298 lines
9.8 KiB
YAML
298 lines
9.8 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- v*.*
|
|
tags:
|
|
- v*
|
|
|
|
env:
|
|
ELIXIR_OPTS: "--warnings-as-errors"
|
|
LANG: C.UTF-8
|
|
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
|
|
jobs:
|
|
create_draft_release:
|
|
runs-on: ubuntu-22.04
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- name: Create draft release
|
|
if: github.ref_type != 'branch'
|
|
run: |
|
|
gh release create \
|
|
--repo ${{ github.repository }} \
|
|
--title ${{ github.ref_name }} \
|
|
--notes '' \
|
|
--draft \
|
|
${{ github.ref_name }}
|
|
|
|
- uses: actions/checkout@v4
|
|
if: github.ref_type == 'branch'
|
|
with:
|
|
fetch-depth: 50
|
|
|
|
- name: Update ${{ github.ref_name }}-latest
|
|
if: github.ref_type == 'branch'
|
|
run: |
|
|
ref_name=${{ github.ref_name }}-latest
|
|
|
|
if ! gh release view $ref_name; then
|
|
gh release create \
|
|
--latest=false \
|
|
--title $ref_name \
|
|
--notes "Automated release for latest ${{ github.ref_name }}." \
|
|
$ref_name
|
|
fi
|
|
|
|
git tag $ref_name --force
|
|
git push origin $ref_name --force
|
|
|
|
build:
|
|
needs: create_draft_release
|
|
strategy:
|
|
fail-fast: true
|
|
matrix:
|
|
include:
|
|
- otp: 25
|
|
otp_version: "25.3"
|
|
- otp: 26
|
|
otp_version: "26.0"
|
|
- otp: 27
|
|
otp_version: "27.0"
|
|
build_docs: build_docs
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 50
|
|
|
|
- name: "Build Release"
|
|
uses: ./.github/workflows/release_pre_built
|
|
with:
|
|
otp_version: ${{ matrix.otp_version }}
|
|
otp: ${{ matrix.otp }}
|
|
build_docs: ${{ matrix.build_docs }}
|
|
|
|
- name: "Attest release .exe provenance"
|
|
uses: actions/attest-build-provenance@v1
|
|
id: attest-exe-provenance
|
|
with:
|
|
subject-path: "elixir-otp-${{ matrix.otp }}.exe"
|
|
- name: "Copy release .exe provenance"
|
|
run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.exe.sigstore
|
|
env:
|
|
ATTESTATION: "${{ steps.attest-exe-provenance.outputs.bundle-path }}"
|
|
|
|
- name: "Attest release .zip provenance"
|
|
uses: actions/attest-build-provenance@v1
|
|
id: attest-zip-provenance
|
|
with:
|
|
subject-path: "elixir-otp-${{ matrix.otp }}.zip"
|
|
- name: "Copy release .zip provenance"
|
|
run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.zip.sigstore
|
|
env:
|
|
ATTESTATION: "${{ steps.attest-zip-provenance.outputs.bundle-path }}"
|
|
|
|
- name: "Attest docs provenance"
|
|
uses: actions/attest-build-provenance@v1
|
|
id: attest-docs-provenance
|
|
if: ${{ matrix.build_docs }}
|
|
with:
|
|
subject-path: "Docs.zip"
|
|
- name: "Copy docs provenance"
|
|
if: ${{ matrix.build_docs }}
|
|
run: cp "$ATTESTATION" Docs.zip.sigstore
|
|
env:
|
|
ATTESTATION: "${{ steps.attest-docs-provenance.outputs.bundle-path }}"
|
|
|
|
- name: "Upload release artifacts"
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: elixir-otp-${{ matrix.otp }}
|
|
path: elixir-otp-${{ matrix.otp }}*
|
|
|
|
- name: "Upload doc artifacts"
|
|
uses: actions/upload-artifact@v4
|
|
if: ${{ matrix.build_docs }}
|
|
with:
|
|
name: Docs
|
|
path: Docs.zip*
|
|
|
|
upload-release:
|
|
needs: build
|
|
runs-on: windows-2022
|
|
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
|
|
- run: |
|
|
mv elixir-otp-*/* .
|
|
mv Docs/* .
|
|
shell: bash
|
|
|
|
- name: "Sign files with Trusted Signing"
|
|
if: github.repository == 'elixir-lang/elixir'
|
|
uses: azure/trusted-signing-action@v0.5.0
|
|
with:
|
|
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
|
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
|
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
endpoint: https://eus.codesigning.azure.net/
|
|
trusted-signing-account-name: trusted-signing-elixir
|
|
certificate-profile-name: Elixir
|
|
files-folder: ${{ github.workspace }}
|
|
files-folder-filter: exe
|
|
file-digest: SHA256
|
|
timestamp-rfc3161: http://timestamp.acs.microsoft.com
|
|
timestamp-digest: SHA256
|
|
|
|
- name: Upload Pre-built
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
if [ "${{ github.ref_type }}" == "branch" ]; then
|
|
tag=${{ github.ref_name }}-latest
|
|
else
|
|
tag="${{ github.ref_name }}"
|
|
fi
|
|
|
|
gh release upload \
|
|
--repo ${{ github.repository }} \
|
|
--clobber \
|
|
"$tag" \
|
|
elixir-otp-*.zip \
|
|
elixir-otp-*.zip.sha{1,256}sum \
|
|
elixir-otp-*.zip.sigstore \
|
|
elixir-otp-*.exe \
|
|
elixir-otp-*.exe.sha{1,256}sum \
|
|
elixir-otp-*.exe.sigstore \
|
|
Docs.zip \
|
|
Docs.zip.sha{1,256}sum \
|
|
Docs.zip.sigstore
|
|
|
|
upload-builds-hex-pm:
|
|
needs: build
|
|
runs-on: ubuntu-22.04
|
|
concurrency: builds-hex-pm
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.HEX_AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.HEX_AWS_SECRET_ACCESS_KEY }}
|
|
AWS_REGION: ${{ secrets.HEX_AWS_REGION }}
|
|
AWS_S3_BUCKET: ${{ secrets.HEX_AWS_S3_BUCKET }}
|
|
FASTLY_REPO_SERVICE_ID: ${{ secrets.HEX_FASTLY_REPO_SERVICE_ID }}
|
|
FASTLY_BUILDS_SERVICE_ID: ${{ secrets.HEX_FASTLY_BUILDS_SERVICE_ID }}
|
|
FASTLY_KEY: ${{ secrets.HEX_FASTLY_KEY }}
|
|
OTP_GENERIC_VERSION: "25"
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
|
|
- name: Init purge keys file
|
|
run: |
|
|
touch purge_keys.txt
|
|
|
|
- name: Upload Precompiled to S3
|
|
run: |
|
|
ref_name=${{ github.ref_name }}
|
|
|
|
mv elixir-otp-*/* .
|
|
for zip in $(find . -type f -name 'elixir-otp-*.zip' | sed 's/^\.\///'); do
|
|
dest=${zip/elixir/${ref_name}}
|
|
surrogate_key=${dest/.zip$/}
|
|
|
|
aws s3 cp "${zip}" "s3://${AWS_S3_BUCKET}/builds/elixir/${dest}" \
|
|
--cache-control "public,max-age=3600" \
|
|
--metadata "{\"surrogate-key\":\"builds builds/elixir builds/elixir/${surrogate_key}\",\"surrogate-control\":\"public,max-age=604800\"}"
|
|
echo "builds/elixir/${surrogate_key}" >> purge_keys.txt
|
|
|
|
if [ "$zip" == "elixir-otp-${OTP_GENERIC_VERSION}.zip" ]; then
|
|
aws s3 cp "${zip}" "s3://${AWS_S3_BUCKET}/builds/elixir/${ref_name}.zip" \
|
|
--cache-control "public,max-age=3600" \
|
|
--metadata "{\"surrogate-key\":\"builds builds/elixir builds/elixir/${ref_name}\",\"surrogate-control\":\"public,max-age=604800\"}"
|
|
echo builds/elixir/${ref_name} >> purge_keys.txt
|
|
fi
|
|
done
|
|
|
|
- name: Upload Docs to S3
|
|
working-directory: Docs
|
|
run: |
|
|
version=$(echo ${{ github.ref_name }} | sed -e 's/^v//g')
|
|
|
|
unzip Docs.zip
|
|
|
|
for f in doc/*; do
|
|
if [ -d "$f" ]; then
|
|
app=$(echo "$f" | sed s/"doc\/"//)
|
|
tarball="${app}-${version}.tar.gz"
|
|
surrogate_key="docs/${app}-${version}"
|
|
|
|
tar -czf "${tarball}" -C "doc/${app}" .
|
|
aws s3 cp "${tarball}" "s3://${AWS_S3_BUCKET}/docs/${tarball}" \
|
|
--cache-control "public,max-age=3600" \
|
|
--metadata "{\"surrogate-key\":\"${surrogate_key}\",\"surrogate-control\":\"public,max-age=604800\"}"
|
|
echo "${surrogate_key}" >> ../purge_keys.txt
|
|
fi
|
|
done
|
|
|
|
- name: Update builds txt
|
|
run: |
|
|
date="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
|
|
ref_name=${{ github.ref_name }}
|
|
|
|
aws s3 cp "s3://${AWS_S3_BUCKET}/builds/elixir/builds.txt" builds.txt || true
|
|
touch builds.txt
|
|
|
|
for sha256_file in $(find . -name 'elixir-otp-*.zip.sha256sum' | sed 's/^\.\///'); do
|
|
otp_version=$(echo "${sha256_file}" | sed -r 's/^elixir-otp-([[:digit:]]+)\.zip\.sha256sum/otp-\1/')
|
|
build_sha256=$(cut -d ' ' -f 1 "${sha256_file}")
|
|
|
|
sed -i "/^${ref_name}-${otp_version} /d" builds.txt
|
|
echo -e "${ref_name}-${otp_version} ${{ github.sha }} ${date} ${build_sha256} \n$(cat builds.txt)" > builds.txt
|
|
|
|
if [ "${otp_version}" == "otp-${OTP_GENERIC_VERSION}" ]; then
|
|
sed -i "/^${ref_name} /d" builds.txt
|
|
echo -e "${ref_name} ${{ github.sha }} ${date} ${build_sha256} \n$(cat builds.txt)" > builds.txt
|
|
fi
|
|
done
|
|
|
|
sort -u -k1,1 -o builds.txt builds.txt
|
|
aws s3 cp builds.txt "s3://${AWS_S3_BUCKET}/builds/elixir/builds.txt" \
|
|
--cache-control "public,max-age=3600" \
|
|
--metadata '{"surrogate-key":"builds builds/elixir builds/elixir/txt","surrogate-control":"public,max-age=604800"}'
|
|
|
|
echo 'builds/elixir/txt' >> purge_keys.txt
|
|
|
|
- name: Flush cache
|
|
if: github.repository == 'elixir-lang/elixir'
|
|
run: |
|
|
function purge_key() {
|
|
curl \
|
|
-X POST \
|
|
-H "Fastly-Key: ${FASTLY_KEY}" \
|
|
-H "Accept: application/json" \
|
|
-H "Content-Length: 0" \
|
|
"https://api.fastly.com/service/$1/purge/$2"
|
|
}
|
|
|
|
function purge() {
|
|
purge_key ${FASTLY_REPO_SERVICE_ID} $1
|
|
purge_key ${FASTLY_BUILDS_SERVICE_ID} $1
|
|
sleep 2
|
|
purge_key ${FASTLY_REPO_SERVICE_ID} $1
|
|
purge_key ${FASTLY_BUILDS_SERVICE_ID} $1
|
|
sleep 2
|
|
purge_key ${FASTLY_REPO_SERVICE_ID} $1
|
|
purge_key ${FASTLY_BUILDS_SERVICE_ID} $1
|
|
}
|
|
|
|
for key in $(cat purge_keys.txt); do
|
|
purge "${key}"
|
|
done
|