Skip to content

Commit aed4d89

Browse files
pjfanningCopilot
pjfanning
and
Copilot
authored
Create stage-release-candidate.yml (#1161)
* Create stage-release-candidate.yml * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 21a46f5 commit aed4d89

1 file changed

Lines changed: 355 additions & 0 deletions

File tree

‎.github/workflows/stage-release-candidate.yml‎

Lines changed: 355 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,355 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
name: Stage release candidate
19+
20+
on:
21+
workflow_dispatch:
22+
inputs:
23+
source-tar-to-svn:
24+
description: "Stage the source tarball to svn (old)"
25+
default: true
26+
type: boolean
27+
source-tar-to-atr:
28+
description: "Stage the source tarball to ATR (new)"
29+
default: true
30+
type: boolean
31+
jars:
32+
description: "Stage the binary jars to nexus"
33+
default: true
34+
type: boolean
35+
email-template:
36+
description: "Generate vote email template"
37+
default: true
38+
type: boolean
39+
40+
permissions:
41+
contents: read
42+
43+
jobs:
44+
# Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate
45+
# Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml
46+
stage-release-candidate-to-svn:
47+
runs-on: ubuntu-24.04
48+
if: ${{ inputs.source-tar-to-svn }}
49+
steps:
50+
- name: Check version parameter
51+
run: |-
52+
# To be enabled after this workflow has been tested:
53+
#if [[ "$REF" != "v"* ]]; then
54+
# echo "Trigger this workflow on a version tag"
55+
# exit 1
56+
#fi
57+
if [[ "$REF" != *"-RC"* ]]; then
58+
echo "Trigger this workflow on an RC tag"
59+
exit 1
60+
fi
61+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
62+
export RC_VERSION=$(echo $REF | tail -c +2)
63+
echo "Version: $VERSION"
64+
echo "RC Version: $RC_VERSION"
65+
env:
66+
REF: ${{ github.ref_name }}
67+
68+
- name: Checkout
69+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
70+
with:
71+
fetch-depth: 0
72+
fetch-tags: true
73+
persist-credentials: false
74+
75+
- name: Generate source archive
76+
run: |-
77+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
78+
PREFIX=apache-pekko-http-$VERSION
79+
DATE=$(git log -n1 --format=%cs | tr -d -)
80+
TARBALL=$PREFIX-src-$DATE.tgz
81+
82+
mkdir archive
83+
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL
84+
cd archive
85+
sha512sum $TARBALL > $TARBALL.sha512
86+
env:
87+
REF: ${{ github.ref_name }}
88+
89+
- name: Sign source archive
90+
run: |-
91+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
92+
gpg -ab archive/*.tgz
93+
env:
94+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
95+
96+
- name: Install Apache Subversion
97+
run: |-
98+
sudo apt-get update
99+
sudo apt-get install -y subversion
100+
101+
- name: Upload source dist
102+
run: |-
103+
svn checkout https://dist.apache.org/repos/dist/dev/pekko dist
104+
cd dist
105+
106+
export RC_VERSION=$(echo $REF | tail -c +2)
107+
export DIR="HTTP-$RC_VERSION"
108+
109+
mkdir $DIR
110+
cp ../archive/* $DIR
111+
svn add $DIR
112+
svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR
113+
env:
114+
PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }}
115+
PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }}
116+
REF: ${{ github.ref_name }}
117+
118+
stage-release-candidate-to-atr:
119+
permissions:
120+
id-token: write
121+
contents: read
122+
runs-on: ubuntu-24.04
123+
if: ${{ inputs.source-tar-to-atr }}
124+
steps:
125+
- name: Check version parameter
126+
run: |-
127+
# To be enabled after this workflow has been tested:
128+
#if [[ "$REF" != "v"* ]]; then
129+
# echo "Trigger this workflow on a version tag"
130+
# exit 1
131+
#fi
132+
if [[ "$REF" != *"-RC"* ]]; then
133+
echo "Trigger this workflow on an RC tag"
134+
exit 1
135+
fi
136+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
137+
export RC_VERSION=$(echo $REF | tail -c +2)
138+
echo "Version: $VERSION"
139+
echo "RC Version: $RC_VERSION"
140+
env:
141+
REF: ${{ github.ref_name }}
142+
143+
- name: Checkout
144+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
145+
with:
146+
fetch-depth: 0
147+
fetch-tags: true
148+
persist-credentials: false
149+
150+
- name: Generate source archive
151+
id: generate-source-archive
152+
run: |-
153+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
154+
echo "version=$VERSION" >> $GITHUB_OUTPUT
155+
PREFIX=apache-pekko-http-$VERSION
156+
DATE=$(git log -n1 --format=%cs | tr -d -)
157+
TARBALL=$PREFIX-src-$DATE.tgz
158+
159+
mkdir dist
160+
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL
161+
cd dist
162+
sha512sum $TARBALL > $TARBALL.sha512
163+
env:
164+
REF: ${{ github.ref_name }}
165+
166+
- name: Sign source archive
167+
run: |-
168+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
169+
gpg -ab dist/*.tgz
170+
env:
171+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
172+
173+
- name: Upload source dist
174+
uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f
175+
with:
176+
project: pekko-http
177+
version: ${{ steps.generate-source-archive.outputs.version }}
178+
179+
stage-jars-to-nexus:
180+
runs-on: ubuntu-24.04
181+
if: ${{ inputs.jars }}
182+
steps:
183+
- name: Check version parameter
184+
run: |-
185+
# To be enabled after this workflow has been tested:
186+
#if [[ "$REF" != "v"* ]]; then
187+
# echo "Trigger this workflow on a version tag"
188+
# exit 1
189+
#fi
190+
if [[ "$REF" != *"-RC"* ]]; then
191+
echo "Trigger this workflow on an RC tag"
192+
exit 1
193+
fi
194+
export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/")
195+
export RC_VERSION=$(echo $REF | tail -c +2)
196+
echo "Version: $VERSION"
197+
echo "RC Version: $RC_VERSION"
198+
env:
199+
REF: ${{ github.ref_name }}
200+
201+
- name: Checkout
202+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
203+
with:
204+
fetch-depth: 0
205+
fetch-tags: true
206+
persist-credentials: false
207+
208+
- name: Setup Java 17
209+
uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
210+
with:
211+
distribution: temurin
212+
java-version: 17
213+
214+
- name: Install sbt
215+
uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0
216+
217+
- name: Install Graphviz
218+
run: |-
219+
sudo apt-get update
220+
sudo apt-get install -y graphviz
221+
222+
# We intentionally do not use the Coursier cache for release candiates,
223+
# to reduce attack surface
224+
225+
# It would be better to split this into 3 steps, where only the first
226+
# uses sbt and the signing/staging are done with well-known tools
227+
# reducing attack surface, but this seems to be the state of the art:
228+
- name: Build, sign and stage artifacts
229+
run: |-
230+
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
231+
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
232+
233+
sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned"
234+
sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose"
235+
env:
236+
REF: ${{ github.ref_name }}
237+
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
238+
SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
239+
SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }}
240+
241+
email-template:
242+
runs-on: ubuntu-24.04
243+
if: ${{ inputs.email-template }}
244+
steps:
245+
- name: Generate vote email template
246+
run: |-
247+
export MODULE="Pekko HTTP"
248+
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
249+
export RC_VERSION=$(echo $REF | tail -c +2)
250+
if [[ "$VERSION" =~ ^1\.([0-9]+)\.[0-9]+$ ]]; then
251+
export BRANCH="1.${BASH_REMATCH[1]}.x"
252+
else
253+
export BRANCH="main"
254+
fi
255+
echo "VERSION=$VERSION"
256+
echo "RC_VERSION=$RC_VERSION"
257+
echo "BRANCH=$BRANCH"
258+
259+
export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \")
260+
echo "DISCUSS=$DISCUSS"
261+
export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \")
262+
echo "DISCUSS_THREAD=$DISCUSS_THREAD"
263+
264+
export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1)
265+
echo "RELEASE_NOTES=$RELEASE_NOTES"
266+
267+
export SENDER=$(curl "https://api.github.com/users/$ACTOR" | jq .name | tr -d \")
268+
echo "SENDER=$SENDER"
269+
270+
echo "This template can be used to start a vote, either via manual email or via https://release-test.apache.org/compose/pekko-http/$VERSION"
271+
echo
272+
cat <<EOF;
273+
Subject: [VOTE] Release Apache $MODULE $RC_VERSION
274+
275+
Hello Pekko Community,
276+
277+
This is a call for a vote to release Apache $MODULE version $RC_VERSION
278+
279+
The discussion thread:
280+
281+
$DISCUSS_THREAD
282+
283+
The release candidate:
284+
285+
https://dist.apache.org/repos/dist/dev/pekko/HTTP-$RC_VERSION
286+
https://release-test.apache.org/vote/pekko-http/$VERSION
287+
288+
This release has been signed with a PGP key available here:
289+
290+
https://downloads.apache.org/pekko/KEYS
291+
292+
Release Notes:
293+
294+
$RELEASE_NOTES
295+
296+
Git branch for the release:
297+
298+
https://github.com/apache/pekko-http/tree/v$RC_VERSION
299+
Git commit ID: $COMMIT_SHA
300+
301+
Please download, verify, and test.
302+
303+
We have also staged jars in the Apache Nexus Repository. These were built with the same code
304+
as appears in this Source Release Candidate. We would appreciate if users could test with these too.
305+
If anyone finds any serious problems with these jars, please also notify us on this thread.
306+
307+
https://repository.apache.org/content/groups/staging/org/apache/pekko/
308+
309+
You can add this resolver to sbt with 'resolvers += Resolver.ApacheMavenStagingRepo'
310+
311+
The VOTE will pass if we have more positive votes than negative votes
312+
and there must be a minimum of 3 approvals from Pekko PMC members.
313+
Anyone voting in favour of the release, could you please provide a list of the checks you have done?
314+
The vote will be left open for at least 72hrs.
315+
316+
[ ] +1 approve
317+
[ ] +0 no opinion
318+
[ ] -1 disapprove with the reason
319+
320+
To learn more about Apache Pekko, please see https://pekko.apache.org/
321+
322+
Checklist for reference:
323+
324+
[ ] Download links are valid.
325+
[ ] Checksums and signatures.
326+
[ ] LICENSE/NOTICE files exist
327+
[ ] No unexpected binary files
328+
[ ] All source files have ASF headers
329+
[ ] Can compile from source
330+
[ ] Can verify the binary build
331+
332+
To compile from the source, please refer to:
333+
334+
https://github.com/apache/pekko-http/blob/$BRANCH/README.md#building-from-source
335+
336+
To verify the binary build, please refer to:
337+
338+
https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#verifying-the-binary-build
339+
340+
Some notes about verifying downloads can be found at:
341+
342+
https://pekko.apache.org/download.html#verifying-downloads
343+
344+
You can vote on ATR at https://release-test.apache.org/vote/pekko-http/$VERSION
345+
or manually by replying to this email.
346+
347+
348+
Thanks,
349+
350+
$SENDER (Apache Pekko PMC member)
351+
EOF
352+
env:
353+
REF: ${{ github.ref_name }}
354+
COMMIT_SHA: ${{ github.sha }}
355+
ACTOR: ${{ github.actor }}

0 commit comments

Comments
 (0)