From 9fdfd997406f0837e32f53fc70577e1b3a0c9d40 Mon Sep 17 00:00:00 2001 From: Jonathan Langevin Date: Fri, 8 May 2026 06:17:30 -0400 Subject: [PATCH 1/5] ci: keep GoReleaser releases draft during upload --- .goreleaser.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.goreleaser.yml b/.goreleaser.yml index fc3adeb..e468ab1 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -27,6 +27,7 @@ archives: checksum: name_template: checksums.txt release: + draft: true github: owner: GoCodeAlone name: workflow-plugin-okta From 989f1e904beeb86ba629861f9739751fe917c8b1 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Fri, 8 May 2026 06:23:32 -0400 Subject: [PATCH 2/5] ci: publish GoReleaser draft releases after upload --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3000235..af12845 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: env: GH_TOKEN: ${{ secrets.REGISTRY_PAT }} run: | - git clone https://x-access-token:${GH_TOKEN}@github.com/GoCodeAlone/workflow-registry.git /tmp/registry + git clone "https://x-access-token:${GH_TOKEN}@github.com/GoCodeAlone/workflow-registry.git" /tmp/registry mkdir -p /tmp/registry/plugins/okta TAG=${GITHUB_REF#refs/tags/} VERSION=${TAG#v} @@ -55,3 +55,8 @@ jobs: env: GH_TOKEN: ${{ secrets.REGISTRY_PAT }} continue-on-error: true + - name: Publish GitHub release + if: ${{ success() }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}" From 42f6e07eee9aa42cad20e2f657fc1b8ea3f5c91f Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Fri, 8 May 2026 10:08:35 -0400 Subject: [PATCH 3/5] ci: publish draft releases through GitHub API --- .github/workflows/release.yml | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index af12845..676e362 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,18 @@ jobs: GH_TOKEN: ${{ secrets.REGISTRY_PAT }} continue-on-error: true - name: Publish GitHub release - if: ${{ success() }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}" + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.RELEASES_TOKEN || github.token }} + script: | + const tag = context.ref.replace('refs/tags/', ''); + const { owner, repo } = context.repo; + const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag }); + if (release.draft) { + await github.rest.repos.updateRelease({ + owner, + repo, + release_id: release.id, + draft: false, + }); + } From 901a539011a538983517ae19587ebb48be8564fc Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Fri, 8 May 2026 16:27:35 -0400 Subject: [PATCH 4/5] ci: run plugin tests on github-hosted runner --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f74b675..d4c2309 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ on: branches: [main] jobs: test: - runs-on: [self-hosted, Linux, X64] + runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-go@v5 From 533262e1e81f8346f93dd7e7b9ec8928b1ae011e Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Fri, 8 May 2026 16:34:49 -0400 Subject: [PATCH 5/5] fix: publish before optional registry sync --- .github/workflows/release.yml | 112 +++++++++++++++++++++++----------- 1 file changed, 76 insertions(+), 36 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 676e362..0f334ca 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,16 +2,16 @@ name: Release on: push: tags: ["v*"] -permissions: - contents: write jobs: release: + permissions: + contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v4 with: fetch-depth: 0 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v5 with: go-version-file: go.mod - uses: goreleaser/goreleaser-action@v7 @@ -20,31 +20,89 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Sync manifest to registry - if: success() && env.GH_TOKEN != '' - continue-on-error: true + + publish-release: + if: startsWith(github.ref, 'refs/tags/v') + needs: [release] + permissions: + contents: write + runs-on: ubuntu-latest + steps: + - name: Publish GitHub release + uses: actions/github-script@v7 + with: + github-token: ${{ github.token }} + script: | + const tag = process.env.GITHUB_REF_NAME; + const { owner, repo } = context.repo; + let release; + try { + ({ data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag })); + } catch (error) { + if (error.status === 404) { + core.setFailed(`No GitHub release found for ${tag}; ensure GoReleaser created the draft before publishing.`); + return; + } + throw error; + } + if (release.draft) { + await github.rest.repos.updateRelease({ + owner, + repo, + release_id: release.id, + draft: false, + }); + } + + sync-registry: + if: startsWith(github.ref, 'refs/tags/v') + needs: [publish-release] + continue-on-error: true + runs-on: ubuntu-latest + steps: + - name: Check registry token + id: registry-token env: - GH_TOKEN: ${{ secrets.REGISTRY_PAT }} + REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} + run: | + if [ -n "$REGISTRY_PAT" ]; then + echo "present=true" >> "$GITHUB_OUTPUT" + fi + + - name: Check out plugin + if: steps.registry-token.outputs.present == 'true' + uses: actions/checkout@v4 + with: + path: plugin + + - name: Check out workflow-registry + if: steps.registry-token.outputs.present == 'true' + uses: actions/checkout@v4 + with: + repository: GoCodeAlone/workflow-registry + token: ${{ secrets.REGISTRY_PAT }} + path: workflow-registry + + - name: Update workflow-registry manifest + if: steps.registry-token.outputs.present == 'true' run: | - git clone "https://x-access-token:${GH_TOKEN}@github.com/GoCodeAlone/workflow-registry.git" /tmp/registry - mkdir -p /tmp/registry/plugins/okta + registry_dir="$GITHUB_WORKSPACE/workflow-registry" + mkdir -p "$registry_dir/plugins/okta" TAG=${GITHUB_REF#refs/tags/} VERSION=${TAG#v} - jq --arg v "$VERSION" '.version = $v' plugin.json > /tmp/registry/plugins/okta/manifest.json - cd /tmp/registry + jq --arg v "$VERSION" --arg tag "$TAG" ' + .version = $v | + .downloads = ((.downloads // []) | map(.url |= sub("/releases/download/v[^/]+/"; "/releases/download/" + $tag + "/"))) + ' "$GITHUB_WORKSPACE/plugin/plugin.json" > "$registry_dir/plugins/okta/manifest.json" + cd "$registry_dir" git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" git add plugins/okta/manifest.json git diff --cached --quiet || git commit -m "chore: sync okta plugin manifest v${VERSION}" git push - notify-registry: - if: startsWith(github.ref, 'refs/tags/v') - needs: [release] - runs-on: ubuntu-latest - steps: - name: Notify workflow-registry - if: env.GH_TOKEN != '' + if: steps.registry-token.outputs.present == 'true' uses: peter-evans/repository-dispatch@v3 with: token: ${{ secrets.REGISTRY_PAT }} @@ -52,22 +110,4 @@ jobs: event-type: plugin-release client-payload: >- {"plugin": "${{ github.repository }}", "tag": "${{ github.ref_name }}"} - env: - GH_TOKEN: ${{ secrets.REGISTRY_PAT }} continue-on-error: true - - name: Publish GitHub release - uses: actions/github-script@v7 - with: - github-token: ${{ secrets.RELEASES_TOKEN || github.token }} - script: | - const tag = context.ref.replace('refs/tags/', ''); - const { owner, repo } = context.repo; - const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag }); - if (release.draft) { - await github.rest.repos.updateRelease({ - owner, - repo, - release_id: release.id, - draft: false, - }); - }