r line; do | |
| if [[ "$line" =~ ^${MAJOR}.${MINOR}.([[:digit:]]+)$ ]]; then | |
| if ((BASH_REMATCH[1] > patch)); then | |
| patch="${BASH_REMATCH[1]}" | |
| fi | |
| fi | |
| done < <(git tag --merged) | |
| echo "value=$((patch+1))" >> "$GITHUB_OUTPUT" | |
| - name: Checkout stackrox submodule | |
| if: steps.final-values.outputs.type != 'patch' | |
| run: | | |
| git submodule update --init collector/proto/third_party/stackrox | |
| - name: Get stackrox version | |
| id: stackrox-version-last | |
| if: steps.final-values.outputs.type != 'patch' | |
| uses: ./.github/actions/get-latest-version | |
| with: | |
| repo: ${{ github.workspace }}/collector/proto/third_party/stackrox | |
| - name: Adjust stackrox version | |
| id: stackrox | |
| if: steps.final-values.outputs.type != 'patch' | |
| run: | | |
| MINOR="$((${{ steps.stackrox-version-last.outputs.minor }}+1))" | |
| echo "major=${{ steps.stackrox-version-last.outputs.major }}" >> "$GITHUB_OUTPUT" | |
| echo "minor=${MINOR}" >> "$GITHUB_OUTPUT" | |
| - name: Notify tags and branches | |
| env: | |
| MAJOR: ${{ steps.final-values.outputs.major }} | |
| MINOR: ${{ steps.final-values.outputs.minor }} | |
| PATCH: ${{ steps.patch-version.outputs.value || '0' }} | |
| RELEASE_TYPE: ${{ steps.final-values.outputs.type }} | |
| run: | | |
| function notice() { | |
| echo "::notice title=$1:: $2" | |
| } | |
| BRANCH="master" | |
| if [[ "${RELEASE_TYPE}" == "patch" ]]; then | |
| BRANCH="release-${MAJOR}.${MINOR}" | |
| fi | |
| notice "Release type" "${RELEASE_TYPE}" | |
| notice "Tag" "${MAJOR}.${MINOR}.${PATCH}" | |
| notice "Base branch" "${BRANCH}" | |
| if [[ "${BRANCH}" == "master" ]]; then | |
| notice "Master tag" "${MAJOR}.${MINOR}.x" | |
| notice "Release branch" "release-${MAJOR}.${MINOR}" | |
| fi | |
| if [[ "${RELEASE_TYPE}" != "patch" ]]; then | |
| notice "Stackrox Major" "${{ steps.stackrox.outputs.major }}" | |
| notice "Stackrox minor" "${{ steps.stackrox.outputs.minor }}" | |
| fi | |
| - name: Mismatched versions | |
| if: steps.required-release.outputs.major != 0 && ( | |
| steps.required-release.outputs.major != steps.final-values.outputs.major || | |
| steps.required-release.outputs.minor != steps.final-values.outputs.minor | |
| ) | |
| env: | |
| REQUIRED_MAJOR: ${{ steps.required-release.outputs.major }} | |
| REQUIRED_MINOR: ${{ steps.required-release.outputs.minor }} | |
| CALCULATED_MAJOR: ${{ steps.final-values.outputs.major }} | |
| CALCULATED_MINOR: ${{ steps.final-values.outputs.minor }} | |
| run: | | |
| cat << EOF >&2 | |
| ::error title='Version mismatch'::The required version did not match the one calculated. REQUIRED: ${REQUIRED_MAJOR}.${REQUIRED_MINOR}, GOT: ${CALCULATED_MAJOR}.${CALCULATED_MINOR} | |
| Please review the input and retrigger the workflow. | |
| EOF | |
| # Fail the workflow | |
| exit 1 | |
| release: | |
| runs-on: ubuntu-24.04 | |
| if: ${{ !inputs.dry-run }} | |
| needs: | |
| - determine-version | |
| env: | |
| RELEASE: ${{ needs.determine-version.outputs.major }}.${{ needs.determine-version.outputs.minor }} | |
| RELEASE_TYPE: ${{ needs.determine-version.outputs.release-type }} | |
| PATCH: ${{ needs.determine-version.outputs.patch }} | |
| GH_TOKEN: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: true | |
| fetch-depth: 0 | |
| token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} | |
| - name: Initialize mandatory git config | |
| run: | | |
| git config user.name "${{ github.event.sender.login }}" | |
| git config user.email noreply@github.com | |
| - name: Create release branch | |
| if: needs.determine-version.outputs.release-type != 'patch' | |
| run: | | |
| git checkout master | |
| git pull --ff-only | |
| git tag "${RELEASE}.x" | |
| git checkout -b "release-${RELEASE}" | |
| - name: Push release branch | |
| if: needs.determine-version.outputs.release-type != 'patch' | |
| run: | | |
| git push origin "${RELEASE}.x" | |
| git push --set-upstream origin "release-${RELEASE}" | |
| - name: Create release tag | |
| run: | | |
| git checkout "release-${RELEASE}" | |
| if [[ "${RELEASE_TYPE}" == "patch" ]]; then | |
| git pull --ff-only | |
| fi | |
| git tag -a -m "Collector v${RELEASE}.${PATCH} release" "${RELEASE}.${PATCH}" | |
| - name: Push release tag | |
| run: | | |
| git push origin "${RELEASE}.${PATCH}" | |
| - name: Create tag in falcosecurity-libs | |
| run: | | |
| git submodule update --init falcosecurity-libs | |
| cd falcosecurity-libs/ | |
| git tag "${RELEASE}.${PATCH}" | |
| - name: Push tag in falcosecurity-libs | |
| run: | | |
| cd falcosecurity-libs/ | |
| git push origin "${RELEASE}.${PATCH}" | |
| - name: Send message to slack | |
| uses: rtCamp/action-slack-notify@v2 | |
| env: | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_COLLECTOR_ONCALL_WEBHOOK }} | |
| SLACK_CHANNEL: team-acs-collector-oncall | |
| SLACK_COLOR: success | |
| SLACK_LINK_NAMES: true | |
| SLACK_TITLE: "New release tagged" | |
| SLACKIFY_MARKDOWN: true | |
| MSG_MINIMAL: true | |
| SLACK_MESSAGE: | | |
| @acs-collector-oncall a new release has just been triggered | |
| with the following values: | |
| | Name | Value | | |
| | --- | --- | | |
| | Version | ${{ env.RELEASE }}.${{ env.PATCH }} | | |
| | Release Type | ${{ env.RELEASE_TYPE }} | |