Create stage-release-candidate.yml #1161
+355
−0
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,355 @@ | ||
| # Licensed to the Apache Software Foundation (ASF) under one | ||
| # or more contributor license agreements. See the NOTICE file | ||
| # distributed with this work for additional information | ||
| # regarding copyright ownership. The ASF licenses this file | ||
| # to you under the Apache License, Version 2.0 (the | ||
| # "License"); you may not use this file except in compliance | ||
| # with the License. You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, | ||
| # software distributed under the License is distributed on an | ||
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| # KIND, either express or implied. See the License for the | ||
| # specific language governing permissions and limitations | ||
| # under the License. | ||
|
|
||
| name: Stage release candidate | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| source-tar-to-svn: | ||
| description: "Stage the source tarball to svn (old)" | ||
| default: true | ||
| type: boolean | ||
| source-tar-to-atr: | ||
| description: "Stage the source tarball to ATR (new)" | ||
| default: true | ||
| type: boolean | ||
| jars: | ||
| description: "Stage the binary jars to nexus" | ||
| default: true | ||
| type: boolean | ||
| email-template: | ||
| description: "Generate vote email template" | ||
| default: true | ||
| type: boolean | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate | ||
| # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml | ||
| stage-release-candidate-to-svn: | ||
| runs-on: ubuntu-24.04 | ||
| if: ${{ inputs.source-tar-to-svn }} | ||
| steps: | ||
| - name: Check version parameter | ||
| run: |- | ||
| # To be enabled after this workflow has been tested: | ||
| #if [[ "$REF" != "v"* ]]; then | ||
| # echo "Trigger this workflow on a version tag" | ||
| # exit 1 | ||
| #fi | ||
| if [[ "$REF" != *"-RC"* ]]; then | ||
| echo "Trigger this workflow on an RC tag" | ||
| exit 1 | ||
| fi | ||
| export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| echo "Version: $VERSION" | ||
| echo "RC Version: $RC_VERSION" | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| fetch-tags: true | ||
| persist-credentials: false | ||
|
|
||
| - name: Generate source archive | ||
| run: |- | ||
| VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| PREFIX=apache-pekko-http-$VERSION | ||
| DATE=$(git log -n1 --format=%cs | tr -d -) | ||
| TARBALL=$PREFIX-src-$DATE.tgz | ||
|
|
||
| mkdir archive | ||
| git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL | ||
| cd archive | ||
| sha512sum $TARBALL > $TARBALL.sha512 | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Sign source archive | ||
| run: |- | ||
| echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show | ||
| gpg -ab archive/*.tgz | ||
| env: | ||
| PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} | ||
|
|
||
| - name: Install Apache Subversion | ||
| run: |- | ||
| sudo apt-get update | ||
| sudo apt-get install -y subversion | ||
|
|
||
| - name: Upload source dist | ||
| run: |- | ||
| svn checkout https://dist.apache.org/repos/dist/dev/pekko dist | ||
| cd dist | ||
|
|
||
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| export DIR="HTTP-$RC_VERSION" | ||
|
|
||
| mkdir $DIR | ||
| cp ../archive/* $DIR | ||
| svn add $DIR | ||
| svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR | ||
| env: | ||
| PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} | ||
| PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| stage-release-candidate-to-atr: | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| runs-on: ubuntu-24.04 | ||
| if: ${{ inputs.source-tar-to-atr }} | ||
| steps: | ||
| - name: Check version parameter | ||
| run: |- | ||
| # To be enabled after this workflow has been tested: | ||
| #if [[ "$REF" != "v"* ]]; then | ||
| # echo "Trigger this workflow on a version tag" | ||
| # exit 1 | ||
| #fi | ||
| if [[ "$REF" != *"-RC"* ]]; then | ||
| echo "Trigger this workflow on an RC tag" | ||
| exit 1 | ||
| fi | ||
| export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| echo "Version: $VERSION" | ||
| echo "RC Version: $RC_VERSION" | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| fetch-tags: true | ||
| persist-credentials: false | ||
|
|
||
| - name: Generate source archive | ||
| id: generate-source-archive | ||
| run: |- | ||
| VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||
| PREFIX=apache-pekko-http-$VERSION | ||
| DATE=$(git log -n1 --format=%cs | tr -d -) | ||
| TARBALL=$PREFIX-src-$DATE.tgz | ||
|
|
||
| mkdir dist | ||
| git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL | ||
| cd dist | ||
| sha512sum $TARBALL > $TARBALL.sha512 | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Sign source archive | ||
| run: |- | ||
| echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show | ||
| gpg -ab dist/*.tgz | ||
| env: | ||
| PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} | ||
|
|
||
| - name: Upload source dist | ||
| uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f | ||
| with: | ||
| project: pekko-http | ||
| version: ${{ steps.generate-source-archive.outputs.version }} | ||
|
|
||
| stage-jars-to-nexus: | ||
| runs-on: ubuntu-24.04 | ||
| if: ${{ inputs.jars }} | ||
| steps: | ||
| - name: Check version parameter | ||
| run: |- | ||
| # To be enabled after this workflow has been tested: | ||
| #if [[ "$REF" != "v"* ]]; then | ||
| # echo "Trigger this workflow on a version tag" | ||
| # exit 1 | ||
| #fi | ||
| if [[ "$REF" != *"-RC"* ]]; then | ||
| echo "Trigger this workflow on an RC tag" | ||
| exit 1 | ||
| fi | ||
| export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") | ||
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| echo "Version: $VERSION" | ||
| echo "RC Version: $RC_VERSION" | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| fetch-tags: true | ||
| persist-credentials: false | ||
|
|
||
| - name: Setup Java 17 | ||
| uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 | ||
| with: | ||
| distribution: temurin | ||
| java-version: 17 | ||
|
|
||
| - name: Install sbt | ||
| uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 | ||
|
|
||
| - name: Install Graphviz | ||
| run: |- | ||
| sudo apt-get update | ||
| sudo apt-get install -y graphviz | ||
|
|
||
| # We intentionally do not use the Coursier cache for release candiates, | ||
| # to reduce attack surface | ||
|
|
||
| # It would be better to split this into 3 steps, where only the first | ||
| # uses sbt and the signing/staging are done with well-known tools | ||
| # reducing attack surface, but this seems to be the state of the art: | ||
| - name: Build, sign and stage artifacts | ||
| run: |- | ||
| VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show | ||
|
|
||
| sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned" | ||
| sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose" | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
| PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} | ||
| SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }} | ||
| SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }} | ||
|
|
||
| email-template: | ||
| runs-on: ubuntu-24.04 | ||
| if: ${{ inputs.email-template }} | ||
| steps: | ||
| - name: Generate vote email template | ||
| run: |- | ||
| export MODULE="Pekko HTTP" | ||
| export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| if [[ "$VERSION" =~ ^1\.([0-9]+)\.[0-9]+$ ]]; then | ||
| export BRANCH="1.${BASH_REMATCH[1]}.x" | ||
| else | ||
| export BRANCH="main" | ||
| fi | ||
| echo "VERSION=$VERSION" | ||
| echo "RC_VERSION=$RC_VERSION" | ||
| echo "BRANCH=$BRANCH" | ||
|
|
||
| export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \") | ||
| echo "DISCUSS=$DISCUSS" | ||
| export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \") | ||
| echo "DISCUSS_THREAD=$DISCUSS_THREAD" | ||
|
|
||
| export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1) | ||
|
Member
There was a problem hiding this comment. The GitHub API default pagination is 30 items per page. This repo has 1000+ PRs, so if the "Release notes for $VERSION" PR isn't among the 30 most recently updated ones, this grep will fail silently and Adding gh pr list --repo apache/pekko-http --state all \
--search "Release notes for $VERSION in:title" \
--json number --jq '"https://github.com/apache/pekko-http/pull/" + (.[0].number | tostring)'Minor concern since for 1.4.0 the release-notes PR will likely be recent enough, but worth hardening before this workflow is reused for future releases.
Member
Author
There was a problem hiding this comment. this is a copy of a script we have in lots of places and it's been working ok - I'd prefer to keep the script as is since this PR does not target main and the improvements should go there first The generated email is just a template, easily fixed by hand. This CI script simply doesn't need to be bomb-proof. |
||
| echo "RELEASE_NOTES=$RELEASE_NOTES" | ||
|
|
||
| export SENDER=$(curl "https://api.github.com/users/$ACTOR" | jq .name | tr -d \") | ||
| echo "SENDER=$SENDER" | ||
|
|
||
| echo "This template can be used to start a vote, either via manual email or via https://release-test.apache.org/compose/pekko-http/$VERSION" | ||
| echo | ||
| cat <<EOF; | ||
| Subject: [VOTE] Release Apache $MODULE $RC_VERSION | ||
|
|
||
| Hello Pekko Community, | ||
|
|
||
| This is a call for a vote to release Apache $MODULE version $RC_VERSION | ||
|
|
||
| The discussion thread: | ||
|
|
||
| $DISCUSS_THREAD | ||
|
|
||
| The release candidate: | ||
|
|
||
| https://dist.apache.org/repos/dist/dev/pekko/HTTP-$RC_VERSION | ||
| https://release-test.apache.org/vote/pekko-http/$VERSION | ||
|
|
||
| This release has been signed with a PGP key available here: | ||
|
|
||
| https://downloads.apache.org/pekko/KEYS | ||
|
|
||
| Release Notes: | ||
|
|
||
| $RELEASE_NOTES | ||
|
|
||
| Git branch for the release: | ||
|
|
||
| https://github.com/apache/pekko-http/tree/v$RC_VERSION | ||
| Git commit ID: $COMMIT_SHA | ||
|
|
||
| Please download, verify, and test. | ||
|
|
||
| We have also staged jars in the Apache Nexus Repository. These were built with the same code | ||
| as appears in this Source Release Candidate. We would appreciate if users could test with these too. | ||
| If anyone finds any serious problems with these jars, please also notify us on this thread. | ||
|
|
||
| https://repository.apache.org/content/groups/staging/org/apache/pekko/ | ||
|
|
||
| You can add this resolver to sbt with 'resolvers += Resolver.ApacheMavenStagingRepo' | ||
|
|
||
| The VOTE will pass if we have more positive votes than negative votes | ||
| and there must be a minimum of 3 approvals from Pekko PMC members. | ||
| Anyone voting in favour of the release, could you please provide a list of the checks you have done? | ||
| The vote will be left open for at least 72hrs. | ||
|
|
||
| [ ] +1 approve | ||
| [ ] +0 no opinion | ||
| [ ] -1 disapprove with the reason | ||
|
|
||
| To learn more about Apache Pekko, please see https://pekko.apache.org/ | ||
|
|
||
| Checklist for reference: | ||
|
|
||
| [ ] Download links are valid. | ||
| [ ] Checksums and signatures. | ||
| [ ] LICENSE/NOTICE files exist | ||
| [ ] No unexpected binary files | ||
| [ ] All source files have ASF headers | ||
| [ ] Can compile from source | ||
| [ ] Can verify the binary build | ||
|
|
||
| To compile from the source, please refer to: | ||
|
|
||
| https://github.com/apache/pekko-http/blob/$BRANCH/README.md#building-from-source | ||
|
|
||
| To verify the binary build, please refer to: | ||
|
|
||
| https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#verifying-the-binary-build | ||
|
|
||
| Some notes about verifying downloads can be found at: | ||
|
|
||
| https://pekko.apache.org/download.html#verifying-downloads | ||
|
|
||
| You can vote on ATR at https://release-test.apache.org/vote/pekko-http/$VERSION | ||
| or manually by replying to this email. | ||
|
|
||
|
|
||
| Thanks, | ||
|
|
||
| $SENDER (Apache Pekko PMC member) | ||
| EOF | ||
| env: | ||
| REF: ${{ github.ref_name }} | ||
| COMMIT_SHA: ${{ github.sha }} | ||
| ACTOR: ${{ github.actor }} | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This sed pattern is missing the leading
.that all the other jobs use. With tagv1.4.0-RC1:The "Build, sign and stage artifacts" step (line 230) uses the correct pattern, so artifacts are not mis-versioned — but this check step prints
Version: v1.4.0in the log, which is misleading when debugging. This same copy-paste bug also exists in apache/pekko line 193.Suggest aligning with the other jobs:
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")