|
| 1 | +name: Post release after develop synced |
| 2 | + |
| 3 | +on: |
| 4 | + repository_dispatch: |
| 5 | + types: [develop-synced] |
| 6 | + |
| 7 | +jobs: |
| 8 | + post_release: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + |
| 11 | + permissions: |
| 12 | + contents: write |
| 13 | + |
| 14 | + steps: |
| 15 | + - name: Read version from repository_dispatch payload |
| 16 | + id: meta |
| 17 | + env: |
| 18 | + PAYLOAD_VERSION: ${{ github.event.client_payload.version }} |
| 19 | + run: | |
| 20 | + set -euo pipefail |
| 21 | + if [ -z "${PAYLOAD_VERSION}" ]; then |
| 22 | + echo "No version in client_payload, skip post-release." |
| 23 | + echo "skip=true" >> "$GITHUB_OUTPUT" |
| 24 | + exit 0 |
| 25 | + fi |
| 26 | + echo "Using version from payload: ${PAYLOAD_VERSION}" |
| 27 | + echo "version=${PAYLOAD_VERSION}" >> "$GITHUB_OUTPUT" |
| 28 | + echo "skip=false" >> "$GITHUB_OUTPUT" |
| 29 | +
|
| 30 | + - name: Checkout main |
| 31 | + if: steps.meta.outputs.skip != 'true' |
| 32 | + uses: actions/checkout@v4 |
| 33 | + with: |
| 34 | + ref: main |
| 35 | + fetch-depth: 0 |
| 36 | + persist-credentials: false |
| 37 | + |
| 38 | + - name: Configure git remote to use PAT |
| 39 | + if: steps.meta.outputs.skip != 'true' |
| 40 | + env: |
| 41 | + GH_PAT: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }} |
| 42 | + run: | |
| 43 | + set -euo pipefail |
| 44 | + git remote set-url origin "https://x-access-token:${GH_PAT}@github.com/${GITHUB_REPOSITORY}.git" |
| 45 | + git remote -v |
| 46 | +
|
| 47 | + - name: Fetch tags |
| 48 | + if: steps.meta.outputs.skip != 'true' |
| 49 | + run: | |
| 50 | + set -euo pipefail |
| 51 | + git fetch --tags --force |
| 52 | +
|
| 53 | + - name: Check existing tag and release |
| 54 | + id: exist |
| 55 | + if: steps.meta.outputs.skip != 'true' |
| 56 | + env: |
| 57 | + VERSION: ${{ steps.meta.outputs.version }} |
| 58 | + GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }} |
| 59 | + run: | |
| 60 | + set -euo pipefail |
| 61 | + TAG="v${VERSION}" |
| 62 | +
|
| 63 | + if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then |
| 64 | + echo "Tag ${TAG} already exists, skip post-release." |
| 65 | + echo "skip=true" >> "$GITHUB_OUTPUT" |
| 66 | + exit 0 |
| 67 | + fi |
| 68 | +
|
| 69 | + if gh release view "${TAG}" >/dev/null 2>&1; then |
| 70 | + echo "Release ${TAG} already exists, skip post-release." |
| 71 | + echo "skip=true" >> "$GITHUB_OUTPUT" |
| 72 | + exit 0 |
| 73 | + fi |
| 74 | +
|
| 75 | + echo "skip=false" >> "$GITHUB_OUTPUT" |
| 76 | +
|
| 77 | + - name: Ensure main changelog exists |
| 78 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' |
| 79 | + run: | |
| 80 | + set -euo pipefail |
| 81 | + if [ ! -f "docs/assets/changelog/en/release.md" ]; then |
| 82 | + echo "Error: docs/assets/changelog/en/release.md not found in main." |
| 83 | + exit 1 |
| 84 | + fi |
| 85 | +
|
| 86 | + - name: Extract release body from main changelog |
| 87 | + id: body |
| 88 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' |
| 89 | + env: |
| 90 | + VERSION: ${{ steps.meta.outputs.version }} |
| 91 | + run: | |
| 92 | + set -euo pipefail |
| 93 | + node <<'NODE' |
| 94 | + const fs = require('fs'); |
| 95 | +
|
| 96 | + const version = process.env.VERSION; |
| 97 | + const changelogPath = 'docs/assets/changelog/en/release.md'; |
| 98 | + const content = fs.readFileSync(changelogPath, 'utf8'); |
| 99 | +
|
| 100 | + function escapeRegExp(str) { |
| 101 | + return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); |
| 102 | + } |
| 103 | +
|
| 104 | + const headerPattern = new RegExp('^#\\s*v?' + escapeRegExp(version) + '\\b', 'm'); |
| 105 | + const match = headerPattern.exec(content); |
| 106 | +
|
| 107 | + if (!match) { |
| 108 | + console.error('No changelog block for version', version, 'found in main changelog.'); |
| 109 | + process.exit(1); |
| 110 | + } |
| 111 | +
|
| 112 | + const startIndex = match.index; |
| 113 | + const rest = content.slice(startIndex); |
| 114 | +
|
| 115 | + // Find the next release header after the current one. |
| 116 | + const nextHeaderPattern = /^#\s*v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?[^\n]*$/gm; |
| 117 | + let nextIndex = rest.length; |
| 118 | + let m; |
| 119 | + while ((m = nextHeaderPattern.exec(rest)) !== null) { |
| 120 | + if (m.index > 0) { |
| 121 | + nextIndex = m.index; |
| 122 | + break; |
| 123 | + } |
| 124 | + } |
| 125 | +
|
| 126 | + const block = rest.slice(0, nextIndex).trimEnd() + '\n'; |
| 127 | + if (!block.trim()) { |
| 128 | + console.error('Extracted changelog block is empty for version', version); |
| 129 | + process.exit(1); |
| 130 | + } |
| 131 | + fs.writeFileSync('release-body.md', block, 'utf8'); |
| 132 | + NODE |
| 133 | + echo "has_body=true" >> "$GITHUB_OUTPUT" |
| 134 | +
|
| 135 | + - name: Validate extracted release body |
| 136 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true' |
| 137 | + env: |
| 138 | + VERSION: ${{ steps.meta.outputs.version }} |
| 139 | + run: | |
| 140 | + set -euo pipefail |
| 141 | + if [ ! -s "release-body.md" ]; then |
| 142 | + echo "Error: release-body.md is missing or empty." |
| 143 | + exit 1 |
| 144 | + fi |
| 145 | +
|
| 146 | + if ! grep -Eq "^#\\s*v?${VERSION}\\b" release-body.md; then |
| 147 | + echo "Error: release-body.md does not start with expected version header v${VERSION}." |
| 148 | + exit 1 |
| 149 | + fi |
| 150 | +
|
| 151 | + HEADER_COUNT="$(grep -Ec '^#\s*v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?\b' release-body.md || true)" |
| 152 | + if [ "${HEADER_COUNT}" -ne 1 ]; then |
| 153 | + echo "Error: extracted release body contains ${HEADER_COUNT} release headers, expected exactly 1." |
| 154 | + exit 1 |
| 155 | + fi |
| 156 | +
|
| 157 | + - name: Verify gh identity |
| 158 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true' |
| 159 | + env: |
| 160 | + GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }} |
| 161 | + run: | |
| 162 | + set -euo pipefail |
| 163 | + gh api user -q '.login' |
| 164 | +
|
| 165 | + - name: Diagnose PAT repository permission |
| 166 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true' |
| 167 | + env: |
| 168 | + GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }} |
| 169 | + run: | |
| 170 | + set -euo pipefail |
| 171 | + LOGIN=$(gh api user -q '.login') |
| 172 | + echo "PAT user: $LOGIN" |
| 173 | + OWNER=${GITHUB_REPOSITORY%%/*} |
| 174 | + REPO=${GITHUB_REPOSITORY#*/} |
| 175 | + RESP=$(gh api "/repos/$OWNER/$REPO/collaborators/$LOGIN/permission" 2>&1 || true) |
| 176 | + echo "$RESP" |
| 177 | + if echo "$RESP" | grep -q '404'; then |
| 178 | + echo "Not a collaborator (404), repository access may be restricted or PAT not authorized to org" |
| 179 | + elif echo "$RESP" | grep -q '"permission":"write"'; then |
| 180 | + echo "permission ok: write" |
| 181 | + elif echo "$RESP" | grep -q '"permission":"admin"'; then |
| 182 | + echo "permission ok: admin" |
| 183 | + else |
| 184 | + echo "permission insufficient: $RESP" |
| 185 | + fi |
| 186 | +
|
| 187 | + - name: Create tag and GitHub Release |
| 188 | + if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true' |
| 189 | + env: |
| 190 | + VERSION: ${{ steps.meta.outputs.version }} |
| 191 | + GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }} |
| 192 | + run: | |
| 193 | + set -euo pipefail |
| 194 | + TAG="v${VERSION}" |
| 195 | +
|
| 196 | + git fetch origin main:refs/remotes/origin/main --depth=1 |
| 197 | + MAIN_SHA="$(git rev-parse origin/main)" |
| 198 | +
|
| 199 | + echo "Creating tag ${TAG} at ${MAIN_SHA}" |
| 200 | + git tag "${TAG}" "${MAIN_SHA}" |
| 201 | + git push origin "${TAG}" |
| 202 | +
|
| 203 | + echo "Creating GitHub Release ${TAG}" |
| 204 | + gh release create "${TAG}" \ |
| 205 | + --target "main" \ |
| 206 | + --title "${TAG}" \ |
| 207 | + --notes-file "release-body.md" |
0 commit comments