Repository navigation
Release #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v[0-9]*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to release (must already be pushed, e.g. v5.10.0-rc1)" | |
| required: true | |
| upload_taps: | |
| description: "Upload to Homebrew/Scoop taps (overrides pre-release skip)" | |
| type: boolean | |
| default: false | |
| upload_repos: | |
| description: "Upload to package repositories via repogen (overrides pre-release skip)" | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| steps: | |
| - name: Resolve tag | |
| id: tag | |
| run: | | |
| TAG="${{ inputs.tag || github.ref_name }}" | |
| if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$'; then | |
| echo "::error::Tag '$TAG' does not match semver format (vMAJOR.MINOR.PATCH)" | |
| exit 1 | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| if [[ "$TAG" == *-* ]]; then | |
| echo "is_prerelease=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is_prerelease=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Check out repository code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.tag.outputs.tag }} | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: ./go.mod | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.4" | |
| extensions: curl, openssl, phar, zlib | |
| tools: composer:v2 | |
| - name: Get Composer cache directory | |
| id: composer-cache | |
| run: echo "dir=$(cd legacy && composer config cache-files-dir)" >> $GITHUB_OUTPUT | |
| - name: Cache Composer dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ steps.composer-cache.outputs.dir }} | |
| key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }} | |
| restore-keys: ${{ runner.os }}-composer- | |
| - name: Install legacy dependencies | |
| run: cd legacy && composer install --no-interaction | |
| - name: Get PHP version from Makefile | |
| id: php-version | |
| run: echo "version=$(grep '^PHP_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| - name: Get tool versions from Makefile | |
| id: tool-versions | |
| run: | | |
| echo "goreleaser=$(grep '^GORELEASER_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| echo "repogen=$(grep '^REPOGEN_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| - name: Cache PHP binaries | |
| uses: actions/cache@v4 | |
| id: php-cache | |
| with: | |
| path: internal/legacy/archives/php_* | |
| key: php-binaries-${{ steps.php-version.outputs.version }} | |
| - name: Download all PHP binaries | |
| if: steps.php-cache.outputs.cache-hit != 'true' | |
| run: make download-php | |
| - name: Write signing keys to files | |
| id: signing-keys | |
| run: | | |
| KEY_DIR=$(mktemp -d) | |
| echo "key_dir=$KEY_DIR" >> $GITHUB_OUTPUT | |
| echo "${{ secrets.RSA_SIGNING_KEY }}" > "$KEY_DIR/rsa-signing-key.pem" | |
| chmod 600 "$KEY_DIR/rsa-signing-key.pem" | |
| openssl rsa -in "$KEY_DIR/rsa-signing-key.pem" -pubout -out "$KEY_DIR/rsa-signing-key.pub" | |
| echo "${{ secrets.GPG_SIGNING_KEY }}" | base64 -d > "$KEY_DIR/gpg-signing-key.asc" | |
| chmod 600 "$KEY_DIR/gpg-signing-key.asc" | |
| - name: Cache Go binaries | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/go/bin | |
| key: ${{ runner.os }}-go-bin-goreleaser-${{ steps.tool-versions.outputs.goreleaser }}-repogen-${{ steps.tool-versions.outputs.repogen }} | |
| - name: Install Go tools | |
| run: make goreleaser repogen | |
| - name: Build release (tag) | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.tag | |
| env: | |
| GORELEASER_CURRENT_TAG: ${{ steps.tag.outputs.tag }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem | |
| GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc | |
| CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} | |
| SKIP_UPLOAD_TAPS: ${{ inputs.upload_taps == true && 'false' || 'auto' }} | |
| RELEASE_MODE: ${{ github.event_name == 'workflow_dispatch' && 'replace' || 'append' }} | |
| run: make release | |
| - name: Build snapshot (branch) | |
| if: "!startsWith(github.ref, 'refs/tags/') && !inputs.tag" | |
| env: | |
| RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem | |
| GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc | |
| run: make snapshot | |
| - name: Configure AWS credentials | |
| if: steps.tag.outputs.is_prerelease == 'false' || inputs.upload_repos == true | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: eu-west-1 | |
| - name: Upload packages to repository | |
| if: steps.tag.outputs.is_prerelease == 'false' || inputs.upload_repos == true | |
| env: | |
| GPG_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc | |
| RSA_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem | |
| RSA_PUBLIC_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pub | |
| run: bash ./repogen.sh | |
| - name: Clean up signing keys | |
| if: always() | |
| run: | | |
| rm -rf "${{ steps.signing-keys.outputs.key_dir }}" |