MokoConsulting/MokoCassiopeia
1
1
Fork 0
Code Issues 2 Pull Requests Actions Packages Releases 1 Activity

Update release_from_version.yml

Browse Source
This commit is contained in:
Jonathan Miller
2025-12-23 19:15:47 -06:00
parent cb51863f88
commit 1e4b45bec4
1 changed files with 27 additions and 473 deletions
Download Patch File Download Diff File Expand all files Collapse all files

500
.github/workflows/release_from_version.yml vendored
View File

@@ -43,473 +43,7 @@ on:
default: true
type: boolean
squash_to_main:
description: "Squash merge version/<version> into main"
required: true
default: false
type: boolean
delete_version_branch:
description: "Delete version/<version> after squash merge to main"
required: true
default: false
type: boolean
concurrency:
group: release-from-dev-${{ github.ref_name }}
cancel-in-progress: false
permissions:
contents: read
defaults:
run:
shell: bash
jobs:
guard:
name: 00 Guard and derive release metadata
runs-on: ubuntu-latest
outputs:
version: ${{ steps.extract.outputs.version }}
dev_branch: ${{ steps.extract.outputs.dev_branch }}
version_branch: ${{ steps.extract.outputs.version_branch }}
target_branch: ${{ steps.extract.outputs.target_branch }}
today_utc: ${{ steps.extract.outputs.today_utc }}
steps:
- name: Validate calling branch and extract version
id: extract
run: |
set -euo pipefail
BRANCH="${GITHUB_REF_NAME}"
echo "Invoked from branch: ${BRANCH}"
# Enterprise gate: only allow manual runs from dev/<major>.<minor>.<patch>
echo "${BRANCH}" | grep -E '^dev/[0-9]+\.[0-9]+\.[0-9]+$'
VERSION="${BRANCH#dev/}"
DEV_BRANCH="dev/${VERSION}"
VERSION_BRANCH="version/${VERSION}"
TODAY_UTC="$(date -u +%Y-%m-%d)"
PROMOTE_INPUT="${{ github.event.inputs.promote_to_version }}"
if [ "${PROMOTE_INPUT}" = "true" ]; then
TARGET_BRANCH="${VERSION_BRANCH}"
else
TARGET_BRANCH="${DEV_BRANCH}"
fi
echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
echo "dev_branch=${DEV_BRANCH}" >> "${GITHUB_OUTPUT}"
echo "version_branch=${VERSION_BRANCH}" >> "${GITHUB_OUTPUT}"
echo "target_branch=${TARGET_BRANCH}" >> "${GITHUB_OUTPUT}"
echo "today_utc=${TODAY_UTC}" >> "${GITHUB_OUTPUT}"
promote_branch:
name: 01 Promote dev to version branch
runs-on: ubuntu-latest
needs: guard
if: ${{ github.event.inputs.promote_to_version == 'true' && startsWith(github.ref_name, 'dev/') }}
permissions:
contents: write
steps:
- name: Checkout dev branch
uses: actions/checkout@v4
with:
ref: ${{ needs.guard.outputs.dev_branch }}
fetch-depth: 0
- name: Configure Git identity
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git config --global --add safe.directory "${GITHUB_WORKSPACE}"
- name: Enforce branch promotion preconditions
run: |
set -euo pipefail
SRC="${{ needs.guard.outputs.dev_branch }}"
DST="${{ needs.guard.outputs.version_branch }}"
git fetch origin --prune
if ! git show-ref --verify --quiet "refs/remotes/origin/${SRC}"; then
echo "ERROR: origin/${SRC} not found."
exit 1
fi
if git show-ref --verify --quiet "refs/remotes/origin/${DST}"; then
echo "ERROR: origin/${DST} already exists."
exit 1
fi
- name: Promote dev branch to version branch
run: |
set -euo pipefail
SRC="${{ needs.guard.outputs.dev_branch }}"
DST="${{ needs.guard.outputs.version_branch }}"
git checkout -B "${DST}" "origin/${SRC}"
git push origin "${DST}"
if [ "${{ github.event.inputs.delete_dev_branch }}" = "true" ]; then
git push origin --delete "${SRC}"
else
echo "Dev branch retention enabled. Skipping deletion of ${SRC}."
fi
echo "Promotion complete: ${SRC} -> ${DST}"
normalize_dates:
name: 02 Normalize dates on release working branch
runs-on: ubuntu-latest
needs:
- guard
- promote_branch
# Control: if promotion is requested, require promote_branch success.
if: ${{ (github.event.inputs.promote_to_version != 'true') || (needs.promote_branch.result == 'success') }}
permissions:
contents: write
steps:
- name: Checkout release working branch
uses: actions/checkout@v4
with:
ref: ${{ needs.guard.outputs.target_branch }}
fetch-depth: 0
- name: Configure Git identity
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git config --global --add safe.directory "${GITHUB_WORKSPACE}"
- name: Validate repository release prerequisites
run: |
set -euo pipefail
test -d src || (echo "ERROR: src directory missing." && exit 1)
test -f CHANGELOG.md || (echo "ERROR: CHANGELOG.md missing." && exit 1)
VERSION="${{ needs.guard.outputs.version }}"
if ! grep -qE "^## \[${VERSION}\] " CHANGELOG.md; then
echo "ERROR: CHANGELOG.md does not contain a heading for version [${VERSION}]."
exit 1
fi
- name: Update dates using repo script when available, otherwise apply baseline updates
run: |
set -euo pipefail
TODAY="${{ needs.guard.outputs.today_utc }}"
VERSION="${{ needs.guard.outputs.version }}"
echo "Release version: ${VERSION}"
echo "Release date (UTC): ${TODAY}"
if [ -f scripts/update_dates.sh ]; then
chmod +x scripts/update_dates.sh
scripts/update_dates.sh "${TODAY}" "${VERSION}"
else
echo "scripts/update_dates.sh not found. Applying baseline date normalization."
find . -type f -name "*.xml" \
-not -path "./.git/*" \
-print0 | while IFS= read -r -d '' f; do
sed -i "s#<creationDate>[^<]*</creationDate>#<creationDate>${TODAY}</creationDate>#g" "${f}" || true
sed -i "s#<date>[^<]*</date>#<date>${TODAY}</date>#g" "${f}" || true
sed -i "s#<buildDate>[^<]*</buildDate>#<buildDate>${TODAY}</buildDate>#g" "${f}" || true
done
sed -i -E "s#^(## \[${VERSION}\]) [0-9]{4}-[0-9]{2}-[0-9]{2}#\1 ${TODAY}#g" CHANGELOG.md || true
fi
- name: Commit and push date updates
run: |
set -euo pipefail
if git diff --quiet; then
echo "No date changes detected. No commit required."
exit 0
fi
git add -A
git commit -m "chore(release): normalize dates for ${{ needs.guard.outputs.version }}"
git push origin "HEAD:${{ needs.guard.outputs.target_branch }}"
build_update_and_release:
name: 03 Build Joomla ZIP, update updates.xml, prerelease
runs-on: ubuntu-latest
needs:
- guard
- normalize_dates
permissions:
contents: write
id-token: write
steps:
- name: Checkout release working branch
uses: actions/checkout@v4
with:
ref: ${{ needs.guard.outputs.target_branch }}
fetch-depth: 0
- name: Configure Git identity
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git config --global --add safe.directory "${GITHUB_WORKSPACE}"
- name: Build Joomla compliant ZIP (template, component, module, plugin)
id: build
run: |
set -euo pipefail
VERSION="${{ needs.guard.outputs.version }}"
REPO="${{ github.event.repository.name }}"
test -d src || (echo "ERROR: src directory missing." && exit 1)
mkdir -p dist
# Determine the Joomla extension root inside src.
# Rules:
# - If src contains a single top-level directory, prefer that directory as the extension root.
# - Otherwise, use src as the extension root.
# - The extension root must contain a manifest XML at its root.
ROOT="src"
TOP_COUNT="$(find src -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
if [ "${TOP_COUNT}" = "1" ]; then
ONLY_DIR="$(find src -mindepth 1 -maxdepth 1 -type d -print -quit)"
ROOT="${ONLY_DIR}"
fi
echo "Candidate extension root: ${ROOT}"
# Locate the manifest XML at the root of ROOT.
# Priority:
# - templateDetails.xml for templates
# - otherwise, any *.xml containing a Joomla <extension ...> root element
MANIFEST=""
if [ -f "${ROOT}/templateDetails.xml" ]; then
MANIFEST="${ROOT}/templateDetails.xml"
else
while IFS= read -r -d '' f; do
if grep -qE '<extension[[:space:]>]' "${f}"; then
MANIFEST="${f}"
break
fi
done < <(find "${ROOT}" -maxdepth 1 -type f -name "*.xml" -print0)
fi
if [ -z "${MANIFEST}" ]; then
echo "ERROR: No Joomla manifest XML found at the root of ${ROOT}."
echo "Expected templateDetails.xml or a *.xml file containing an <extension> element."
exit 1
fi
echo "Manifest: ${MANIFEST}"
# Derive extension type for logging and compliance checks.
EXT_TYPE="$(grep -oE '<extension[^>]*type=\"[^\"]+\"' "${MANIFEST}" | head -n 1 | sed -E 's/.*type=\"([^\"]+)\".*/\1/')"
if [ -z "${EXT_TYPE}" ]; then
EXT_TYPE="unknown"
fi
echo "Detected extension type: ${EXT_TYPE}"
# Basic Joomla compliance checks by type.
case "${EXT_TYPE}" in
template)
test -f "${ROOT}/templateDetails.xml" || (echo "ERROR: templateDetails.xml missing for template build." && exit 1)
;;
component)
if ! ls "${ROOT}"/com_*.xml >/dev/null 2>&1; then
echo "WARNING: No com_*.xml manifest found at root. Using detected manifest anyway."
fi
;;
module)
if ! ls "${ROOT}"/mod_*.xml >/dev/null 2>&1; then
echo "WARNING: No mod_*.xml manifest found at root. Using detected manifest anyway."
fi
;;
plugin)
:
;;
*)
echo "WARNING: Extension type could not be determined reliably. Proceeding with generic packaging."
;;
esac
ZIP="${REPO}-${VERSION}.zip"
# Joomla install expectation: ZIP root is the extension root.
# Zip the CONTENTS of ROOT, not ROOT itself.
(cd "${ROOT}" && zip -r -X "../dist/${ZIP}" . \
-x "**/.git/**" \
-x "**/.github/**" \
-x "**/.DS_Store" \
-x "**/__MACOSX/**")
echo "zip_name=${ZIP}" >> "${GITHUB_OUTPUT}"
ls -la dist
- name: Compute SHA256 for ZIP
id: sha
run: |
set -euo pipefail
ZIP="${{ steps.build.outputs.zip_name }}"
SHA="$(sha256sum "dist/${ZIP}" | awk '{print $1}')"
echo "sha256=${SHA}" >> "${GITHUB_OUTPUT}"
printf "%s %s\n" "${SHA}" "${ZIP}" > dist/SHA256SUMS.txt
cat dist/SHA256SUMS.txt
- name: Update updates.xml with download URL and sha256
run: |
set -euo pipefail
VERSION="${{ needs.guard.outputs.version }}"
TODAY="${{ needs.guard.outputs.today_utc }}"
ZIP="${{ steps.build.outputs.zip_name }}"
SHA="${{ steps.sha.outputs.sha256 }}"
OWNER="${{ github.repository_owner }}"
REPO="${{ github.event.repository.name }}"
DOWNLOAD_URL="https://github.com/${OWNER}/${REPO}/releases/download/${VERSION}/${ZIP}"
echo "Version: ${VERSION}"
echo "Download URL: ${DOWNLOAD_URL}"
echo "SHA256: ${SHA}"
# If a template exists, instantiate it
if [ -f "docs/templates/template_update.xml" ]; then
cp -f "docs/templates/template_update.xml" "updates.xml"
elif [ -f "docs/templates/update_template.xml" ]; then
cp -f "docs/templates/update_template.xml" "updates.xml"
fi
if [ ! -f "updates.xml" ]; then
# Backward compatibility: allow repos that still keep update.xml
if [ -f "update.xml" ]; then
mv -f "update.xml" "updates.xml"
else
echo "ERROR: updates.xml not found and no template present in docs/templates."
exit 1
fi
fi
# Replace common placeholders if present
sed -i "s#{{VERSION}}#${VERSION}#g" updates.xml || true
sed -i "s#{{DATE}}#${TODAY}#g" updates.xml || true
sed -i "s#{{DOWNLOADURL}}#${DOWNLOAD_URL}#g" updates.xml || true
sed -i "s#{{SHA256}}#${SHA}#g" updates.xml || true
sed -i "s#{{ZIP}}#${ZIP}#g" updates.xml || true
# Also enforce canonical tag replacement inside common XML elements
sed -i "s#<downloadurl>[^<]*</downloadurl>#<downloadurl>${DOWNLOAD_URL}</downloadurl>#g" updates.xml || true
sed -i "s#<sha256>[^<]*</sha256>#<sha256>${SHA}</sha256>#g" updates.xml || true
sed -i "s#<sha256sum>[^<]*</sha256sum>#<sha256sum>${SHA}</sha256sum>#g" updates.xml || true
sed -i "s#<version>[^<]*</version>#<version>${VERSION}</version>#g" updates.xml || true
sed -i "s#<date>[^<]*</date>#<date>${TODAY}</date>#g" updates.xml || true
echo "updates.xml updated."
- name: Commit updates.xml changes (and any related date deltas)
run: |
set -euo pipefail
if git diff --quiet; then
echo "No updates.xml changes detected. No commit required."
exit 0
fi
git add -A
git commit -m "chore(release): update updates.xml for ${{ needs.guard.outputs.version }}"
git push origin "HEAD:${{ needs.guard.outputs.target_branch }}"
- name: Create and push annotated tag after final release commit
run: |
set -euo pipefail
VERSION="${{ needs.guard.outputs.version }}"
git fetch --tags
if git rev-parse -q --verify "refs/tags/${VERSION}" >/dev/null; then
echo "ERROR: Tag ${VERSION} already exists."
exit 1
fi
git tag -a "${VERSION}" -m "Prerelease ${VERSION}"
git push origin "refs/tags/${VERSION}"
- name: Generate release notes from CHANGELOG.md
run: |
set -euo pipefail
VERSION="${{ needs.guard.outputs.version }}"
awk "/^## \[${VERSION}\]/{flag=1;next}/^## \[/ {flag=0}flag" CHANGELOG.md > RELEASE_NOTES.md || true
if [ ! -s RELEASE_NOTES.md ]; then
echo "ERROR: Release notes extraction failed for ${VERSION}."
exit 1
fi
ZIP_ASSET="${{ steps.build.outputs.zip_name }}"
{
echo ""
echo "Assets:"
echo "- ${ZIP_ASSET}"
echo "- updates.xml"
echo "- SHA256SUMS.txt"
} >> RELEASE_NOTES.md
- name: Upload build artifacts
uses: actions/upload-artifact@v4
with:
name: release-assets
path: |
dist/*.zip
dist/SHA256SUMS.txt
updates.xml
RELEASE_NOTES.md
retention-days: 30
- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: |
dist/*.zip
dist/SHA256SUMS.txt
- name: Create GitHub prerelease and attach assets
uses: softprops/action-gh-release@v2
with:
token: ${{ github.token }}
tag_name: ${{ needs.guard.outputs.version }}
name: Prerelease ${{ needs.guard.outputs.version }}
prerelease: true
body_path: RELEASE_NOTES.md
files: |
dist/*.zip
updates.xml
dist/SHA256SUMS.txt
squash_to_main:
name: 04 Optional squash merge version branch to main
name: 04 Optional squash merge version branch to main (PR-based)
runs-on: ubuntu-latest
needs:
- guard
@@ -519,6 +53,7 @@ jobs:
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout main
@@ -539,17 +74,28 @@ jobs:
set -euo pipefail
git fetch origin --prune
- name: Squash merge version branch into main
- name: Create squash-merge branch targeting main
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
VERSION="${{ needs.guard.outputs.version }}"
VBRANCH="origin/${{ needs.guard.outputs.version_branch }}"
MERGE_BRANCH="merge/${VERSION}"
# Governance control: if main is protected from direct pushes, this will fail by design.
# Enforce PR-based merge in that scenario.
# Create a dedicated merge branch off main, squash version branch into it, then open a PR.
# This is compatible with enterprise branch protections on main.
git checkout main
git pull --ff-only origin main
# Ensure merge branch is fresh
if git show-ref --verify --quiet "refs/heads/${MERGE_BRANCH}"; then
git branch -D "${MERGE_BRANCH}"
fi
git checkout -b "${MERGE_BRANCH}" main
git merge --squash "${VBRANCH}"
if git diff --cached --quiet; then
@@ -558,13 +104,21 @@ jobs:
fi
git commit -m "chore(release): squash ${VERSION} into main"
git push origin "HEAD:main"
git push -u origin "${MERGE_BRANCH}"
- name: Optional delete version branch after squash
# Create PR (idempotent): if it already exists, do not fail.
gh pr create \
--base main \
--head "${MERGE_BRANCH}" \
--title "Release ${VERSION} (squash)" \
--body "Squash merge of version/${VERSION} into main. Generated by release pipeline." \
|| echo "PR may already exist for ${MERGE_BRANCH}."
- name: Optional delete version branch after PR creation
run: |
set -euo pipefail
if [ "${{ github.event.inputs.delete_version_branch }}" = "true" ]; then
git push origin --delete "${{ needs.guard.outputs.version_branch }}"
git push origin --delete "${{ needs.guard.outputs.version_branch }}" || true
else
echo "Version branch retention enabled. Skipping deletion."
fi