feat(bedrock): consume signed principal v2 (#129) #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| actions: write | |
| checks: read | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| release_created: ${{ steps.rp.outputs.release_created }} | |
| tag_name: ${{ steps.rp.outputs.tag_name }} | |
| pr_number: ${{ steps.rp.outputs.pr }} | |
| steps: | |
| - id: rp | |
| uses: googleapis/release-please-action@v5 | |
| with: | |
| config-file: .release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| - name: Validate and merge release PR | |
| if: ${{ steps.rp.outputs.pr }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| PR_NUMBER=$(jq -r '.number' <<< '${{ steps.rp.outputs.pr }}') | |
| PR_JSON=$(gh pr view "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --json headRefName,headRefOid) | |
| HEAD_REF=$(jq -r '.headRefName' <<< "$PR_JSON") | |
| HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_JSON") | |
| echo "Dispatching PR build for release PR #$PR_NUMBER at $HEAD_REF ($HEAD_SHA)" | |
| gh workflow run pullrequest.yml \ | |
| --repo "${{ github.repository }}" \ | |
| --ref "$HEAD_REF" | |
| RUN_ID="" | |
| for _ in $(seq 1 60); do | |
| RUN_ID=$(gh run list \ | |
| --repo "${{ github.repository }}" \ | |
| --workflow pullrequest.yml \ | |
| --branch "$HEAD_REF" \ | |
| --event workflow_dispatch \ | |
| --json databaseId,headSha \ | |
| --jq "map(select(.headSha == \"$HEAD_SHA\")) | .[0].databaseId // \"\"") | |
| if [ -n "$RUN_ID" ]; then | |
| break | |
| fi | |
| sleep 5 | |
| done | |
| if [ -z "$RUN_ID" ]; then | |
| echo "::error::Timed out waiting for dispatched PR build to appear" | |
| exit 1 | |
| fi | |
| echo "Waiting for PR build run $RUN_ID" | |
| STATUS="" | |
| CONCLUSION="" | |
| RUN_URL="" | |
| for _ in $(seq 1 180); do | |
| RUN_JSON=$(gh run view "$RUN_ID" \ | |
| --repo "${{ github.repository }}" \ | |
| --json status,conclusion,url) | |
| STATUS=$(jq -r '.status' <<< "$RUN_JSON") | |
| CONCLUSION=$(jq -r '.conclusion // ""' <<< "$RUN_JSON") | |
| RUN_URL=$(jq -r '.url' <<< "$RUN_JSON") | |
| if [ "$STATUS" = "completed" ]; then | |
| break | |
| fi | |
| sleep 10 | |
| done | |
| if [ "$STATUS" != "completed" ]; then | |
| echo "::error::Timed out waiting for PR build run $RUN_ID" | |
| exit 1 | |
| fi | |
| CHECKS_JSON=$(gh api \ | |
| "repos/${{ github.repository }}/commits/$HEAD_SHA/check-runs?per_page=100") | |
| RUN_CHECKS=$(jq --arg run_url "$RUN_URL" ' | |
| [ | |
| .check_runs[] | |
| | select((.details_url // "") | startswith($run_url + "/job/")) | |
| ] | |
| ' <<< "$CHECKS_JSON") | |
| CHECK_COUNT=$(jq 'length' <<< "$RUN_CHECKS") | |
| if [ "$CHECK_COUNT" -eq 0 ]; then | |
| echo "::error::No native checks from run $RUN_ID found on commit $HEAD_SHA" | |
| exit 1 | |
| fi | |
| echo "Native checks for run $RUN_ID on commit $HEAD_SHA:" | |
| jq -r '.[] | "\(.name): \(.status) / \(.conclusion // "none")"' \ | |
| <<< "$RUN_CHECKS" | |
| BAD_CHECKS=$(jq ' | |
| [ | |
| .[] | |
| | select(.status != "completed" or .conclusion != "success") | |
| ] | |
| ' <<< "$RUN_CHECKS") | |
| if [ "$(jq 'length' <<< "$BAD_CHECKS")" -ne 0 ]; then | |
| echo "::error::Dispatched run has incomplete or unsuccessful native checks" | |
| jq -c '.[] | {name, status, conclusion, details_url}' <<< "$BAD_CHECKS" | |
| exit 1 | |
| fi | |
| if [ "$CONCLUSION" != "success" ]; then | |
| echo "::error::Release PR build concluded $CONCLUSION" | |
| exit 1 | |
| fi | |
| CURRENT_HEAD_SHA=$(gh pr view "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --json headRefOid \ | |
| --jq '.headRefOid') | |
| if [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then | |
| echo "::error::Release PR moved from $HEAD_SHA to $CURRENT_HEAD_SHA during validation" | |
| exit 1 | |
| fi | |
| echo "Merging release PR #$PR_NUMBER" | |
| for _ in $(seq 1 30); do | |
| if gh pr merge "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --match-head-commit "$HEAD_SHA" \ | |
| --merge; then | |
| break | |
| fi | |
| PR_STATE_JSON=$(gh pr view "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --json state,headRefOid) | |
| STATE=$(jq -r '.state' <<< "$PR_STATE_JSON") | |
| if [ "$STATE" = "MERGED" ]; then | |
| CURRENT_HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_STATE_JSON") | |
| if [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then | |
| echo "::error::Release PR #$PR_NUMBER merged at unvalidated head $CURRENT_HEAD_SHA" | |
| exit 1 | |
| fi | |
| break | |
| fi | |
| sleep 10 | |
| done | |
| PR_STATE_JSON=$(gh pr view "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --json state,headRefOid) | |
| STATE=$(jq -r '.state' <<< "$PR_STATE_JSON") | |
| CURRENT_HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_STATE_JSON") | |
| if [ "$STATE" != "MERGED" ] || [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then | |
| echo "::error::Release PR #$PR_NUMBER did not merge" | |
| exit 1 | |
| fi | |
| gh workflow run release-please.yml \ | |
| --repo "${{ github.repository }}" \ | |
| --ref "${{ github.ref_name }}" | |
| trigger-release: | |
| needs: release-please | |
| if: needs.release-please.outputs.release_created == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Dispatch release.yml on the new tag | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh workflow run release.yml \ | |
| --repo "${{ github.repository }}" \ | |
| --ref "${{ needs.release-please.outputs.tag_name }}" \ | |
| -f release_tag="${{ needs.release-please.outputs.tag_name }}" |