zero/.github/workflows/promote.yml at main · wevm/zero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
name: Promote Zero Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Stable Zero version to promote, e.g. 1.8.0
        required: true
        type: string

permissions: {}

concurrency:
  group: zero-promote-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  validate:
    name: Validate release
    # Releases publish from the public repo only. This file also exists in
    # rocicorp/mono-internal, where skipping this job skips every job that
    # needs it.
    if: github.repository == 'rocicorp/mono'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.validate.outputs.version }}
      tag: ${{ steps.validate.outputs.tag }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Validate release
        id: validate
        env:
          VERSION: ${{ inputs.version }}
          WORKFLOW_REF_NAME: ${{ github.ref_name }}
        run: node --experimental-strip-types --no-warnings scripts/src/promote-validate.ts

  promote-docker:
    name: Promote Docker latest
    runs-on: ubuntu-latest
    needs: validate
    environment:
      name: zero-promote-docker
    permissions:
      id-token: write # For Docker Hub OIDC and cosign.
      packages: write # To update GHCR latest.
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        env:
          DOCKERHUB_OIDC_CONNECTIONID: 2b3442aa-9cf7-4a13-afce-535dece25f7a
        with:
          username: rocicorp

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Promote Docker tags
        run: |
          docker buildx imagetools create -t "rocicorp/zero:latest" "rocicorp/zero:$VERSION"
          docker buildx imagetools create -t "ghcr.io/rocicorp/zero:latest" "ghcr.io/rocicorp/zero:$VERSION"

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign Docker latest tags
        run: |
          cosign sign --yes "docker.io/rocicorp/zero:latest"
          cosign sign --yes "ghcr.io/rocicorp/zero:latest"

  promote-git:
    name: Promote git latest tag
    runs-on: ubuntu-latest
    needs: [validate, promote-docker]
    permissions:
      contents: write # To move the git latest tag.
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - name: Checkout repository
        # zizmor: ignore[artipacked] Keep the token needed to push the tag.
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Move git latest tag
        run: |
          git tag --force latest "zero/v$VERSION"
          git push --force origin refs/tags/latest:refs/tags/latest

      - name: Summarize manual npm promotion
        run: |
          {
            printf '## Manual npm promotion\n\n'
            printf 'Docker and git `latest` have been promoted for `%s`.\n\n' "$VERSION"
            printf 'Run these commands locally to promote npm:\n\n'
            printf '```sh\n'
            printf 'pnpm dist-tag add "@rocicorp/zero@%s" latest\n' "$VERSION"
            printf 'pnpm dist-tag rm "@rocicorp/zero" staging\n'
            printf 'pnpm dist-tag ls "@rocicorp/zero"\n'
            printf '```\n'
          } >> "$GITHUB_STEP_SUMMARY"