Merge pull request #120 from open-source-cloud/feat/authoring-tuis #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Single-workflow release (spec 25), built-in GITHUB_TOKEN only — no PAT/App token. | |
| # | |
| # Two entry points, one job: | |
| # • push to main → svu computes the next 0.x version from conventional | |
| # commits and, IF enabled, tags + releases in THIS job. | |
| # • push of a v* tag → a human cut a tag by hand → just run goreleaser. | |
| # | |
| # Tag-compute and goreleaser run together ON PURPOSE: GitHub suppresses workflow | |
| # events triggered by GITHUB_TOKEN, so a tag pushed here does NOT re-trigger this | |
| # workflow (no double release) — which is exactly why a split tag→release setup | |
| # would have needed a separate token. We avoid the token by never depending on | |
| # that re-trigger. | |
| # | |
| # Kill-switch (automated path only): the repository variable RELEASE_ENABLED. | |
| # Unset/anything-but-"true" (the default) ⇒ compute + log, never release. Enable | |
| # once with: gh variable set RELEASE_ENABLED --body true | |
| # A manual `git tag vX.Y.Z && git push` always releases (human pushes are not | |
| # suppressed and are not gated — explicit intent). | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write # tag push + goreleaser GitHub Release, both via GITHUB_TOKEN | |
| id-token: write # keyless cosign signing: mint a GitHub OIDC token for Fulcio | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history + tags for svu + goreleaser | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.25" | |
| check-latest: true | |
| # cosign for KEYLESS release signing (goreleaser's `signs:` block shells it). | |
| # Keyless uses the job's OIDC token (id-token: write above) — no private key. | |
| - uses: sigstore/cosign-installer@v3 | |
| # --- automated path (push to main / workflow_dispatch): compute + tag --- | |
| - name: install svu (pinned) | |
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| run: go install github.com/caarlos0/svu/v3@v3.4.1 | |
| - name: compute next version | |
| id: svu | |
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| run: | | |
| CUR="$(git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0)" | |
| NEXT="$(svu next --v0)" | |
| echo "current=$CUR" >> "$GITHUB_OUTPUT" | |
| echo "next=$NEXT" >> "$GITHUB_OUTPUT" | |
| echo "svu: $CUR -> $NEXT" | |
| - name: 0.x guard (a stray feat!/BREAKING must NEVER yield v1.0.0 while in BETA) | |
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| run: | | |
| case "${{ steps.svu.outputs.next }}" in | |
| v0.*) echo "ok: ${{ steps.svu.outputs.next }} is on the 0.x beta line" ;; | |
| *) echo "::error::refusing non-0.x tag ${{ steps.svu.outputs.next }} while in BETA"; exit 1 ;; | |
| esac | |
| - name: gate + tag (only when enabled + a real bump) | |
| id: gate | |
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| run: | | |
| if [ "${{ vars.RELEASE_ENABLED }}" != "true" ]; then | |
| echo "go=false" >> "$GITHUB_OUTPUT" | |
| echo "releases disabled: set repo variable RELEASE_ENABLED=true to enable (computed ${{ steps.svu.outputs.next }})" | |
| exit 0 | |
| fi | |
| if [ "${{ steps.svu.outputs.next }}" = "${{ steps.svu.outputs.current }}" ]; then | |
| echo "go=false" >> "$GITHUB_OUTPUT" | |
| echo "no release due: no version-bumping commits since ${{ steps.svu.outputs.current }}" | |
| exit 0 | |
| fi | |
| git config user.name "devstack-release[bot]" | |
| git config user.email "release@devstack.local" | |
| git tag "${{ steps.svu.outputs.next }}" | |
| # GITHUB_TOKEN push: does NOT re-trigger this workflow's tag filter (so no | |
| # double release); we run goreleaser below in this same job. | |
| git push origin "${{ steps.svu.outputs.next }}" | |
| echo "go=true" >> "$GITHUB_OUTPUT" | |
| echo "tagged + pushed ${{ steps.svu.outputs.next }}" | |
| # --- release: on a manual tag push, or right after auto-tagging --- | |
| - uses: goreleaser/goreleaser-action@v6 | |
| if: ${{ startsWith(github.ref, 'refs/tags/') || steps.gate.outputs.go == 'true' }} | |
| with: | |
| version: "~> v2" | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |