Repository navigation
chore(deps): bump the go-deps group with 2 updates (#162) #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v[0-9]*" | |
| permissions: | |
| contents: write | |
| env: | |
| IMAGE: ghcr.io/upsun/cli | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| permissions: | |
| contents: write | |
| outputs: | |
| tag: ${{ steps.tag.outputs.tag }} | |
| is_prerelease: ${{ steps.tag.outputs.is_prerelease }} | |
| steps: | |
| - name: Resolve tag | |
| id: tag | |
| env: | |
| TAG: ${{ github.ref_name }} | |
| run: | | |
| if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$'; then | |
| echo "::error::Tag '$TAG' does not match semver format (vMAJOR.MINOR.PATCH)" | |
| exit 1 | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| if [[ "$TAG" == *-* ]]; then | |
| echo "is_prerelease=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is_prerelease=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Check out repository code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ steps.tag.outputs.tag }} | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: ./go.mod | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: "8.4" | |
| extensions: curl, openssl, phar, zlib | |
| tools: composer:v2 | |
| - name: Get Composer cache directory | |
| id: composer-cache | |
| run: echo "dir=$(cd legacy && composer config cache-files-dir)" >> $GITHUB_OUTPUT | |
| - name: Cache Composer dependencies | |
| uses: actions/cache@v6 | |
| with: | |
| path: ${{ steps.composer-cache.outputs.dir }} | |
| key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }} | |
| restore-keys: ${{ runner.os }}-composer- | |
| - name: Install legacy dependencies | |
| run: cd legacy && composer install --no-interaction | |
| - name: Get PHP version from Makefile | |
| id: php-version | |
| run: echo "version=$(grep '^PHP_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| - name: Get tool versions from Makefile | |
| id: tool-versions | |
| run: | | |
| echo "goreleaser=$(grep '^GORELEASER_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| echo "repogen=$(grep '^REPOGEN_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT | |
| - name: Cache PHP binaries | |
| uses: actions/cache@v6 | |
| id: php-cache | |
| with: | |
| path: internal/legacy/archives/php_* | |
| key: php-binaries-${{ steps.php-version.outputs.version }} | |
| - name: Download all PHP binaries | |
| if: steps.php-cache.outputs.cache-hit != 'true' | |
| run: make download-php | |
| - name: Write signing keys to files | |
| id: signing-keys | |
| run: | | |
| KEY_DIR=$(mktemp -d) | |
| echo "key_dir=$KEY_DIR" >> $GITHUB_OUTPUT | |
| echo "${{ secrets.RSA_SIGNING_KEY }}" > "$KEY_DIR/rsa-signing-key.pem" | |
| chmod 600 "$KEY_DIR/rsa-signing-key.pem" | |
| openssl rsa -in "$KEY_DIR/rsa-signing-key.pem" -pubout -out "$KEY_DIR/rsa-signing-key.pub" | |
| echo "${{ secrets.GPG_SIGNING_KEY }}" | base64 -d > "$KEY_DIR/gpg-signing-key.asc" | |
| chmod 600 "$KEY_DIR/gpg-signing-key.asc" | |
| - name: Cache Go binaries | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/go/bin | |
| key: ${{ runner.os }}-go-bin-goreleaser-${{ steps.tool-versions.outputs.goreleaser }}-repogen-${{ steps.tool-versions.outputs.repogen }} | |
| - name: Install Go tools | |
| run: make goreleaser repogen | |
| - name: Generate GitHub App token for homebrew-tap | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| repositories: homebrew-tap | |
| - name: Build release | |
| env: | |
| GORELEASER_CURRENT_TAG: ${{ steps.tag.outputs.tag }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem | |
| GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc | |
| CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} | |
| SKIP_UPLOAD_TAPS: auto | |
| run: make release | |
| - name: Configure AWS credentials | |
| if: steps.tag.outputs.is_prerelease == 'false' | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: eu-west-1 | |
| - name: Upload packages to repository | |
| if: steps.tag.outputs.is_prerelease == 'false' | |
| env: | |
| GPG_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc | |
| RSA_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem | |
| RSA_PUBLIC_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pub | |
| run: bash ./repogen.sh | |
| - name: Clean up signing keys | |
| if: always() | |
| run: | | |
| rm -rf "${{ steps.signing-keys.outputs.key_dir }}" | |
| npm: | |
| runs-on: ubuntu-latest | |
| needs: release | |
| environment: production | |
| permissions: | |
| contents: read # gh release download | |
| id-token: write # OIDC token for npm trusted publishing | |
| steps: | |
| - name: Check out repository code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.release.outputs.tag }} | |
| # registry-url is deliberately unset: it would write an .npmrc authToken | |
| # line bound to NODE_AUTH_TOKEN, and an empty token there shadows OIDC. | |
| # Node 24 bundles npm >= 11.5.1, which OIDC trusted publishing requires. | |
| - name: Setup Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| - name: Download release archives | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ needs.release.outputs.tag }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| mkdir -p dist | |
| gh release download "$TAG" --repo "$REPO" --dir dist \ | |
| -p 'upsun_*_linux_amd64.tar.gz' \ | |
| -p 'upsun_*_linux_arm64.tar.gz' \ | |
| -p 'upsun_*_darwin_all.tar.gz' \ | |
| -p 'upsun_*_windows_amd64.zip' | |
| - name: Build npm tarballs | |
| run: make npm-pack | |
| - name: Publish to npm | |
| env: | |
| NPM_TAG: ${{ needs.release.outputs.is_prerelease == 'true' && 'next' || 'latest' }} | |
| run: make npm-publish | |
| docker: | |
| runs-on: ${{ matrix.runner }} | |
| needs: release | |
| strategy: | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| platform: linux/amd64 | |
| suffix: amd64 | |
| - runner: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| suffix: arm64 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: https://github.com/${{ github.repository }}.git#${{ needs.release.outputs.tag }} | |
| platforms: ${{ matrix.platform }} | |
| push: true | |
| tags: ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-${{ matrix.suffix }} | |
| build-args: | | |
| VERSION=${{ needs.release.outputs.tag }} | |
| cache-from: type=gha,scope=${{ matrix.suffix }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.suffix }} | |
| docker-manifest: | |
| runs-on: ubuntu-latest | |
| needs: [docker, release] | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create and push versioned manifest | |
| run: | | |
| docker buildx imagetools create \ | |
| --tag ${{ env.IMAGE }}:${{ needs.release.outputs.tag }} \ | |
| ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \ | |
| ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64 | |
| - name: Create and push latest manifest | |
| if: needs.release.outputs.is_prerelease == 'false' | |
| run: | | |
| docker buildx imagetools create \ | |
| --tag ${{ env.IMAGE }}:latest \ | |
| ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \ | |
| ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64 |