Skip to content

Commit dea7ddf

Browse files
spring-rainingspring-raining
committed
chore: Fix release CI
1 parent 6394c34 commit dea7ddf

File tree

2 files changed

+41
-37
lines changed

2 files changed

+41
-37
lines changed

‎.github/actions/crypto-secret/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ runs:
3636
run: |
3737
set -eo pipefail
3838
TOKEN="${{ inputs.token }}"
39-
ENCRYPTED_TOKEN=$(echo -n "$TOKEN" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "${{ inputs.encryption-key }}" | base64)
39+
ENCRYPTED_TOKEN=$(echo -n "$TOKEN" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "${{ inputs.encryption-key }}" | base64 -w 0)
4040
echo "::add-mask::$TOKEN"
4141
echo "token=$TOKEN" >> "$GITHUB_OUTPUT"
4242
echo "encrypted-token=$ENCRYPTED_TOKEN" >> "$GITHUB_OUTPUT"
@@ -47,7 +47,7 @@ runs:
4747
run: |
4848
set -eo pipefail
4949
ENCRYPTED_TOKEN="${{ inputs.encrypted-token }}"
50-
DECRYPTED_TOKEN=$(echo -n "$ENCRYPTED_TOKEN" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -d -salt -k "${{ inputs.encryption-key }}")
50+
DECRYPTED_TOKEN=$(echo -n "$ENCRYPTED_TOKEN" | tr -d '\n' | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -d -salt -k "${{ inputs.encryption-key }}")
5151
echo "::add-mask::$DECRYPTED_TOKEN"
5252
echo "encrypted-token=$ENCRYPTED_TOKEN" >> "$GITHUB_OUTPUT"
5353
echo "decrypted-token=$DECRYPTED_TOKEN" >> "$GITHUB_OUTPUT"

‎.github/workflows/release.yml‎

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -69,57 +69,57 @@ jobs:
6969
with:
7070
setupGitUser: false
7171

72-
get-release-token:
72+
publish:
7373
needs:
7474
- publish-dry-run
7575
- create-version-pr
7676
if: ${{ fromJson(needs.publish-dry-run.outputs.publish-summary).publishedPackages[0] && !fromJson(needs.create-version-pr.outputs.has-changesets) }}
7777
runs-on: ubuntu-latest
7878
environment: Production deployment
7979
outputs:
80-
encrypted-token: ${{ steps.crypto-secret.outputs.encrypted-token }}
81-
git-user-name: ${{ steps.app-token.outputs.app-slug }}[bot]
82-
git-user-email: ${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
80+
encrypted-token: ${{ steps.encrypt-secret.outputs.encrypted-token }}
81+
app-slug: ${{ steps.app-token.outputs.app-slug }}
82+
user-id: ${{ steps.get-user-id.outputs.user-id }}
8383
steps:
84+
- uses: actions/checkout@v4
85+
with:
86+
sparse-checkout: |
87+
.github
88+
persist-credentials: false
8489
- uses: actions/create-github-app-token@v2
8590
id: app-token
8691
with:
8792
app-id: ${{ secrets.GH_APP_ID }}
8893
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
89-
- name: Get GitHub App User ID
90-
id: get-user-id
91-
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
92-
env:
93-
GH_TOKEN: ${{ steps.app-token.outputs.token }}
94+
skip-token-revoke: true
9495
- name: Encrypt release token
95-
id: crypto-secret
96+
id: encrypt-secret
9697
uses: ./.github/actions/crypto-secret
9798
with:
9899
mode: encrypt
99100
token: ${{ steps.app-token.outputs.token }}
100101
encryption-key: ${{ secrets.ENCRYPTION_KEY }}
101-
102-
publish:
103-
needs:
104-
- get-release-token
105-
runs-on: ubuntu-latest
106-
steps:
107102
- name: Decrypt release token
108-
id: crypto-secret
103+
id: decrypt-secret
109104
uses: ./.github/actions/crypto-secret
110105
with:
111106
mode: decrypt
112-
encrypted-token: ${{ needs.get-release-token.outputs.encrypted-token }}
107+
encrypted-token: ${{ steps.encrypt-secret.outputs.encrypted-token }}
113108
encryption-key: ${{ secrets.ENCRYPTION_KEY }}
109+
- name: Get GitHub App User ID
110+
id: get-user-id
111+
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
112+
env:
113+
GH_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted-token }}
114+
- name: Set up git
115+
run: |
116+
git config --global user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
117+
git config --global user.email "${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com"
118+
git config --global url."https://x-access-token:${{ steps.decrypt-secret.outputs.decrypted-token }}@github.com/".insteadOf "https://github.com/"
114119
- uses: actions/checkout@v4
115120
with:
116-
token: ${{ steps.crypto-secret.outputs.decrypted-token }}
121+
token: ${{ steps.decrypt-secret.outputs.decrypted-token }}
117122
persist-credentials: false
118-
- name: Set up git
119-
run: |
120-
git config --global user.name "${{ needs.get-release-token.outputs.git-user-name }}"
121-
git config --global user.email "${{ needs.get-release-token.outputs.git-user-email }}"
122-
git remote set-url origin "https://x-access-token:${{ steps.crypto-secret.outputs.decrypted-token }}@github.com/${{ github.repository }}.git"
123123
- uses: actions/download-artifact@v4
124124
with:
125125
path: .
@@ -139,28 +139,37 @@ jobs:
139139
- name: Release
140140
run: pnpm publish -r --access public --publish-branch ${{ github.ref_name }}
141141
env:
142-
GITHUB_TOKEN: ${{ steps.crypto-secret.outputs.decrypted-token }}
142+
GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted-token }}
143143

144144
release:
145145
needs:
146146
- publish-dry-run
147-
- get-release-token
148147
- publish
149148
runs-on: ubuntu-latest
150149
strategy:
151150
matrix:
152151
package: ${{ fromJson(needs.publish-dry-run.outputs.publish-summary).publishedPackages }}
153152
steps:
153+
- uses: actions/checkout@v4
154+
with:
155+
sparse-checkout: |
156+
.github
157+
persist-credentials: false
154158
- name: Decrypt release token
155-
id: crypto-secret
159+
id: decrypt-secret
156160
uses: ./.github/actions/crypto-secret
157161
with:
158162
mode: decrypt
159-
encrypted-token: ${{ needs.get-release-token.outputs.encrypted-token }}
163+
encrypted-token: ${{ needs.publish.outputs.encrypted-token }}
160164
encryption-key: ${{ secrets.ENCRYPTION_KEY }}
165+
- name: Set up git
166+
run: |
167+
git config --global user.name "${{ needs.publish.outputs.app-slug }}[bot]"
168+
git config --global user.email "${{ needs.publish.outputs.user-id }}+${{ needs.publish.outputs.app-slug }}[bot]@users.noreply.github.com"
169+
git config --global url."https://x-access-token:${{ steps.decrypt-secret.outputs.decrypted-token }}@github.com/".insteadOf "https://github.com/"
161170
- uses: actions/checkout@v4
162171
with:
163-
token: ${{ steps.crypto-secret.outputs.decrypted-token }}
172+
token: ${{ steps.decrypt-secret.outputs.decrypted-token }}
164173
persist-credentials: false
165174
- uses: pnpm/action-setup@v4
166175
with:
@@ -169,11 +178,6 @@ jobs:
169178
with:
170179
node-version-file: .nvmrc
171180
cache: 'pnpm'
172-
- name: Set up git
173-
run: |
174-
git config --global user.name "${{ needs.get-release-token.outputs.git-user-name }}"
175-
git config --global user.email "${{ needs.get-release-token.outputs.git-user-email }}"
176-
git remote set-url origin "https://x-access-token:${{ steps.crypto-secret.outputs.decrypted-token }}@github.com/${{ github.repository }}.git"
177181
- name: Output current package info
178182
id: package
179183
run: |
@@ -209,4 +213,4 @@ jobs:
209213
tag_name: ${{ steps.create-tag.outputs.name }}
210214
body_path: release_notes.txt
211215
generate_release_notes: true
212-
token: ${{ steps.crypto-secret.outputs.decrypted-token }}
216+
token: ${{ steps.decrypt-secret.outputs.decrypted-token }}

0 commit comments

Comments
 (0)