initial commit
This commit is contained in:
195
.github/workflows/publish.yml
vendored
Normal file
195
.github/workflows/publish.yml
vendored
Normal file
@@ -0,0 +1,195 @@
|
||||
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
|
||||
name: Publish
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
version:
|
||||
required: true
|
||||
type: string
|
||||
isPrerelease:
|
||||
required: true
|
||||
type: boolean
|
||||
skipGoSdk:
|
||||
default: false
|
||||
type: boolean
|
||||
description: Skip publishing & verifying the Go SDK
|
||||
skipJavaSdk:
|
||||
default: false
|
||||
type: boolean
|
||||
description: Skip publishing the Java SDK
|
||||
|
||||
env:
|
||||
IS_PRERELEASE: ${{ inputs.isPrerelease }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
||||
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
|
||||
NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
|
||||
PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
|
||||
PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
|
||||
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
|
||||
PULUMI_API: https://api.pulumi-staging.io
|
||||
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
|
||||
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
|
||||
PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
|
||||
PYPI_USERNAME: __token__
|
||||
SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
|
||||
SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
|
||||
SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
|
||||
TF_APPEND_USER_AGENT: pulumi
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
name: publish
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Validate prerelease
|
||||
if: inputs.isPrerelease == false && (contains(inputs.version, '-') || contains(inputs.version, '+'))
|
||||
run: echo "Can't publish a prerelease version as a stable release. This is likely a bug in the calling workflow." && exit 1
|
||||
- name: Validate skipGoSdk
|
||||
if: inputs.skipGoSdk && inputs.isPrerelease == false
|
||||
run: echo "Can't skip Go SDK for stable releases. This is likely a bug in the calling workflow." && exit 1
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Setup tools
|
||||
uses: ./.github/actions/setup-tools
|
||||
with:
|
||||
tools: pulumictl, pulumicli, go, schema-tools
|
||||
cache-go: false
|
||||
- name: Create dist directory
|
||||
run: mkdir -p dist
|
||||
- name: Download provider assets
|
||||
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
|
||||
with:
|
||||
pattern: pulumi-resource-xyz-v${{ inputs.version }}-*
|
||||
path: dist
|
||||
# Don't create a directory for each artifact
|
||||
merge-multiple: true
|
||||
- name: Download schema
|
||||
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
|
||||
with:
|
||||
# Use a pattern to avoid failing if the artifact doesn't exist
|
||||
pattern: schema-embed.*
|
||||
# Avoid creating directories for each artifact
|
||||
merge-multiple: true
|
||||
path: dist
|
||||
- name: Calculate checksums
|
||||
working-directory: dist
|
||||
run: shasum ./*.tar.gz > "pulumi-xyz_${{ inputs.version }}_checksums.txt"
|
||||
- name: Get Schema Change Summary
|
||||
id: schema-summary
|
||||
shell: bash
|
||||
run: |
|
||||
# Get latest stable release. Return only first column from result (tag).
|
||||
LAST_VERSION=$(gh release view --repo pulumi/pulumi-xyz --json tagName -q .tagName || echo "No stable release" )
|
||||
{
|
||||
echo 'summary<<EOF'
|
||||
if [[ "$LAST_VERSION" != "No stable release" ]]; then
|
||||
schema-tools compare --provider="xyz" --old-commit="$LAST_VERSION" --repository="github://api.github.com/pulumi" --new-commit="--local-path=provider/cmd/pulumi-resource-xyz/schema.json"
|
||||
fi
|
||||
echo 'EOF'
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
- name: Create GH Release
|
||||
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
|
||||
if: inputs.isPrerelease == false
|
||||
with:
|
||||
tag_name: v${{ inputs.version }}
|
||||
prerelease: ${{ inputs.isPrerelease }}
|
||||
# We keep pre-releases as drafts so they're not visible until we manually publish them.
|
||||
draft: ${{ inputs.isPrerelease }}
|
||||
body: ${{ steps.schema-summary.outputs.summary }}
|
||||
generate_release_notes: true
|
||||
files: dist/*
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
publish_sdk:
|
||||
name: publish_sdk
|
||||
needs: publish
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
python_version: ${{ steps.python_version.outputs.version }}
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
# Persist credentials so we can push back to the repo
|
||||
persist-credentials: true
|
||||
- name: Setup tools
|
||||
uses: ./.github/actions/setup-tools
|
||||
with:
|
||||
tools: pulumictl, pulumicli, dotnet, go, nodejs, python
|
||||
cache-go: false
|
||||
- name: Publish SDKs
|
||||
if: inputs.skipJavaSdk == false
|
||||
uses: pulumi/pulumi-package-publisher@696a0fe98f86d86ada2a842d1859f3e8c40d6cd7 # v0.0.21
|
||||
with:
|
||||
sdk: all,!java
|
||||
version: ${{ inputs.version }}
|
||||
- name: Publish SDKs (except Java)
|
||||
if: inputs.skipJavaSdk == true
|
||||
uses: pulumi/pulumi-package-publisher@696a0fe98f86d86ada2a842d1859f3e8c40d6cd7 # v0.0.21
|
||||
with:
|
||||
sdk: all,!java,!java
|
||||
version: ${{ inputs.version }}
|
||||
- name: Download Go SDK
|
||||
uses: ./.github/actions/download-sdk
|
||||
with:
|
||||
language: go
|
||||
- uses: pulumi/publish-go-sdk-action@v1
|
||||
if: inputs.skipGoSdk == false
|
||||
with:
|
||||
repository: ${{ github.repository }}
|
||||
base-ref: ${{ github.sha }}
|
||||
source: sdk
|
||||
path: sdk
|
||||
version: ${{ inputs.version }}
|
||||
additive: false
|
||||
# Avoid including other language SDKs & artifacts in the commit
|
||||
files: |
|
||||
go.*
|
||||
go/**
|
||||
!*.tar.gz
|
||||
- name: Extract python version
|
||||
id: python_version
|
||||
working-directory: sdk/python
|
||||
run: |
|
||||
pip install toml-cli==0.7.0
|
||||
version=$(toml get --toml-path pyproject.toml project.version)
|
||||
echo "version=${version}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
clean_up_release_labels:
|
||||
name: Clean up release labels
|
||||
# Only run for non-prerelease, if the publish_go_sdk job was successful or skipped
|
||||
if: inputs.isPrerelease == false
|
||||
|
||||
needs: publish_sdk
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Clean up release labels
|
||||
uses: pulumi/action-release-by-pr-label@main
|
||||
with:
|
||||
command: "clean-up-release-labels"
|
||||
repo: ${{ github.repository }}
|
||||
commit: ${{ github.sha }}
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
verify_release:
|
||||
name: verify_release
|
||||
needs: publish_sdk
|
||||
permissions:
|
||||
contents: write
|
||||
id-token: write
|
||||
uses: ./.github/workflows/verify-release.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
providerVersion: ${{ inputs.version }}
|
||||
skipGoSdk: ${{ inputs.skipGoSdk }}
|
||||
pythonVersion: ${{ needs.publish_sdk.outputs.python_version }}
|
||||
Reference in New Issue
Block a user