ci: upgrade release please action to v5 (#548) #428
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # NOTE: After a release is published, remember to update internal version registries | |
| # with the new version numbers. | |
| name: Release Please | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| force_cloudflare_deploy: | |
| description: 'Force publish the cloudflare deployer image (use when release tag was created but publish job was skipped)' | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| confidence_resolver_release_created: ${{ steps.releasemanifest.outputs['confidence-resolver--release_created'] }} | |
| cloudflare_resolver_release_created: ${{ steps.releasemanifest.outputs['confidence-cloudflare-resolver--release_created'] }} | |
| java_provider_release_created: ${{ steps.releasemanifest.outputs['openfeature-provider/java--release_created'] }} | |
| js_provider_release_created: ${{ steps.releasemanifest.outputs['openfeature-provider/js--release_created'] }} | |
| ruby_provider_release_created: ${{ steps.releasemanifest.outputs['openfeature-provider/ruby--release_created'] }} | |
| rust_provider_release_created: ${{ steps.releasemanifest.outputs['openfeature-provider/rust--release_created'] }} | |
| python_provider_release_created: ${{ steps.releasemanifest.outputs['openfeature-provider/python--release_created'] }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Release Please (manifest) | |
| id: releasemanifest | |
| uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| publish-cloudflare-deployer-image: | |
| needs: release | |
| if: ${{ needs.release.outputs.cloudflare_resolver_release_created == 'true' || inputs.force_cloudflare_deploy == true }} | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| include: | |
| - platform: linux/amd64 | |
| runner: ubuntu-latest | |
| - platform: linux/arm64 | |
| runner: ubuntu-24.04-arm | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push by digest | |
| id: build | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: confidence-cloudflare-resolver.deployer | |
| build-args: | | |
| COMMIT_SHA=${{ github.sha }} | |
| platforms: ${{ matrix.platform }} | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| outputs: type=image,name=ghcr.io/${{ github.repository_owner }}/confidence-cloudflare-deployer,push-by-digest=true,name-canonical=true,push=true | |
| - name: Export digest | |
| run: | | |
| mkdir -p $RUNNER_TEMP/digests | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "$RUNNER_TEMP/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: deployer-digest-${{ matrix.runner }} | |
| path: ${{ runner.temp }}/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| publish-cloudflare-deployer-manifest: | |
| needs: [release, publish-cloudflare-deployer-image] | |
| if: ${{ needs.release.outputs.cloudflare_resolver_release_created == 'true' || inputs.force_cloudflare_deploy == true }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Extract confidence-cloudflare-resolver version and tag | |
| id: extract_ccr_version | |
| run: | | |
| VERSION=$(grep -m1 '^version\s*=\s*"' confidence-cloudflare-resolver/Cargo.toml | sed -E 's/.*"([^\"]+)".*/\1/') | |
| echo "CCR_VERSION=$VERSION" >> $GITHUB_ENV | |
| echo "CCR_TAG_NAME=confidence-cloudflare-resolver-v$VERSION" >> $GITHUB_ENV | |
| - name: Download digests | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| path: ${{ runner.temp }}/digests | |
| pattern: deployer-digest-* | |
| merge-multiple: true | |
| - name: Log in to GHCR | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6 | |
| with: | |
| images: ghcr.io/${{ github.repository_owner }}/confidence-cloudflare-deployer | |
| tags: | | |
| type=raw,value=${{ env.CCR_TAG_NAME }} | |
| type=raw,value=latest | |
| - name: Create manifest list and push | |
| working-directory: ${{ runner.temp }}/digests | |
| run: | | |
| docker buildx imagetools create \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf 'ghcr.io/${{ github.repository_owner }}/confidence-cloudflare-deployer@sha256:%s ' *) | |
| publish-java-provider-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| if: ${{ needs.release.outputs.java_provider_release_created == 'true' }} | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Construct Maven settings file | |
| run: | | |
| cat > /tmp/maven_settings.xml <<'EOF' | |
| <?xml version="1.0" encoding="UTF-8"?> | |
| <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" | |
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | |
| xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 | |
| http://maven.apache.org/xsd/settings-1.0.0.xsd"> | |
| <servers> | |
| <server> | |
| <id>central</id> | |
| <username>${{ secrets.MAVEN_CENTRAL_USERNAME }}</username> | |
| <password>${{ secrets.MAVEN_CENTRAL_PASSWORD }}</password> | |
| </server> | |
| </servers> | |
| </settings> | |
| EOF | |
| - name: Write GPG key and passphrase to files | |
| run: | | |
| echo "${{ secrets.GPG_PRIVATE_KEY }}" > /tmp/gpg_private_key.asc | |
| echo "${{ secrets.SIGN_KEY_PASS }}" > /tmp/gpg_pass.txt | |
| - name: Publish Java package with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: openfeature-provider-java.publish | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| secret-files: | | |
| maven_settings=/tmp/maven_settings.xml | |
| gpg_private_key=/tmp/gpg_private_key.asc | |
| gpg_pass=/tmp/gpg_pass.txt | |
| publish-js-provider-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| permissions: | |
| id-token: write # Required for npm OIDC publishing | |
| contents: read | |
| if: ${{ needs.release.outputs.js_provider_release_created == 'true' }} | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Build and extract package tarball with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: openfeature-provider-js.artifact | |
| outputs: type=local,dest=./artifacts | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: '22' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install npm with trusted publishing support | |
| run: npm install -g npm@11.19.0 | |
| - name: Publish to npm with OIDC | |
| run: npm publish ./artifacts/package.tgz --provenance --access public | |
| publish-ruby-provider-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| permissions: | |
| contents: read | |
| if: ${{ needs.release.outputs.ruby_provider_release_created == 'true' }} | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Write RubyGems API key to file | |
| run: | | |
| echo "${{ secrets.RUBYGEM_API_KEY }}" > /tmp/rubygem_api_key.txt | |
| - name: Publish Ruby gem with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: openfeature-provider-ruby.publish | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| secret-files: | | |
| rubygem_api_key=/tmp/rubygem_api_key.txt | |
| publish-confidence-resolver-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| if: ${{ needs.release.outputs.confidence_resolver_release_created == 'true' }} | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Write crates.io token to file | |
| run: | | |
| echo "${{ secrets.CRATES_IO_TOKEN }}" > /tmp/crates_io_token.txt | |
| - name: Publish confidence-resolver with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: confidence-resolver.publish | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| secret-files: | | |
| crates_io_token=/tmp/crates_io_token.txt | |
| publish-rust-provider-release: | |
| needs: [release, publish-confidence-resolver-release] | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| if: | | |
| always() && | |
| needs.release.outputs.rust_provider_release_created == 'true' && | |
| (needs.publish-confidence-resolver-release.result == 'success' || needs.publish-confidence-resolver-release.result == 'skipped') | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Write crates.io token to file | |
| run: | | |
| echo "${{ secrets.CRATES_IO_TOKEN }}" > /tmp/crates_io_token.txt | |
| - name: Wait for crates.io index update | |
| if: ${{ needs.publish-confidence-resolver-release.result == 'success' }} | |
| run: sleep 30 | |
| - name: Publish Rust provider with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: openfeature-provider-rust.publish | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| secret-files: | | |
| crates_io_token=/tmp/crates_io_token.txt | |
| publish-python-provider-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| environment: deployment | |
| permissions: | |
| id-token: write # Required for PyPI OIDC trusted publishing | |
| contents: read | |
| if: ${{ needs.release.outputs.python_provider_release_created == 'true' }} | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Build and extract package with Docker | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 | |
| with: | |
| context: . | |
| target: openfeature-provider-python.artifact | |
| outputs: type=local,dest=./artifacts | |
| cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main | |
| provenance: false | |
| - name: List artifacts | |
| run: ls -la ./artifacts/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | |
| with: | |
| packages-dir: ./artifacts/ |