From 4fe218c30582cacf355e0c3b44857f8eb7d0afa8 Mon Sep 17 00:00:00 2001 From: Snehil Kishore Date: Tue, 29 Oct 2024 15:56:53 +0530 Subject: [PATCH] Changing Release Workflow --- .github/actions/get-prerelease/action.yml | 30 ++++++++ .github/actions/get-release-notes/action.yml | 42 +++++++++++ .github/actions/get-version/action.yml | 21 ++++++ .github/actions/release-create/action.yml | 47 +++++++++++++ .github/actions/rubygems-publish/action.yml | 30 ++++++++ .github/actions/tag-exists/action.yml | 36 ++++++++++ .github/workflows/publish.yml | 31 +++------ .github/workflows/rl-scanner.yml | 9 +-- .github/workflows/ruby-release.yml | 73 ++++++++++++++++++++ .version | 1 + 10 files changed, 294 insertions(+), 26 deletions(-) create mode 100644 .github/actions/get-prerelease/action.yml create mode 100644 .github/actions/get-release-notes/action.yml create mode 100644 .github/actions/get-version/action.yml create mode 100644 .github/actions/release-create/action.yml create mode 100644 .github/actions/rubygems-publish/action.yml create mode 100644 .github/actions/tag-exists/action.yml create mode 100644 .github/workflows/ruby-release.yml create mode 100644 .version diff --git a/.github/actions/get-prerelease/action.yml b/.github/actions/get-prerelease/action.yml new file mode 100644 index 0000000..131f93d --- /dev/null +++ b/.github/actions/get-prerelease/action.yml @@ -0,0 +1,30 @@ +name: Return a boolean indicating if the version contains prerelease identifiers + +# +# Returns a simple true/false boolean indicating whether the version indicates it's a prerelease or not. +# +# TODO: Remove once the common repo is public. +# + +inputs: + version: + required: true + +outputs: + prerelease: + value: ${{ steps.get_prerelease.outputs.PRERELEASE }} + +runs: + using: composite + + steps: + - id: get_prerelease + shell: bash + run: | + if [[ "${VERSION}" == *"beta"* || "${VERSION}" == *"alpha"* ]]; then + echo "PRERELEASE=true" >> $GITHUB_OUTPUT + else + echo "PRERELEASE=false" >> $GITHUB_OUTPUT + fi + env: + VERSION: ${{ inputs.version }} \ No newline at end of file diff --git a/.github/actions/get-release-notes/action.yml b/.github/actions/get-release-notes/action.yml new file mode 100644 index 0000000..5ce3f92 --- /dev/null +++ b/.github/actions/get-release-notes/action.yml @@ -0,0 +1,42 @@ +name: Return the release notes extracted from the PR body + +# +# Returns the release notes from the content of a pull request linked to a release branch. It expects the branch name to be in the format release/vX.Y.Z, release/X.Y.Z, release/vX.Y.Z-beta.N. etc. +# +# TODO: Remove once the common repo is public. +# +inputs: + version: + required: true + repo_name: + required: false + repo_owner: + required: true + token: + required: true + +outputs: + release-notes: + value: ${{ steps.get_release_notes.outputs.RELEASE_NOTES }} + +runs: + using: composite + + steps: + - uses: actions/github-script@v7 + id: get_release_notes + with: + result-encoding: string + script: | + const { data: pulls } = await github.rest.pulls.list({ + owner: process.env.REPO_OWNER, + repo: process.env.REPO_NAME, + state: 'all', + head: `${process.env.REPO_OWNER}:release/${process.env.VERSION}`, + }); + core.setOutput('RELEASE_NOTES', pulls[0].body); + env: + GITHUB_TOKEN: ${{ inputs.token }} + REPO_OWNER: ${{ inputs.repo_owner }} + REPO_NAME: ${{ inputs.repo_name }} + VERSION: ${{ inputs.version }} \ No newline at end of file diff --git a/.github/actions/get-version/action.yml b/.github/actions/get-version/action.yml new file mode 100644 index 0000000..84814a3 --- /dev/null +++ b/.github/actions/get-version/action.yml @@ -0,0 +1,21 @@ +name: Return the version extracted from the branch name + +# +# Returns the version from the .version file. +# +# TODO: Remove once the common repo is public. +# + +outputs: + version: + value: ${{ steps.get_version.outputs.VERSION }} + +runs: + using: composite + + steps: + - id: get_version + shell: bash + run: | + VERSION=$(head -1 .version) + echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT \ No newline at end of file diff --git a/.github/actions/release-create/action.yml b/.github/actions/release-create/action.yml new file mode 100644 index 0000000..a0db443 --- /dev/null +++ b/.github/actions/release-create/action.yml @@ -0,0 +1,47 @@ +name: Create a GitHub release + +# +# Creates a GitHub release with the given version. +# +# TODO: Remove once the common repo is public. +# + +inputs: + token: + required: true + files: + required: false + name: + required: true + body: + required: true + tag: + required: true + commit: + required: true + draft: + default: false + required: false + prerelease: + default: false + required: false + fail_on_unmatched_files: + default: true + required: false + +runs: + using: composite + + steps: + - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 + with: + body: ${{ inputs.body }} + name: ${{ inputs.name }} + tag_name: ${{ inputs.tag }} + target_commitish: ${{ inputs.commit }} + draft: ${{ inputs.draft }} + prerelease: ${{ inputs.prerelease }} + fail_on_unmatched_files: ${{ inputs.fail_on_unmatched_files }} + files: ${{ inputs.files }} + env: + GITHUB_TOKEN: ${{ inputs.token }} \ No newline at end of file diff --git a/.github/actions/rubygems-publish/action.yml b/.github/actions/rubygems-publish/action.yml new file mode 100644 index 0000000..e7ea970 --- /dev/null +++ b/.github/actions/rubygems-publish/action.yml @@ -0,0 +1,30 @@ +name: Publishes to RubyGems + +# +# Publishes to RubyGems +# +# TODO: Remove once the common repo is public. +# + +inputs: + rubygems-token: + required: true + ruby-version: + required: true + +runs: + using: composite + + steps: + - name: Configure Ruby + uses: ./.github/actions/setup + with: + ruby: ${{ inputs.ruby-version }} + + - name: Publish to RubyGems + shell: bash + run: | + gem build *.gemspec + gem push *.gem + env: + GEM_HOST_API_KEY: ${{ inputs.rubygems-token }} \ No newline at end of file diff --git a/.github/actions/tag-exists/action.yml b/.github/actions/tag-exists/action.yml new file mode 100644 index 0000000..b8f33f6 --- /dev/null +++ b/.github/actions/tag-exists/action.yml @@ -0,0 +1,36 @@ +name: Return a boolean indicating if a tag already exists for the repository + +# +# Returns a simple true/false boolean indicating whether the tag exists or not. +# +# TODO: Remove once the common repo is public. +# + +inputs: + token: + required: true + tag: + required: true + +outputs: + exists: + description: 'Whether the tag exists or not' + value: ${{ steps.tag-exists.outputs.EXISTS }} + +runs: + using: composite + + steps: + - id: tag-exists + shell: bash + run: | + GET_API_URL="https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG_NAME}" + http_status_code=$(curl -LI $GET_API_URL -o /dev/null -w '%{http_code}\n' -s -H "Authorization: token ${GITHUB_TOKEN}") + if [ "$http_status_code" -ne "404" ] ; then + echo "EXISTS=true" >> $GITHUB_OUTPUT + else + echo "EXISTS=false" >> $GITHUB_OUTPUT + fi + env: + TAG_NAME: ${{ inputs.tag }} + GITHUB_TOKEN: ${{ inputs.token }} \ No newline at end of file diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index dc12a0f..8926584 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,9 +7,14 @@ on: description: The branch to release from. required: true default: master + push: + branches: + - 'adding-reversing-labs-scanner' + permissions: contents: read + id-token: write # This is required for requesting the JWT jobs: rl-scanner: @@ -25,26 +30,12 @@ jobs: PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} publish: - name: Publish to RubyGems + uses: ./.github/workflows/ruby-release.yml needs: rl-scanner runs-on: ubuntu-latest environment: release - - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - ref: ${{ github.event.inputs.branch }} - - - name: Configure Ruby - uses: ./.github/actions/setup - with: - ruby: 3.2 - - - name: Publish to RubyGems - run: | - gem build *.gemspec - gem push *.gem - env: - GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}} + with: + ruby-version: 3.2 + secrets: + github-token: ${{ secrets.GITHUB_TOKEN }} + rubygems-token: ${{ secrets.RUBYGEMS_AUTH_TOKEN }} diff --git a/.github/workflows/rl-scanner.yml b/.github/workflows/rl-scanner.yml index c17b30a..6efcba4 100644 --- a/.github/workflows/rl-scanner.yml +++ b/.github/workflows/rl-scanner.yml @@ -22,15 +22,10 @@ on: jobs: rl-scanner: - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) runs-on: ubuntu-latest outputs: scan-status: ${{ steps.rl-scan-conclusion.outcome }} - permissions: - pull-requests: write - id-token: write # This is required for requesting the JWT - steps: - name: Checkout code uses: actions/checkout@v4 @@ -47,6 +42,8 @@ jobs: shell: bash run: | gem build *.gemspec + export GEM_FILE=$(ls *.gem) + echo "gem_file=$GEM_FILE" >> $GITHUB_ENV - name: Get Artifact Version id: get_version @@ -56,7 +53,7 @@ jobs: id: rl-scan-conclusion uses: ./.github/actions/rl-scanner with: - artifact-path: "$(pwd)/*.gem" + artifact-path: "$(pwd)/${{ env.gem_file }}" version: "${{ steps.get_version.outputs.version }}" env: RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} diff --git a/.github/workflows/ruby-release.yml b/.github/workflows/ruby-release.yml new file mode 100644 index 0000000..702a910 --- /dev/null +++ b/.github/workflows/ruby-release.yml @@ -0,0 +1,73 @@ +name: Create Release + +on: + workflow_call: + inputs: + ruby-version: + required: true + type: string + secrets: + github-token: + required: true + rubygems-token: + required: true + +jobs: + release: + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) + runs-on: ubuntu-latest + environment: release + + steps: + # Checkout the code + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + ref: ${{ github.event.inputs.branch }} + + # Get the version from the branch name + - id: get_version + uses: ./.github/actions/get-version + + # Get the prerelease flag from the branch name + - id: get_prerelease + uses: ./.github/actions/get-prerelease + with: + version: ${{ steps.get_version.outputs.version }} + + # Get the release notes + # This will expose the release notes as env.RELEASE_NOTES + - id: get_release_notes + uses: ./.github/actions/get-release-notes + with: + token: ${{ secrets.github-token }} + version: ${{ steps.get_version.outputs.version }} + repo_owner: ${{ github.repository_owner }} + repo_name: ${{ github.event.repository.name }} + + # Check if the tag already exists + - id: tag_exists + uses: ./.github/actions/tag-exists + with: + tag: ${{ steps.get_version.outputs.version }} + token: ${{ secrets.github-token }} + + # If the tag already exists, exit with an error + - if: steps.tag_exists.outputs.exists == 'true' + run: exit 1 + + # Publish the release to our package manager + - uses: ./.github/actions/rubygems-publish + with: + ruby-version: ${{ inputs.ruby-version }} + rubygems-token: ${{ secrets.rubygems-token }} + + # Create a release for the tag + - uses: ./.github/actions/release-create + with: + token: ${{ secrets.github-token }} + name: ${{ steps.get_version.outputs.version }} + body: ${{ steps.get_release_notes.outputs.release-notes }} + tag: ${{ steps.get_version.outputs.version }} + commit: ${{ github.sha }} + prerelease: ${{ steps.get_prerelease.outputs.prerelease }} diff --git a/.version b/.version new file mode 100644 index 0000000..50e47c8 --- /dev/null +++ b/.version @@ -0,0 +1 @@ +3.1.1 \ No newline at end of file