From d1a88b463b140f69c4d105401ccb47edcecc7752 Mon Sep 17 00:00:00 2001 From: KC Berg Date: Tue, 8 Jul 2025 17:01:41 -0600 Subject: [PATCH 1/3] chore: remove old publish workflows, unify under release workflow --- .github/workflows/publish-docker.yml | 33 --------- .github/workflows/publish-pypi.yml | 63 ---------------- .github/workflows/release.yml | 103 ++++++++++++++------------- 3 files changed, 52 insertions(+), 147 deletions(-) delete mode 100644 .github/workflows/publish-docker.yml delete mode 100644 .github/workflows/publish-pypi.yml diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml deleted file mode 100644 index 78e61b8..0000000 --- a/.github/workflows/publish-docker.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Publish Docker image - -on: - workflow_run: - workflows: ["CI"] - types: - - completed - branches: - - main - release: - types: [published] - -jobs: - build-and-push: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to DockerHub - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Build and push Docker image - uses: docker/build-push-action@v5 - with: - context: . - push: true - tags: stackhawk/stackhawk-mcp:latest,stackhawk/stackhawk-mcp:${{ github.ref_name }} - platforms: linux/amd64,linux/arm64 \ No newline at end of file diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml deleted file mode 100644 index 150b132..0000000 --- a/.github/workflows/publish-pypi.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Publish Python 🐍 distribution 📦 to PyPI - -on: - workflow_run: - workflows: ["CI"] - types: - - completed - branches: - - main - release: - types: [published] - -permissions: - contents: write - id-token: write - -jobs: - build-and-publish: - runs-on: ubuntu-latest - environment: pypi - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: Set up Python - uses: actions/setup-python@v5 - with: - python-version: '3.11' - - name: Install build dependencies - run: | - python -m pip install --upgrade pip - pip install build bumpver - - name: Bump minor version with bumpver - if: github.ref == 'refs/heads/main' - run: bumpver update --minor --commit - - name: Get version from pyproject.toml - id: get_version - run: | - VERSION=$(grep '^version = ' pyproject.toml | head -1 | cut -d '"' -f2) - echo "version=$VERSION" >> $GITHUB_OUTPUT - - name: Set up git for pushing - if: github.ref == 'refs/heads/main' - run: | - git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git - - name: Create and push tag for new version - if: github.ref == 'refs/heads/main' - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git tag v${{ steps.get_version.outputs.version }} - git push origin v${{ steps.get_version.outputs.version }} - - name: Push version bump commit - if: github.ref == 'refs/heads/main' - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git push - - name: Build package - run: | - python -m build - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 - # No password needed! Uses OIDC trusted publisher \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 958ea8b..07565ac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,60 +1,61 @@ -name: Release Approval +name: Release on: - workflow_dispatch: - inputs: - tag: - description: 'Release tag (e.g., v0.1.0)' - required: true - release_title: - description: 'Release title' - required: false - release_notes: - description: 'Release notes (optional)' - required: false + release: + types: [published] + +permissions: + contents: write + id-token: write jobs: - approve-and-release: + publish-pypi: + name: Publish to PyPI runs-on: ubuntu-latest + environment: pypi steps: - - name: Wait for manual approval - uses: trstringer/manual-approval@v1 - with: - secret: ${{ github.TOKEN }} - approvers: sgerlach,kcberg,danielhopkins,clamey,Bwvolleyball - minimum-approvals: 1 - fail-on-denial: true - - name: Check CI status for this commit - id: check_ci - uses: actions/github-script@v7 + - uses: actions/checkout@v4 with: - script: | - const commit = context.sha; - const { data: runs } = await github.rest.actions.listWorkflowRunsForRepo({ - owner: context.repo.owner, - repo: context.repo.repo, - branch: 'main', - event: 'push', - status: 'completed', - per_page: 10 - }); - const ciRun = runs.workflow_runs.find(run => run.name === 'CI' && run.head_sha === commit); - if (!ciRun) { - core.setFailed('No CI workflow run found for this commit.'); - } else if (ciRun.conclusion !== 'success') { - core.setFailed(`CI workflow did not succeed (status: ${ciRun.conclusion}). Release aborted.`); - } - - name: Create GitHub Release - if: steps.check_ci.outcome == 'success' - uses: softprops/action-gh-release@v1 + fetch-depth: 0 + - name: Set up Python + uses: actions/setup-python@v5 with: - tag_name: ${{ github.event.inputs.tag }} - name: ${{ github.event.inputs.release_title || github.event.inputs.tag }} - body: ${{ github.event.inputs.release_notes }} - draft: false - prerelease: false + python-version: '3.11' + - name: Install build dependencies + run: | + python -m pip install --upgrade pip + pip install build bumpver + - name: Set version from tag + run: | + TAG_NAME=${GITHUB_REF#refs/tags/v} + bumpver update --set-version $TAG_NAME --commit + - name: Build package + run: | + python -m build + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + # No password needed! Uses OIDC trusted publisher -permissions: - actions: read - issues: write - contents: write \ No newline at end of file + publish-docker: + name: Publish Docker image + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to DockerHub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Build and push Docker image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: stackhawk/stackhawk-mcp:latest,stackhawk/stackhawk-mcp:${{ github.ref_name }} + platforms: linux/amd64,linux/arm64 \ No newline at end of file From 18b86b795cbb8ce61a5db36f4a2cf39c6f6402dd Mon Sep 17 00:00:00 2001 From: KC Berg Date: Tue, 8 Jul 2025 17:09:18 -0600 Subject: [PATCH 2/3] chore: remove obsolete publish workflow files from local filesystem --- .github/workflows/release.yml | 49 +++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 07565ac..5f4f884 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,10 +9,32 @@ permissions: id-token: write jobs: + approval: + name: Manual Approval + runs-on: ubuntu-latest + steps: + - name: Generate GitHub App token + id: generate_token + uses: tibdex/github-app-token@v2 + with: + app_id: ${{ secrets.HAWKY_APP_ID }} + private_key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} + - name: Wait for manual approval + uses: trstringer/manual-approval@v1 + with: + secret: ${{ steps.generate_token.outputs.token }} + issue-title: "Release Approval for ${{ github.ref_name }}" + issue-body: "Please approve this release to publish to PyPI and Docker." + approvers: sgerlach,kcberg,danielhopkins,clamey,Bwvolleyball + minimum-approvals: 1 + mode: issue + fail-on-denial: true + publish-pypi: name: Publish to PyPI runs-on: ubuntu-latest environment: pypi + needs: approval steps: - uses: actions/checkout@v4 with: @@ -25,6 +47,19 @@ jobs: run: | python -m pip install --upgrade pip pip install build bumpver + - name: Generate GitHub App token + id: generate_token + uses: tibdex/github-app-token@v2 + with: + app_id: ${{ secrets.HAWKY_APP_ID }} + private_key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} + - name: Set up git for pushing + run: | + git remote set-url origin https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git + - name: Set git user for HawkyMcBuilderFace bot + run: | + git config user.name "HawkyMcBuilderFace[bot]" + git config user.email "222944+HawkyMcBuilderFace[bot]@users.noreply.github.com" - name: Set version from tag run: | TAG_NAME=${GITHUB_REF#refs/tags/v} @@ -39,10 +74,24 @@ jobs: publish-docker: name: Publish Docker image runs-on: ubuntu-latest + needs: approval steps: - uses: actions/checkout@v4 with: fetch-depth: 0 + - name: Generate GitHub App token + id: generate_token + uses: tibdex/github-app-token@v2 + with: + app_id: ${{ secrets.HAWKY_APP_ID }} + private_key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} + - name: Set up git for pushing + run: | + git remote set-url origin https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git + - name: Set git user for HawkyMcBuilderFace bot + run: | + git config user.name "HawkyMcBuilderFace[bot]" + git config user.email "222944+HawkyMcBuilderFace[bot]@users.noreply.github.com" - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx From e810fe31913e40c9e68a64b28554b7354224a4bd Mon Sep 17 00:00:00 2001 From: KC Berg Date: Tue, 8 Jul 2025 17:19:13 -0600 Subject: [PATCH 3/3] refactor: decouple tagging and publishing in release workflow, ensure approval and parallel publish from tag --- .github/workflows/release.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f4f884..b507773 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,14 +30,30 @@ jobs: mode: issue fail-on-denial: true + tag: + name: Confirm Tag Exists + runs-on: ubuntu-latest + needs: approval + steps: + - name: Generate GitHub App token + id: generate_token + uses: tibdex/github-app-token@v2 + with: + app_id: ${{ secrets.HAWKY_APP_ID }} + private_key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} + - name: Confirm release tag exists + run: | + echo "Release tag is ${{ github.ref }}" + publish-pypi: name: Publish to PyPI runs-on: ubuntu-latest environment: pypi - needs: approval + needs: tag steps: - uses: actions/checkout@v4 with: + ref: ${{ github.ref }} fetch-depth: 0 - name: Set up Python uses: actions/setup-python@v5 @@ -74,10 +90,11 @@ jobs: publish-docker: name: Publish Docker image runs-on: ubuntu-latest - needs: approval + needs: tag steps: - uses: actions/checkout@v4 with: + ref: ${{ github.ref }} fetch-depth: 0 - name: Generate GitHub App token id: generate_token