name: Tag and Release
on:
push:
tags:
- "v*.*.*"
concurrency:
group: main-build
cancel-in-progress: false
jobs:
lint:
permissions:
contents: read
name: Lint and test
uses: ./.github/workflows/ci.yml
draft-release:
name: Create draft release
runs-on: ubuntu-latest
needs: lint
permissions:
contents: write
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
- name: Get tag version
id: version
run: echo "version=${GITHUB_REF#refs/tags/v}" | tee -a "$GITHUB_OUTPUT"
- name: Verify all package versions match tag
env:
TAG_VERSION: ${{ steps.version.outputs.version }}
run: |
CARGO_VERSION="$(yq -roy '.package.version' Cargo.toml)"
NPM_VERSION="$(jq -r '.version' npm/package.json)"
PYTHON_VERSION="$(yq -roy '.project.version' python/pyproject.toml)"
FAILED=0
for PAIR in "Cargo.toml:${CARGO_VERSION}" "npm/package.json:${NPM_VERSION}" "python/pyproject.toml:${PYTHON_VERSION}"; do
FILE="${PAIR%%:*}"
VERSION="${PAIR##*:}"
if [[ "$TAG_VERSION" != "$VERSION" ]]; then
echo "Tag version ${TAG_VERSION} does not match ${FILE} version ${VERSION}" >&2
FAILED=1
fi
done
exit "$FAILED"
- name: Check if release already exists
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
if gh release view '${{ github.ref_name }}' --repo '${{ github.repository }}'; then
echo "Release ${{ github.ref_name }} already exists" >&2
exit 1
fi
- name: Create Draft Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: |
# shellcheck disable=SC2016
envsubst '$VERSION $REPO' < .github/release-template.md > /tmp/release-notes.md
gh release create '${{ github.ref_name }}' \
--repo '${{ github.repository }}' \
--title "Release ${{ github.ref_name }}" \
--draft \
--notes-file /tmp/release-notes.md
release-binaries:
name: Release Binaries
needs: draft-release
permissions:
contents: write
uses: ./.github/workflows/release-binaries.yml
with:
release: ${{ github.ref_name }}
publish-docker:
needs: release-binaries
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-container.yml
with:
version: ${{ github.ref_name }}
secrets: inherit
publish-node:
needs: release-binaries
permissions:
contents: read
id-token: write uses: ./.github/workflows/publish-npm.yml
publish-python:
needs: release-binaries
permissions:
contents: read
id-token: write uses: ./.github/workflows/publish-python.yml
publish-rust:
needs: release-binaries
permissions:
contents: read
id-token: write uses: ./.github/workflows/publish-rust.yml
publish-release:
name: Publish Release
needs:
- publish-docker
- publish-node
- publish-python
- publish-rust
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
- name: Publish Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh release edit '${{ github.ref_name }}' --repo '${{ github.repository }}' --draft=false