release #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| release-version: | |
| description: 'Version being released' | |
| required: true | |
| branch: | |
| description: 'Branch to release from' | |
| required: true | |
| default: 'main' | |
| permissions: | |
| contents: write | |
| deployments: write | |
| packages: write | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 150 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Java | |
| uses: actions/setup-java@v6 | |
| with: | |
| java-version: 25 | |
| distribution: 'temurin' | |
| server-id: central | |
| server-username: MAVEN_USERNAME | |
| server-password: MAVEN_CENTRAL_TOKEN | |
| gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| gpg-passphrase: MAVEN_GPG_PASSPHRASE | |
| - id: install-secret-key | |
| name: Install gpg secret key | |
| run: | | |
| cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import | |
| gpg --list-secret-keys --keyid-format LONG | |
| - name: Compile | |
| run: ./mvnw --batch-mode -Dquickly | |
| - name: Setup Git | |
| run: | | |
| git config user.name "Endive BOT" | |
| git config user.email "endive@bytecodealliance.org" | |
| - name: Install ORAS | |
| uses: oras-project/setup-oras@v2 | |
| # Jars must be built against an immutable wasm tag: the development | |
| # snapshot is mutable, so a release built against it stops being | |
| # reproducible the moment that tag moves. | |
| # | |
| # This retags the digest already pinned in wkg.lock rather than rebuilding | |
| # from Rust, so the released wasm is byte-identical to the one CI tested | |
| # and no toolchain is needed here. | |
| - name: Publish the bridge wasm under the release version | |
| run: | | |
| set -euo pipefail | |
| DIGEST=$(grep -oE 'sha256:[0-9a-f]{64}' redline/wkg.lock | head -1 || true) | |
| if [ -z "$DIGEST" ]; then | |
| echo "::error::No digest found in redline/wkg.lock" | |
| exit 1 | |
| fi | |
| echo "Retagging $DIGEST as $VERSION" | |
| echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin | |
| oras tag "ghcr.io/bytecodealliance/endive-cranelift-bridge@${DIGEST}" "$VERSION" | |
| env: | |
| VERSION: ${{ github.event.inputs.release-version }} | |
| # Runs before "Set the version" so the property and lock changes are | |
| # swept into the release commit by its "git add ." below. | |
| - name: Pin the build to the released wasm | |
| run: | | |
| ./mvnw versions:set-property -Dproperty=cranelift-bridge.version \ | |
| -DnewVersion=${{ github.event.inputs.release-version }} -DgenerateBackupPoms=false | |
| ./mvnw generate-sources -pl :redline-bridge-experimental -Dinlay.update | |
| - name: Set the version | |
| run: | | |
| ./mvnw versions:set -DgenerateBackupPoms=false -DnewVersion=${{ github.event.inputs.release-version }} | |
| git add . | |
| git commit -m "Release version update ${{ github.event.inputs.release-version }}" | |
| git push | |
| git tag ${{ github.event.inputs.release-version }} | |
| git push origin ${{ github.event.inputs.release-version }} | |
| env: | |
| GITHUB_TOKEN: ${{secrets.GH_TOKEN}} | |
| # Last line of defence: if the steps above were skipped or edited away, the | |
| # jars would be built from a mutable tag and could not be rebuilt later. | |
| - name: Verify the bridge wasm tag is immutable | |
| run: | | |
| set -euo pipefail | |
| v=$(./mvnw help:evaluate -Dexpression=cranelift-bridge.version -q -DforceStdout) | |
| echo "cranelift-bridge.version = $v" | |
| case "$v" in | |
| *SNAPSHOT*) | |
| echo "::error::Refusing to release jars built against the mutable wasm tag '$v'" | |
| exit 1 | |
| ;; | |
| esac | |
| - name: Release to Maven Central | |
| run: | | |
| # -Dquickly is needed to locally publish wasm-corpus | |
| ./mvnw --batch-mode -Dquickly | |
| ./mvnw --batch-mode clean deploy -Drelease -DskipTests=true -X | |
| env: | |
| MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | |
| MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_PASSWORD }} | |
| MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| - name: Back to Snapshot | |
| run: | | |
| ./mvnw versions:set -DgenerateBackupPoms=false -DnewVersion=999-SNAPSHOT | |
| ./mvnw versions:set-property -Dproperty=cranelift-bridge.version \ | |
| -DnewVersion=999.0.0-SNAPSHOT -DgenerateBackupPoms=false | |
| ./mvnw generate-sources -pl :redline-bridge-experimental -Dinlay.update | |
| git add . | |
| git commit -m "Snapshot version update" | |
| git push | |
| env: | |
| GITHUB_TOKEN: ${{secrets.GH_TOKEN}} | |
| - name: Release to GH Action | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ github.event.inputs.release-version }} | |
| token: ${{ secrets.GH_TOKEN }} |