From dd10e15b8a698641232f325aa803a1c94c5530ef Mon Sep 17 00:00:00 2001 From: Niklas Merz Date: Mon, 1 Jun 2026 08:27:51 +0200 Subject: [PATCH 1/5] chore(ci): add/update release workflows --- .github/workflows/release-audit.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-audit.yml b/.github/workflows/release-audit.yml index 52798d4af..d3d7067c9 100644 --- a/.github/workflows/release-audit.yml +++ b/.github/workflows/release-audit.yml @@ -34,13 +34,16 @@ jobs: runs-on: ubuntu-latest steps: # Checkout project - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 1 # Check license headers (v2.0.0) - uses: erisu/apache-rat-action@46fb01ce7d8f76bdcd7ab10e7af46e1ea95ca01c # Setup environment with node - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 From ab19e0fef2159fe5837369226a863d63eb8ad410 Mon Sep 17 00:00:00 2001 From: Niklas Merz Date: Mon, 1 Jun 2026 08:47:51 +0200 Subject: [PATCH 2/5] add .asf-release --- .asf-release/.gitkeep | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .asf-release/.gitkeep diff --git a/.asf-release/.gitkeep b/.asf-release/.gitkeep new file mode 100644 index 000000000..a926db80a --- /dev/null +++ b/.asf-release/.gitkeep @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# --- +# This directory is used as apart of the release process. +# Package tarballs will be generated in stored temporarily +# within this directory and should not be commited to repo. +# --- From e39f6281e915b6b6697e94158438160a4849248d Mon Sep 17 00:00:00 2001 From: Niklas Merz Date: Mon, 1 Jun 2026 09:16:17 +0200 Subject: [PATCH 3/5] update ignore files --- .gitignore | 4 ++++ .npmignore | 3 +++ .npmrc | 5 +++++ .rat-excludes | 22 ++++++++++++++++++++++ .ratignore | 4 +++- 5 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 .rat-excludes diff --git a/.gitignore b/.gitignore index 3e4cbb3d7..1d69092d3 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,7 @@ Thumbs.db *.user node_modules + +# ASF release workspace +.asf-release/ +!.asf-release/.gitkeep diff --git a/.npmignore b/.npmignore index 10b946b6b..355267948 100644 --- a/.npmignore +++ b/.npmignore @@ -17,3 +17,6 @@ .* tests + +# ASF release workspace +.asf-release/ diff --git a/.npmrc b/.npmrc index 7cff3238d..6f982f743 100644 --- a/.npmrc +++ b/.npmrc @@ -16,3 +16,8 @@ # under the License. registry=https://registry.npmjs.org + +# ASF release settings +git-tag-version=false +preid=dev +pack-destination=./.asf-release diff --git a/.rat-excludes b/.rat-excludes new file mode 100644 index 000000000..d7105358b --- /dev/null +++ b/.rat-excludes @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# This file used by ATR + +.git/ +node_modules/ +types/index.d.ts diff --git a/.ratignore b/.ratignore index 97a9a57f3..50341d415 100644 --- a/.ratignore +++ b/.ratignore @@ -1,4 +1,4 @@ -.ratignore# Licensed to the Apache Software Foundation (ASF) under one +# Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information # regarding copyright ownership. The ASF licenses this file @@ -15,6 +15,8 @@ # specific language governing permissions and limitations # under the License. +# This file used by release audit workflow + .git/ node_modules/ tests/resources/local.pdf From 544bfe07ab1de95c487f0ff7f1004c819076ab23 Mon Sep 17 00:00:00 2001 From: Erisu Date: Mon, 1 Jun 2026 16:37:44 +0900 Subject: [PATCH 4/5] chore(workflow): update release audit and merge rat exclude files --- .github/workflows/release-audit.yml | 8 ++++---- .rat-excludes | 3 +-- .ratignore | 23 ----------------------- 3 files changed, 5 insertions(+), 29 deletions(-) delete mode 100644 .ratignore diff --git a/.github/workflows/release-audit.yml b/.github/workflows/release-audit.yml index d3d7067c9..28a6b8758 100644 --- a/.github/workflows/release-audit.yml +++ b/.github/workflows/release-audit.yml @@ -39,8 +39,8 @@ jobs: persist-credentials: false fetch-depth: 1 - # Check license headers (v2.0.0) - - uses: erisu/apache-rat-action@46fb01ce7d8f76bdcd7ab10e7af46e1ea95ca01c + # Check license headers + - uses: erisu/apache-rat-action@30c94d10ed21e6f6fd5590dc5c158f58cae7a0dd # v3.0.0 # Setup environment with node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -51,8 +51,8 @@ jobs: - name: npm install packages run: npm ci - # Check node package licenses (v2.0.1) - - uses: erisu/license-checker-action@99cffa11264fe545fd0baa6c13bca5a00ae608f2 + # Check node package licenses + - uses: erisu/license-checker-action@04511f4c052b5773f11e1c65b42cda88235c62ae # v2.1.0 with: license-config: 'licence_checker.yml' include-asf-category-a: true diff --git a/.rat-excludes b/.rat-excludes index d7105358b..1c91a96ab 100644 --- a/.rat-excludes +++ b/.rat-excludes @@ -15,8 +15,7 @@ # specific language governing permissions and limitations # under the License. -# This file used by ATR - .git/ node_modules/ +tests/resources/local.pdf types/index.d.ts diff --git a/.ratignore b/.ratignore deleted file mode 100644 index 50341d415..000000000 --- a/.ratignore +++ /dev/null @@ -1,23 +0,0 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. - -# This file used by release audit workflow - -.git/ -node_modules/ -tests/resources/local.pdf -types/index.d.ts From 8624b09bd14b4a3291f033c610fc2684c631f69b Mon Sep 17 00:00:00 2001 From: Erisu Date: Mon, 1 Jun 2026 16:38:07 +0900 Subject: [PATCH 5/5] chore(workflow): add draft release --- .github/workflows/draft-release.yml | 155 ++++++++++++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 .github/workflows/draft-release.yml diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml new file mode 100644 index 000000000..d98bbc394 --- /dev/null +++ b/.github/workflows/draft-release.yml @@ -0,0 +1,155 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Draft Release + +on: + push: + tags: + - 'draft/**' + +permissions: + contents: read + id-token: write + +jobs: + upload-to-atr: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 1 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 24 + package-manager-cache: false + cache: '' + + - name: Setup environment variables + run: | + REPO_NAME="${GITHUB_REPOSITORY#*/}" + TAG_NAME="${GITHUB_REF#refs/tags/}" + TARGET_RELEASE_VERSION="${TAG_NAME#draft/}" + SRC_PACKAGE_NAME=${REPO_NAME}-source-${TARGET_RELEASE_VERSION} + SRC_PACKAGE_TAR=${SRC_PACKAGE_NAME}.tar + SRC_PACKAGE_TAR_GZ=${SRC_PACKAGE_NAME}.tar.gz + SRC_PACKAGE_ZIP=${SRC_PACKAGE_NAME}.zip + NPM_PACKAGE_NAME=${REPO_NAME}-npm-${TARGET_RELEASE_VERSION} + + echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV + echo "TAG_NAME=$TAG_NAME" >> $GITHUB_ENV + echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION" >> $GITHUB_ENV + echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME" >> $GITHUB_ENV + echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR" >> $GITHUB_ENV + echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ" >> $GITHUB_ENV + echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP" >> $GITHUB_ENV + echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME" >> $GITHUB_ENV + + echo "REPO_NAME=$REPO_NAME" + echo "TAG_NAME=$TAG_NAME" + echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION" + echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME" + echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR" + echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ" + echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP" + echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME" + + - name: Verify Target Release Version + run: | + PACKAGE_VERSION=$(jq -r '.version' package.json) + if [ "$PACKAGE_VERSION" != "$TARGET_RELEASE_VERSION" ]; then + echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and package version ($PACKAGE_VERSION)" + exit 1 + fi + + if [ -f "plugin.xml" ]; then + PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml | jq -r .) + if [ "$PLUGIN_VERSION" != "$TARGET_RELEASE_VERSION" ]; then + echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and plugin version ($PLUGIN_VERSION)" + exit 1 + fi + fi + + - name: Generate "tgz" npm convenience package + run: |- + npm ci + NPM_PKG_NAME=$(npm pack --json | jq -r '.[0].filename') + mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${NPM_PACKAGE_NAME}.tgz + env: + TZ: UTC + + - name: Generate "tar" source package + run: |- + export SRC_LAST_COMMIT_EPOCH=$(git log -1 --format=%ct "$TAG_NAME") + + git archive \ + --prefix=$SRC_PACKAGE_NAME/ \ + --mtime=$SRC_LAST_COMMIT_EPOCH \ + -o ./.asf-release/${SRC_PACKAGE_TAR} \ + $TAG_NAME + env: + TZ: UTC + + - name: Generate "tar.gz" source archive + working-directory: ./.asf-release + run: |- + gzip -n -9 -c "$SRC_PACKAGE_TAR" > "$SRC_PACKAGE_TAR_GZ" + env: + TZ: UTC + + - name: Generate "zip" source archive + working-directory: ./.asf-release + run: |- + export ASF_RELEASE_DIR=$(pwd) + export TMP_DIR=$(mktemp -d) + + tar -xf "$SRC_PACKAGE_TAR" -C "$TMP_DIR" + ( + cd "$TMP_DIR" + find . -type f | LC_ALL=C sort | zip -X -q "$ASF_RELEASE_DIR/$SRC_PACKAGE_ZIP" -@ + ) + rm -rf $TMP_DIR + env: + TZ: UTC + + - name: Cleanup Process + working-directory: ./.asf-release + run: |- + rm -rf $SRC_PACKAGE_TAR + rm -rf .gitkeep + + - name: Create Sign and Checksum + working-directory: .asf-release + run: |- + for f in *.tar.gz *.tgz *.zip; do + [ -e "$f" ] || continue + echo "$CORDOVA_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg --armor --detach-sign "$f" + sha512sum "$f" > "${f}.sha512" + done + env: + CORDOVA_GPG_SECRET_KEY: ${{ secrets.CORDOVA_GPG_SECRET_KEY }} + + - name: Upload to Apache Trusted Release (ATR) + uses: apache/tooling-actions/upload-to-atr@f5f4c0e7ddfbde6b1f8288cef36324c6def68051 + with: + project: ${{ env.REPO_NAME }} + version: ${{ env.TARGET_RELEASE_VERSION }} + src: .asf-release