Skip to content

Commit b38e152

Browse files
mkuznyetsovmkuznyetsov
authored
chore: enable Trusted Publishing (#23882)
Signed-off-by: Mykhailo Kuznietsov <mkuznets@redhat.com>
1 parent 0a559c2 commit b38e152

2 files changed

Lines changed: 106 additions & 24 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -106,17 +106,3 @@ jobs:
106106
pushd tests/e2e >/dev/null || exit
107107
npm ci && npm run tsc && npm publish
108108
popd >/dev/null || exit
109-
#- name: Create failure MM message
110-
#if: ${{ failure() }}
111-
#run: |
112-
#echo "{\"text\":\":no_entry_sign: Che E2E Tests ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse/che/actions/workflows/release.yml\"}" > mattermost.json
113-
#- name: Create success MM message
114-
#run: |
115-
#echo "{\"text\":\":white_check_mark: Che E2E Tests image and generator ${{ github.event.inputs.version }} release job is complete: \n Performed tagging and container build of new image: https://quay.io/eclipse/che-e2e:${{ github.event.inputs.version }}. \n Published package to npmjs https://www.npmjs.com/package/@eclipse-che/che-e2e/v/${{ github.event.inputs.version }}.\"}" > mattermost.json
116-
#- name: Send MM message
117-
#if: ${{ success() }} || ${{ failure() }}
118-
#uses: mattermost/action-mattermost-notify@1.1.0
119-
#env:
120-
#MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
121-
#MATTERMOST_CHANNEL: eclipse-che-releases
122-
#MATTERMOST_USERNAME: che-bot

‎.github/workflows/typescript-publish.yml‎

Lines changed: 106 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,19 @@
77
# SPDX-License-Identifier: EPL-2.0
88
#
99

10-
name: Publish Next Che E2E Tests to npmjs
10+
name: Build/Publish Next Che E2E Tests to npmjs
1111

1212
on:
1313
workflow_dispatch:
14+
inputs:
15+
release-version:
16+
description: 'release version in format 7.y.z'
17+
required: true
18+
release-remake:
19+
description: 'set to true to recreate existing tags (otherwise release will fail if tags already exist)'
20+
type: boolean
21+
default: false
22+
required: true
1423
push:
1524
branches:
1625
- main
@@ -23,6 +32,35 @@ jobs:
2332
publish:
2433
runs-on: ubuntu-22.04
2534
steps:
35+
- name: Validate parameters and build type
36+
shell: bash
37+
id: dist-tag-eval
38+
run: |
39+
# check if workflow is triggered manually (release) or via branch push (next build)
40+
# release will always be performed as workflow_dispatch trigger, while push triggers are for dev/next builds
41+
# based on this information, we determine the dist-tag for pushing to npmjs
42+
DIST_TAG=
43+
if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
44+
RELEASE_VERSION=${{ github.event.inputs.release-version }}
45+
if [[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
46+
echo "[INFO]" preparing to build and release with version: $RELEASE_VERSION
47+
# DIST_TAG is not used in make-release.sh, as release version will always be latest anyway
48+
DIST_TAG=latest
49+
else
50+
echo "[ERROR] incorrect version "$RELEASE_VERSION". Must be following format <number>.<number>.<number>, e.g. 7.111.0"
51+
exit 1
52+
fi
53+
fi
54+
if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
55+
if [[ ${GITHUB_REF##*/} == "7."**".x" ]]; then
56+
echo "[INFO] using ${GITHUB_REF##*/} tag"
57+
DIST_TAG="next-${GITHUB_REF##*/}"
58+
else
59+
echo "[INFO] using "next" tag"
60+
DIST_TAG=next
61+
fi
62+
fi
63+
echo "npm_dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
2664
- uses: actions/setup-node@v3
2765
with:
2866
node-version: '16'
@@ -32,24 +70,82 @@ jobs:
3270
uses: actions/checkout@v3
3371
with:
3472
fetch-depth: 0
35-
- name: publish
73+
- name: Check existing release tags
74+
if: github.event_name == 'workflow_dispatch'
3675
env:
37-
NODE_AUTH_TOKEN: ${{secrets.CHE_NPM_AUTH_TOKEN}}
76+
GITHUB_TOKEN: ${{secrets.CHE_BOT_GITHUB_TOKEN}}
3877
run: |
39-
if [[ ${GITHUB_REF##*/} == "7."**".x" ]]; then
40-
echo "[INFO] using ${GITHUB_REF##*/} tag"
41-
DIST_TAG=next-${GITHUB_REF##*/}
78+
set +e
79+
RECREATE_TAGS=${{ github.event.inputs.release-remake }}
80+
VERSION=${{ github.event.inputs.release-version }}
81+
EXISTING_TAG=$(git ls-remote --exit-code origin refs/tags/${VERSION})
82+
if [[ -n ${EXISTING_TAG} ]]; then
83+
if [[ ${RECREATE_TAGS} == "true" ]]; then
84+
echo "[INFO] Removing tag for ${VERSION} version. New tag will be recreated during release."
85+
git push origin :${VERSION}
86+
else
87+
echo "[ERROR] Cannot proceed with release - tag ${EXISTING_TAG} already exists."
88+
exit 1
89+
fi
4290
else
43-
echo "[INFO] using "next" tag"
44-
DIST_TAG=next
91+
echo "[INFO] No existing tags detected for ${VERSION}"
4592
fi
93+
- name: "Set up QEMU"
94+
if: github.event.inputs.release-version == 'true'
95+
uses: docker/setup-qemu-action@v2
96+
- name: "Docker quay.io Login"
97+
if: github.event.inputs.release-version == 'true'
98+
uses: docker/login-action@v2
99+
with:
100+
registry: quay.io
101+
username: ${{ secrets.QUAY_USERNAME }}
102+
password: ${{ secrets.QUAY_PASSWORD }}
103+
- name: Login to docker.io
104+
if: github.event.inputs.release-version == 'true'
105+
uses: docker/login-action@v2
106+
with:
107+
registry: docker.io
108+
username: ${{ secrets.DOCKERHUB_USERNAME }}
109+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
110+
- name: Set up yq
111+
if: github.event.inputs.release-version == 'true'
112+
run: |
113+
sudo wget https://github.com/mikefarah/yq/releases/download/v4.7.0/yq_linux_amd64 -O /usr/bin/yq
114+
sudo chmod +x /usr/bin/yq
115+
- name: Perform a release
116+
if: github.event.inputs.release-version == 'true'
117+
run: |
118+
git config --global user.name "Mykhailo Kuznietsov"
119+
git config --global user.email "mkuznets@redhat.com"
120+
git config --global pull.rebase true
46121
122+
export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
123+
./make-release.sh --version ${{ github.event.inputs.version}}
124+
- name: Build and publish next version
125+
if: github.event_name == 'push'
126+
run: |
47127
cd tests/e2e
48-
npm ci && npm run tsc
49128
50129
SHORT_SHA1=$(git rev-parse --short=7 HEAD)
51130
CURRENT_VERSION=$(sed -r 's/(.*)-next/\1/' ../../VERSION)
52131
NEW_VERSION="${CURRENT_VERSION}-next-${SHORT_SHA1}"
53132
sed -i -r -e "s/(\"version\": )(\".*\")/\1\"$NEW_VERSION\"/" package.json
54133
55-
npm publish --tag $DIST_TAG
134+
npm ci && npm run tsc
135+
136+
# uncomment this publishing, when steps below are removed
137+
#npm publish ${{ steps.dist-tag-eval.outputs.npm_dist_tag }}
138+
139+
# newer npm version is required for Trusted publishing
140+
# remove the steps of npm below, once build will be updated to newer version
141+
- name: Change node version for publishing
142+
uses: actions/setup-node@v3
143+
with:
144+
node-version: '24'
145+
registry-url: 'https://registry.npmjs.org'
146+
scope: '@eclipse-che'
147+
- name: Publish
148+
run: |
149+
cd tests/e2e
150+
# --ignore-scripts parameter is needed to prevent recompilation
151+
npm publish --ignore-scripts --tag ${{ steps.dist-tag-eval.outputs.npm_dist_tag }}

0 commit comments

Comments
 (0)