ci: bound every job with timeout-minutes on main (#18) #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Workflow | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - master | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version to release (leave empty to use info.xml version)' | |
| required: false | |
| default: '' | |
| jobs: | |
| release-management: | |
| runs-on: ubuntu-latest | |
| # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| with: | |
| fetch-depth: 0 | |
| ssh-key: ${{ secrets.DEPLOY_KEY }} | |
| - name: Set app env | |
| run: | | |
| echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV | |
| - name: Get current version and increment | |
| id: increment_version | |
| run: | | |
| current_version=$(grep -oP '(?<=<version>)[^<]+' appinfo/info.xml) | |
| IFS='.' read -ra version_parts <<< "$current_version" | |
| ((version_parts[2]++)) | |
| new_version="${version_parts[0]}.${version_parts[1]}.${version_parts[2]}" | |
| echo "NEW_VERSION=$new_version" >> $GITHUB_ENV | |
| echo "new_version=$new_version" >> $GITHUB_OUTPUT | |
| - name: Update version in info.xml | |
| run: | | |
| sed -i "s|<version>.*</version>|<version>${{ env.NEW_VERSION }}</version>|" appinfo/info.xml | |
| - name: Commit version update | |
| run: | | |
| git config --local user.email "action@github.com" | |
| git config --local user.name "GitHub Action" | |
| git commit -am "Bump version to ${{ env.NEW_VERSION }}" -m "[skip ci]" | |
| git push | |
| - name: Prepare Signing Certificate and Key | |
| run: | | |
| echo "${{ secrets.NEXTCLOUD_SIGNING_CERT }}" > signing-cert.crt | |
| echo "${{ secrets.NEXTCLOUD_SIGNING_KEY }}" > signing-key.key | |
| - name: Install npm dependencies | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: '18.x' | |
| - name: Set up PHP and install extensions | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.2' | |
| extensions: zip, gd | |
| - run: npm ci | |
| - run: npm run build | |
| - run: composer install --no-dev --optimize-autoloader --classmap-authoritative | |
| - name: Copy the package files into the package | |
| run: | | |
| mkdir -p package/${{ github.event.repository.name }} | |
| rsync -av --progress \ | |
| --exclude='/package' \ | |
| --exclude='/.git' \ | |
| --exclude='/.github' \ | |
| --exclude='/.cursor' \ | |
| --exclude='/.vscode' \ | |
| --exclude='/node_modules' \ | |
| --exclude='/src' \ | |
| --exclude='/tests' \ | |
| --exclude='/package.json' \ | |
| --exclude='/package-lock.json' \ | |
| --exclude='/composer.json' \ | |
| --exclude='/composer.lock' \ | |
| --exclude='/phpcs.xml' \ | |
| --exclude='/phpmd.xml' \ | |
| --exclude='/psalm.xml' \ | |
| --exclude='/phpunit.xml' \ | |
| --exclude='/.phpunit.cache' \ | |
| --exclude='.phpunit.result.cache' \ | |
| --exclude='/jest.config.js' \ | |
| --exclude='/webpack.config.js' \ | |
| --exclude='/tsconfig.json' \ | |
| --exclude='/.babelrc' \ | |
| --exclude='/.eslintrc.js' \ | |
| --exclude='/.prettierrc' \ | |
| --exclude='/stylelint.config.js' \ | |
| --exclude='/.gitignore' \ | |
| --exclude='/.gitattributes' \ | |
| --exclude='/signing-key.key' \ | |
| --exclude='/signing-cert.crt' \ | |
| ./ package/${{ github.event.repository.name }}/ | |
| - name: Create Tarball | |
| run: | | |
| cd package && tar -czf ../nextcloud-release.tar.gz ${{ github.event.repository.name }} | |
| - name: Sign the TAR.GZ file with OpenSSL | |
| run: | | |
| openssl dgst -sha512 -sign signing-key.key nextcloud-release.tar.gz | openssl base64 -out nextcloud-release.signature | |
| - name: Upload tarball as artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: nextcloud-release-${{ env.NEW_VERSION }} | |
| path: | | |
| nextcloud-release.tar.gz | |
| nextcloud-release.signature | |
| retention-days: 30 | |
| - name: Git Version | |
| id: version | |
| uses: codacy/git-version@2.7.1 | |
| with: | |
| release-branch: main | |
| - name: Upload Release | |
| uses: ncipollo/release-action@v1.12.0 | |
| with: | |
| tag: v${{ env.NEW_VERSION }} | |
| name: Release ${{ env.NEW_VERSION }} | |
| draft: false | |
| prerelease: false | |
| - name: Attach tarball to GitHub release | |
| uses: svenstaro/upload-release-action@v2 | |
| with: | |
| repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| file: nextcloud-release.tar.gz | |
| asset_name: ${{ env.APP_NAME }}-${{ env.NEW_VERSION }}.tar.gz | |
| tag: v${{ env.NEW_VERSION }} | |
| overwrite: true | |
| - name: Upload app to Nextcloud appstore | |
| uses: nextcloud-releases/nextcloud-appstore-push-action@a011fe619bcf6e77ddebc96f9908e1af4071b9c1 | |
| with: | |
| app_name: ${{ env.APP_NAME }} | |
| appstore_token: ${{ secrets.NEXTCLOUD_APPSTORE_TOKEN }} | |
| download_url: https://github.com/${{ github.repository }}/releases/download/v${{ env.NEW_VERSION }}/${{ env.APP_NAME }}-${{ env.NEW_VERSION }}.tar.gz | |
| app_private_key: ${{ secrets.NEXTCLOUD_SIGNING_KEY }} | |
| nightly: false | |
| - name: Verify release | |
| run: | | |
| echo "App version: ${{ env.NEW_VERSION }}" | |
| echo "Tarball contents:" | |
| tar -tvf nextcloud-release.tar.gz | head -50 | |
| echo "info.xml contents:" | |
| tar -xOf nextcloud-release.tar.gz ${{ env.APP_NAME }}/appinfo/info.xml |