|
1 | 1 | name: Release |
2 | 2 |
|
| 3 | +# Single-workflow release (spec 25), built-in GITHUB_TOKEN only — no PAT/App token. |
| 4 | +# |
| 5 | +# Two entry points, one job: |
| 6 | +# • push to main → svu computes the next 0.x version from conventional |
| 7 | +# commits and, IF enabled, tags + releases in THIS job. |
| 8 | +# • push of a v* tag → a human cut a tag by hand → just run goreleaser. |
| 9 | +# |
| 10 | +# Tag-compute and goreleaser run together ON PURPOSE: GitHub suppresses workflow |
| 11 | +# events triggered by GITHUB_TOKEN, so a tag pushed here does NOT re-trigger this |
| 12 | +# workflow (no double release) — which is exactly why a split tag→release setup |
| 13 | +# would have needed a separate token. We avoid the token by never depending on |
| 14 | +# that re-trigger. |
| 15 | +# |
| 16 | +# Kill-switch (automated path only): the repository variable RELEASE_ENABLED. |
| 17 | +# Unset/anything-but-"true" (the default) ⇒ compute + log, never release. Enable |
| 18 | +# once with: gh variable set RELEASE_ENABLED --body true |
| 19 | +# A manual `git tag vX.Y.Z && git push` always releases (human pushes are not |
| 20 | +# suppressed and are not gated — explicit intent). |
| 21 | + |
3 | 22 | on: |
4 | 23 | push: |
| 24 | + branches: [main] |
5 | 25 | tags: ["v*"] |
| 26 | + paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] |
| 27 | + workflow_dispatch: {} |
6 | 28 |
|
7 | 29 | permissions: |
8 | | - contents: write # create the GitHub release + upload artifacts |
| 30 | + contents: write # tag push + goreleaser GitHub Release, both via GITHUB_TOKEN |
| 31 | + |
| 32 | +concurrency: |
| 33 | + group: release-${{ github.ref }} |
| 34 | + cancel-in-progress: false |
9 | 35 |
|
10 | 36 | jobs: |
11 | | - goreleaser: |
| 37 | + release: |
12 | 38 | runs-on: ubuntu-latest |
13 | 39 | steps: |
14 | 40 | - uses: actions/checkout@v4 |
15 | 41 | with: |
16 | | - fetch-depth: 0 # goreleaser needs full history + tags |
| 42 | + fetch-depth: 0 # full history + tags for svu + goreleaser |
17 | 43 | - uses: actions/setup-go@v5 |
18 | 44 | with: |
19 | 45 | go-version: "1.25" |
20 | 46 | check-latest: true |
| 47 | + |
| 48 | + # --- automated path (push to main / workflow_dispatch): compute + tag --- |
| 49 | + - name: install svu (pinned) |
| 50 | + if: ${{ !startsWith(github.ref, 'refs/tags/') }} |
| 51 | + run: go install github.com/caarlos0/svu/v3@v3.4.1 |
| 52 | + - name: compute next version |
| 53 | + id: svu |
| 54 | + if: ${{ !startsWith(github.ref, 'refs/tags/') }} |
| 55 | + run: | |
| 56 | + CUR="$(git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0)" |
| 57 | + NEXT="$(svu next --v0)" |
| 58 | + echo "current=$CUR" >> "$GITHUB_OUTPUT" |
| 59 | + echo "next=$NEXT" >> "$GITHUB_OUTPUT" |
| 60 | + echo "svu: $CUR -> $NEXT" |
| 61 | + - name: 0.x guard (a stray feat!/BREAKING must NEVER yield v1.0.0 while in BETA) |
| 62 | + if: ${{ !startsWith(github.ref, 'refs/tags/') }} |
| 63 | + run: | |
| 64 | + case "${{ steps.svu.outputs.next }}" in |
| 65 | + v0.*) echo "ok: ${{ steps.svu.outputs.next }} is on the 0.x beta line" ;; |
| 66 | + *) echo "::error::refusing non-0.x tag ${{ steps.svu.outputs.next }} while in BETA"; exit 1 ;; |
| 67 | + esac |
| 68 | + - name: gate + tag (only when enabled + a real bump) |
| 69 | + id: gate |
| 70 | + if: ${{ !startsWith(github.ref, 'refs/tags/') }} |
| 71 | + run: | |
| 72 | + if [ "${{ vars.RELEASE_ENABLED }}" != "true" ]; then |
| 73 | + echo "go=false" >> "$GITHUB_OUTPUT" |
| 74 | + echo "releases disabled: set repo variable RELEASE_ENABLED=true to enable (computed ${{ steps.svu.outputs.next }})" |
| 75 | + exit 0 |
| 76 | + fi |
| 77 | + if [ "${{ steps.svu.outputs.next }}" = "${{ steps.svu.outputs.current }}" ]; then |
| 78 | + echo "go=false" >> "$GITHUB_OUTPUT" |
| 79 | + echo "no release due: no version-bumping commits since ${{ steps.svu.outputs.current }}" |
| 80 | + exit 0 |
| 81 | + fi |
| 82 | + git config user.name "devstack-release[bot]" |
| 83 | + git config user.email "release@devstack.local" |
| 84 | + git tag "${{ steps.svu.outputs.next }}" |
| 85 | + # GITHUB_TOKEN push: does NOT re-trigger this workflow's tag filter (so no |
| 86 | + # double release); we run goreleaser below in this same job. |
| 87 | + git push origin "${{ steps.svu.outputs.next }}" |
| 88 | + echo "go=true" >> "$GITHUB_OUTPUT" |
| 89 | + echo "tagged + pushed ${{ steps.svu.outputs.next }}" |
| 90 | +
|
| 91 | + # --- release: on a manual tag push, or right after auto-tagging --- |
21 | 92 | - uses: goreleaser/goreleaser-action@v6 |
| 93 | + if: ${{ startsWith(github.ref, 'refs/tags/') || steps.gate.outputs.go == 'true' }} |
22 | 94 | with: |
23 | 95 | version: "~> v2" |
24 | 96 | args: release --clean |
|
0 commit comments