Release candidate #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release candidate | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| rc_number: | |
| description: Positive RC sequence number | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-candidate-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| outputs: | |
| version: ${{ steps.validate.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Validate release branch and RC number | |
| id: validate | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| RC_NUMBER: ${{ inputs.rc_number }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| [[ "$REF_NAME" =~ ^release/v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { | |
| echo "This workflow must run from release/vX.Y.Z." >&2 | |
| exit 2 | |
| } | |
| base_version="${BASH_REMATCH[1]}" | |
| [[ "$RC_NUMBER" =~ ^[1-9][0-9]*$ ]] || { | |
| echo "rc_number must be a positive integer." >&2 | |
| exit 2 | |
| } | |
| version="v$base_version-rc.$RC_NUMBER" | |
| if git ls-remote --exit-code --tags origin "refs/tags/$version" >/dev/null 2>&1; then | |
| echo "Tag already exists: $version" >&2 | |
| exit 1 | |
| fi | |
| if gh release view "$version" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then | |
| echo "Release already exists: $version" >&2 | |
| exit 1 | |
| fi | |
| echo "version=$version" >>"$GITHUB_OUTPUT" | |
| build: | |
| needs: validate | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| uses: ./.github/workflows/release-build.yml | |
| with: | |
| version: ${{ needs.validate.outputs.version }} | |
| release_type: rc | |
| content_key_id: sysarmor-rc | |
| release_environment: '' | |
| release: | |
| needs: build | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check out release source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.build.outputs.source_sha }} | |
| - name: Download release assets | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ${{ needs.build.outputs.artifact_name }} | |
| path: dist/github-release | |
| - name: Create GitHub pre-release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| VERSION: ${{ needs.build.outputs.version }} | |
| SOURCE_SHA: ${{ needs.build.outputs.source_sha }} | |
| ASSET_DIR: ${{ github.workspace }}/dist/github-release | |
| run: | | |
| set -euo pipefail | |
| deployments/packages/render-github-release-notes.sh "$VERSION" "$GITHUB_REPOSITORY" rc >"$RUNNER_TEMP/release-notes.md" | |
| gh release create "$VERSION" "$ASSET_DIR"/* \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --target "$SOURCE_SHA" \ | |
| --title "SysArmor $VERSION" \ | |
| --notes-file "$RUNNER_TEMP/release-notes.md" \ | |
| --prerelease |