Add reusable release workflows (slice #4) - #2
Merged
Conversation
Implements slice #4 of the Apius Splunk CI standard: the DECIDED commit-back release-PR flow (ADR-0004) plus tag-triggered publish (ADR-0004/ADR-0005). prepare-release.yml (workflow_call; inputs version, app_id): - Stamps app.conf [launcher] version and root pyproject.toml [project].version to the target version via `python -m splunk_app_ci stamp`, sourcing the packaging module the same way app-ci.yml does (checkout splunk-app-ci into .splunk-app-ci, run under PYTHONPATH=.splunk-app-ci). - Commits only the two stamped files onto a release/vX.Y.Z branch and opens a "Release vX.Y.Z" PR against main. Never writes to main directly; opening the PR runs the normal PR gate. Needs contents:write + pull-requests:write. release.yml (workflow_call; inputs app_id, version, cloud_gate=false; secrets SPLUNK_USER/SPLUNK_PASS): - Builds the Splunkbase package at the released version into dist/. - Runs Splunk AppInspect via the AppInspect API (splunk/appinspect-api-action @v3.0.5). Base (non-cloud) checks run with excluded_tags "manual,cloud" and BLOCK on errors (the action hardcodes failOnError=true). Cloud checks run with included_tags cloud in a separate step made ADVISORY via step-level continue-on-error: ${{ !inputs.cloud_gate }}, so cloud findings only block when cloud_gate=true. This two-step split is required because v3 of the action dropped the failOn* inputs. - Publishes a GitHub Release for the pushed tag with dist/*.tar.gz and auto-generated notes (gh release create --generate-notes). Splunkbase upload is out of scope (slice #6); the workflow stops after the Release step. README: document the two workflows and the human release flow (prepare-release -> merge Release PR -> push tag vX.Y.Z -> release publishes), with caller snippets and the "Allow Actions to create PRs" repo-setting note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements slice #4 (apius-tech/splunk-app-standards#5): the reusable release workflows for the Apius Splunk CI standard.
What
prepare-release.yml(workflow_call; inputsversion,app_id) — stampsapp.conf [launcher] versionand rootpyproject.toml [project].versionto the target version viasplunk_app_ci stamp(module sourced the same way asapp-ci.yml), commits the two files onto arelease/vX.Y.Zbranch, and opens a "Release vX.Y.Z" PR against main. Never writes main directly; opening the PR runs the normal gate.release.yml(workflow_call; inputsapp_id,version,cloud_gate=false; secretsSPLUNK_USER/SPLUNK_PASS) — packages the app at the released version, runs Splunk AppInspect via the AppInspect API (splunk/appinspect-api-action@v3.0.5), then publishes a GitHub Release withdist/*.tar.gz+ auto-generated notes. Splunkbase upload is out of scope (slice #6).AppInspect advisory-cloud (ADR-0005)
appinspect-api-actionv3 dropped thefailOn*inputs (failOnErroris hardcodedtrue). To get "base blocks, cloud advisory" the vetting runs as two steps:excluded_tags: "manual,cloud"— blocks on error/failure;included_tags: cloudwithcontinue-on-error: ${{ !inputs.cloud_gate }}— advisory by default, blocking whencloud_gate=true.Verified locally
yaml.safe_load.stampandpackageCLIs run against a freshapius_lang_entropycheckout: both source files stamp to the version and the package builds withapp.confstamped inside.ruff check/formatclean.Not verified (needs a human-approved run post-merge)
prepare-releaseworkflow_dispatchis only dispatchable once the caller file is on the default branch.Notes
@mainfor now (nov1tag cut yet), per the README guidance; repin to@v1once released.prepare-releaseneeds the repo setting "Allow GitHub Actions to create and approve pull requests" enabled.