mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
aab12d018e
Tagging v9.0.0-rc.1 produced a startup_failure: the workflow was rejected before any job ran. owncloud pins Actions to an org allowlist (owncloud/admin:actions-allowlist.yml, allowed_actions: selected with sha_pinning_required), and three pins in this file are not on it: docker/setup-buildx-action @f87e5991 v4.4.1 (allowlist has v4.0.0) docker/login-action @dbcb8138 v4.6.0 (allowlist has v4.1.0) docker/build-push-action @c3c9e263 v7.4.0 (allowlist has v7.0.0) Allowlist validation happens at parse time, so it does not care that all three only appear in jobs already marked `if: false`. Rather than pin them back, drop the jobs. Building, scanning and publishing the production image moved to owncloud-docker/ocis, which is why these were disabled in the first place; the image Trivy scan now runs there on every PR. That leaves nothing to maintain here and removes all three offending pins. Removes docker-build, docker-scan (dead too: it needs docker-build), docker-manifest and docker-readme. Nothing outside that subgraph depended on them, so the `docker_repos` and `is_production` outputs, the PRODUCTION_RELEASE_TAGS / DOCKER_REPO_ROLLING / DOCKER_REPO_PRODUCTION env vars and the REPOS computation go with them. is_prerelease stays, as create-github-release still reads it. The filesystem scan in security-scan-trivy is untouched. Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
271 lines
10 KiB
YAML
271 lines
10 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
branches:
|
|
- 'feat/release-pipeline**'
|
|
workflow_dispatch:
|
|
inputs:
|
|
version_override:
|
|
description: 'Version override (leave empty to auto-detect from latest tag)'
|
|
type: string
|
|
default: ''
|
|
|
|
env:
|
|
NODE_VERSION: '24'
|
|
PNPM_VERSION: '10.28.1'
|
|
GOLANG_BUILD_IMAGE: 'golang:1.26.8-alpine3.23@sha256:a8fa79c5bd40d880b52bd3b6d7669ecdcfd00e85facdd427d279efb5ddd79cb1'
|
|
|
|
jobs:
|
|
determine-release-type:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
outputs:
|
|
version: ${{ steps.info.outputs.version }}
|
|
is_prerelease: ${{ steps.info.outputs.is_prerelease }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
if: ${{ github.ref_type == 'branch' || (github.event_name == 'workflow_dispatch' && inputs.version_override == '') }}
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- id: info
|
|
env:
|
|
VERSION_OVERRIDE: ${{ inputs.version_override }}
|
|
run: |
|
|
next_dev() {
|
|
# If latest tag is already a pre-release (e.g. v8.0.2-dev.1), reuse its base
|
|
# version (8.0.2-dev.1) so repeated branch runs don't bump the patch counter.
|
|
# If latest tag is a production release (e.g. v8.0.1), increment patch (8.0.2-dev.1).
|
|
local tag=$(git tag --sort=-version:refname | grep -m1 '^v' || echo "v0.0.0")
|
|
local ver="${tag#v}"
|
|
if [[ "$ver" == *"-"* ]]; then
|
|
echo "${ver%%-*}-dev.1"
|
|
else
|
|
IFS='.' read -r M m p <<< "$ver"
|
|
echo "${M}.${m}.$((p + 1))-dev.1"
|
|
fi
|
|
}
|
|
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
VERSION="$VERSION_OVERRIDE"
|
|
[[ -z "$VERSION" ]] && VERSION=$(next_dev)
|
|
elif [[ "${{ github.ref_type }}" == "branch" ]]; then
|
|
VERSION=$(next_dev)
|
|
else
|
|
VERSION="${GITHUB_REF#refs/tags/v}"
|
|
fi
|
|
|
|
# `version` below is read back by nine `run:` blocks in this file (thirteen
|
|
# interpolations) as ${{ needs.determine-release-type.outputs.version }}, and each
|
|
# of those is substituted into the script text before bash sees it. Refusing
|
|
# anything that is not a version token here is what keeps those nine safe, instead
|
|
# of nine more env: blocks -- and a release version that is not a version token is
|
|
# a bug in its own right.
|
|
if [[ ! "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z.+-]*$ ]]; then
|
|
echo "::error title=Invalid release version::'$VERSION' is not a version string (expected ^[0-9A-Za-z][0-9A-Za-z.+-]*$)"
|
|
exit 1
|
|
fi
|
|
|
|
[[ "$VERSION" == *"-"* ]] && IS_PRERELEASE=true || IS_PRERELEASE=false
|
|
|
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
|
echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT
|
|
|
|
generate-code:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
needs: [determine-release-type]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- run: npm install --silent -g yarn npx --force
|
|
- uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v4
|
|
with:
|
|
version: ${{ env.PNPM_VERSION }}
|
|
- run: pnpm config set store-dir ./.pnpm-store && make ci-node-generate
|
|
env:
|
|
CHROMEDRIVER_SKIP_DOWNLOAD: 'true'
|
|
- run: make ci-go-generate
|
|
env:
|
|
BUF_TOKEN: ${{ secrets.BUF_API_TOKEN }}
|
|
- name: bump LatestTag
|
|
run: |
|
|
VERSION="${{ needs.determine-release-type.outputs.version }}"
|
|
sed -i "s/LatestTag = \".*\"/LatestTag = \"$VERSION\"/" ocis-pkg/version/version.go
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: generated-code
|
|
path: |
|
|
.
|
|
!.git
|
|
!web
|
|
retention-days: 1
|
|
|
|
build-binaries:
|
|
name: build-binaries (${{ matrix.os }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 120
|
|
needs: [determine-release-type, generate-code]
|
|
strategy:
|
|
matrix:
|
|
os: [linux, darwin]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: generated-code
|
|
path: .
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
- run: |
|
|
make -C ocis release-${{ matrix.os }} OUTPUT=${{ needs.determine-release-type.outputs.version }}
|
|
make -C ocis release-finish
|
|
if [[ "${{ matrix.os }}" == "linux" ]]; then
|
|
cp assets/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf ocis/dist/release/
|
|
fi
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: binaries-${{ matrix.os }}
|
|
path: ocis/dist/release/*
|
|
retention-days: 1
|
|
|
|
security-scan-trivy:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
format: table
|
|
exit-code: 1
|
|
severity: CRITICAL,HIGH
|
|
trivy-config: .trivy.yaml
|
|
|
|
license-check:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
needs: [determine-release-type, generate-code]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: generated-code
|
|
path: .
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
- run: npm install --silent -g yarn npx "pnpm@$PNPM_VERSION" --force
|
|
# web is excluded from the generated-code artifact (see generate-code) to
|
|
# avoid OOM on upload, so its node_modules — which provides the
|
|
# license-checker-rseidelsohn binary — must be reinstalled here.
|
|
- run: cd web && pnpm install
|
|
- run: make ci-node-check-licenses && make ci-node-save-licenses
|
|
- run: make ci-go-check-licenses && make ci-go-save-licenses
|
|
- run: tar -czf third-party-licenses.tar.gz -C third-party-licenses .
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: third-party-licenses
|
|
path: third-party-licenses.tar.gz
|
|
retention-days: 1
|
|
|
|
generate-changelog:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
needs: [determine-release-type]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
- run: |
|
|
make changelog CHANGELOG_VERSION=$(echo "${{ needs.determine-release-type.outputs.version }}" | cut -d'-' -f1)
|
|
# calens produces empty output when no versioned changelog directory exists (e.g. dev builds).
|
|
# Fall back to a pointer to the unreleased entries.
|
|
if [[ $(wc -l < ocis/dist/CHANGELOG.md) -lt 5 ]]; then
|
|
echo "Development release — no release notes yet. See [unreleased changes](https://github.com/owncloud/ocis/tree/master/changelog/unreleased/)." > ocis/dist/CHANGELOG.md
|
|
fi
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: changelog
|
|
path: ocis/dist/CHANGELOG.md
|
|
retention-days: 1
|
|
|
|
create-github-release:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
needs: [determine-release-type, build-binaries, license-check, generate-changelog, security-scan-trivy]
|
|
steps:
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-linux
|
|
path: release-assets
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-darwin
|
|
path: release-assets
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: third-party-licenses
|
|
path: release-assets
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: changelog
|
|
path: .
|
|
- uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
|
|
with:
|
|
tag_name: v${{ needs.determine-release-type.outputs.version }}
|
|
name: v${{ needs.determine-release-type.outputs.version }}
|
|
body_path: CHANGELOG.md
|
|
prerelease: ${{ needs.determine-release-type.outputs.is_prerelease == 'true' }}
|
|
files: release-assets/*
|
|
|
|
audit-release:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
needs:
|
|
- determine-release-type
|
|
- generate-code
|
|
- build-binaries
|
|
- security-scan-trivy
|
|
- license-check
|
|
- generate-changelog
|
|
- create-github-release
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-linux
|
|
path: release-assets
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: binaries-darwin
|
|
path: release-assets
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: third-party-licenses
|
|
path: release-assets
|
|
- run: |
|
|
python3 scripts/audit-release.py \
|
|
--version "${{ needs.determine-release-type.outputs.version }}" \
|
|
--dir release-assets/ \
|
|
--github-release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|