Hugh Hackman
ca5ab75f6b
pnpm/action-setup@v4 errors with ERR_PNPM_BAD_PM_VERSION when both `version` (in the workflow) and `packageManager` (in package.json) are specified. Remove the hardcoded `version: latest` from plugin-release so that repos can pin their pnpm version via the packageManager field in package.json. When packageManager is absent the action falls back to latest (same prior behavior). When packageManager is set it is used exclusively, which prevents silent version drift. The plugin-ci.yaml change is handled separately in PR #54. Co-Authored-By: Paperclip <noreply@paperclip.ing>
252 lines
8.9 KiB
YAML
252 lines
8.9 KiB
YAML
name: Plugin Release
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
version:
|
|
description: 'Release version (e.g. 1.0.0)'
|
|
required: true
|
|
type: string
|
|
node-version:
|
|
description: 'Node.js version to use'
|
|
required: false
|
|
type: string
|
|
default: '22'
|
|
upstream-repo:
|
|
description: 'Upstream repo to fetch appVersion from (e.g. fenio/tns-csi). Leave empty to skip.'
|
|
required: false
|
|
type: string
|
|
default: ''
|
|
secrets:
|
|
RELEASE_APP_ID:
|
|
description: 'GitHub App ID for creating PRs (org blocks GITHUB_TOKEN from creating PRs)'
|
|
required: true
|
|
RELEASE_APP_PRIVATE_KEY:
|
|
description: 'GitHub App private key (PEM format)'
|
|
required: true
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
check-secrets:
|
|
runs-on: runners-privilegedescalation
|
|
outputs:
|
|
ready: ${{ steps.check.outputs.ready }}
|
|
steps:
|
|
- name: Verify RELEASE_APP_ID is configured
|
|
id: check
|
|
env:
|
|
RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
|
|
run: |
|
|
if [ -z "$RELEASE_APP_ID" ]; then
|
|
echo "::notice::RELEASE_APP_ID org secret is not configured (see PRI-380). Release skipped — no artifacts will be created."
|
|
echo "ready=false" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "ready=true" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
ci:
|
|
needs: check-secrets
|
|
if: needs.check-secrets.outputs.ready == 'true'
|
|
uses: ./.github/workflows/plugin-ci.yaml
|
|
with:
|
|
node-version: ${{ inputs.node-version }}
|
|
|
|
check-tag:
|
|
needs: check-secrets
|
|
if: needs.check-secrets.outputs.ready == 'true'
|
|
runs-on: runners-privilegedescalation
|
|
outputs:
|
|
skip: ${{ steps.check.outputs.skip }}
|
|
steps:
|
|
- name: Check if tag already exists
|
|
id: check
|
|
run: |
|
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
|
-H "Authorization: Bearer ${{ github.token }}" \
|
|
"https://api.github.com/repos/${{ github.repository }}/git/refs/tags/v${{ inputs.version }}")
|
|
if [ "$HTTP_CODE" = "200" ]; then
|
|
echo "::notice::Tag v${{ inputs.version }} already exists. Release skipped (not an error)."
|
|
echo "skip=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "skip=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
release:
|
|
needs: [ci, check-tag, check-secrets]
|
|
if: needs.check-secrets.outputs.ready == 'true' && needs.check-tag.outputs.skip != 'true'
|
|
runs-on: runners-privilegedescalation
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Validate version format
|
|
run: |
|
|
if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "Error: Version must be in X.Y.Z format"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Detect package manager
|
|
id: pkg-manager
|
|
run: |
|
|
if [ -f "pnpm-lock.yaml" ]; then
|
|
echo "manager=pnpm" >> $GITHUB_OUTPUT
|
|
echo "lockfile=pnpm-lock.yaml" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "manager=npm" >> $GITHUB_OUTPUT
|
|
echo "lockfile=package-lock.json" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Setup pnpm
|
|
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
run_install: false
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ inputs.node-version }}
|
|
cache: ${{ steps.pkg-manager.outputs.manager }}
|
|
|
|
- name: Configure Git
|
|
run: |
|
|
git config --global user.name "github-actions[bot]"
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
|
|
- name: Update version in package.json
|
|
run: |
|
|
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
|
pnpm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
|
|
else
|
|
npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
|
|
fi
|
|
|
|
- name: Update artifacthub-pkg.yml
|
|
run: |
|
|
VERSION="${{ inputs.version }}"
|
|
PKG_NAME=$(jq -r .name package.json)
|
|
RELEASE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/${PKG_NAME}-${VERSION}.tar.gz"
|
|
sed -i "s/^version:.*/version: \"${VERSION}\"/" artifacthub-pkg.yml
|
|
sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"${RELEASE_URL}\"|" artifacthub-pkg.yml
|
|
|
|
- name: Update appVersion from upstream release
|
|
if: inputs.upstream-repo != ''
|
|
run: |
|
|
APP_VERSION=$(curl -sf "https://api.github.com/repos/${{ inputs.upstream-repo }}/releases/latest" | jq -r '.tag_name | ltrimstr("v")')
|
|
if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "null" ]; then
|
|
echo "::warning::Could not fetch latest upstream release, skipping appVersion update"
|
|
else
|
|
sed -i "s|^appVersion:.*|appVersion: \"${APP_VERSION}\"|" artifacthub-pkg.yml
|
|
echo "appVersion set to ${APP_VERSION}"
|
|
fi
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
|
pnpm install --frozen-lockfile
|
|
else
|
|
npm ci
|
|
fi
|
|
|
|
- name: Build plugin
|
|
run: npx @kinvolk/headlamp-plugin build
|
|
|
|
- name: Package plugin
|
|
run: npx @kinvolk/headlamp-plugin package
|
|
|
|
- name: Prepare release tarball
|
|
run: |
|
|
VERSION="${{ inputs.version }}"
|
|
PKG_NAME=$(jq -r .name package.json)
|
|
TARBALL="${PKG_NAME}-${VERSION}.tar.gz"
|
|
# Rename tarball if headlamp-plugin produced a different name
|
|
for f in *.tar.gz; do
|
|
[ "$f" != "$TARBALL" ] && mv "$f" "$TARBALL"
|
|
done
|
|
if [ ! -f "$TARBALL" ]; then
|
|
echo "Error: Expected tarball $TARBALL not found"
|
|
ls -la *.tar.gz 2>/dev/null || echo "No .tar.gz files found"
|
|
exit 1
|
|
fi
|
|
echo "TARBALL=$TARBALL" >> $GITHUB_ENV
|
|
echo "PKG_NAME=$PKG_NAME" >> $GITHUB_ENV
|
|
|
|
- name: Validate tarball
|
|
run: |
|
|
echo "Tarball: ${{ env.TARBALL }}"
|
|
ls -lh "${{ env.TARBALL }}"
|
|
tar -tzf "${{ env.TARBALL }}" | head -20
|
|
tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || { echo "Error: main.js not found in tarball"; exit 1; }
|
|
|
|
- name: Compute checksum
|
|
run: |
|
|
CHECKSUM=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
|
|
echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
|
|
sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
|
|
|
|
- name: Commit and tag
|
|
run: |
|
|
VERSION="${{ inputs.version }}"
|
|
BRANCH="release/v${VERSION}"
|
|
git checkout -b "$BRANCH"
|
|
git add package.json "${{ steps.pkg-manager.outputs.lockfile }}" artifacthub-pkg.yml
|
|
git commit -m "release: v${VERSION}"
|
|
git tag "v${VERSION}"
|
|
git push origin "$BRANCH" --tags
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: "v${{ inputs.version }}"
|
|
files: ${{ env.TARBALL }}
|
|
fail_on_unmatched_files: true
|
|
generate_release_notes: true
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Generate GitHub App token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@v1
|
|
with:
|
|
app-id: ${{ secrets.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
|
|
- name: Install GitHub CLI
|
|
run: |
|
|
if ! command -v gh &>/dev/null; then
|
|
GH_VERSION="2.74.0"
|
|
curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz" -o /tmp/gh.tar.gz
|
|
tar -xzf /tmp/gh.tar.gz -C /tmp
|
|
mkdir -p "$HOME/.local/bin"
|
|
mv "/tmp/gh_${GH_VERSION}_linux_amd64/bin/gh" "$HOME/.local/bin/gh"
|
|
rm -rf /tmp/gh.tar.gz "/tmp/gh_${GH_VERSION}_linux_amd64"
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
"$HOME/.local/bin/gh" --version
|
|
fi
|
|
|
|
- name: Create PR for version bump
|
|
run: |
|
|
VERSION="${{ inputs.version }}"
|
|
BODY=$(printf "Automated version bump and checksum update for v%s.\n\ncc @cpfarhood" "${VERSION}")
|
|
gh pr create \
|
|
--title "release: v${VERSION}" \
|
|
--body "$BODY" \
|
|
--base main \
|
|
--head "release/v${VERSION}"
|
|
gh pr merge "release/v${VERSION}" --auto --squash --delete-branch
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|