amp-postmaster/.github/workflows/release-build.yml at 6e2b0fd161aee5d74676a18bfbb33dc28d77d464 · philips-software/amp-postmaster · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
---
name: Release Build

on:
  release:
    types: [published]

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

permissions: {}

jobs:
  build:
    name: Build
    strategy:
      matrix:
        target: ["host", "stm32f407", "windows"]
        configuration: ["RelWithDebInfo"]
    uses: ./.github/workflows/wc-continuous-integration.yml
    with:
      target: ${{ matrix.target }}
      configuration: ${{ matrix.configuration }}

  upgrade-pack:
    name: Build Upgrade Pack
    needs: [build]
    uses: ./.github/workflows/wc-upgrade-pack.yml
    with:
      version: ${{ github.ref_name }}

  apply-release-notes-template:
    name: 📝 Apply Release Template
    runs-on: ubuntu-latest
    permissions:
      # Please note that this is an overly broad scope, but GitHub does not
      # currently provide a more fine-grained permission for release modification.
      contents: write # is needed to modify a release
    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Amend release description
        run: |
          set -Eeuo pipefail
          CURRENT_NOTES=$(gh release view "${REF_NAME}" --json body -q '.body')
          HEADER=$(echo "$CURRENT_NOTES" | awk '/^## / {print; exit}')
          TEMPLATE=$(cat "$GITHUB_WORKSPACE/.github/RELEASE_TEMPLATE.md")
          BODY=$(echo "$CURRENT_NOTES" | sed "0,/^## /d")
          gh release edit "${REF_NAME}" --notes "${HEADER}${TEMPLATE}${BODY}"
        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}

  update-release-notes:
    name: Update Release Notes (🍨 ${{ matrix.flavor }})
    strategy:
      matrix:
        flavor: [flex]
    runs-on: ubuntu-latest
    permissions:
      # Please note that this is an overly broad scope, but GitHub does not
      # currently provide a more fine-grained permission for release modification.
      contents: write # is needed to modify a release
    needs: [build, apply-release-notes-template]
    env:
      CONTAINER_FLAVOR: ${{ matrix.flavor }}
      REF_NAME: ${{ github.ref_name }}
      REGISTRY: ghcr.io
    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit
      - name: Inspect manifest and extract digest
        id: inspect-manifest
        run: |
          set -Eeuo pipefail
          output=$(docker buildx imagetools inspect "${REGISTRY}/${GH_REPO}-${CONTAINER_FLAVOR}:${REF_NAME}" --format '{{json .}}')
          echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
        env:
          GH_REPO: ${{ github.repository }}
      - name: Update package details in release
        run: |
          set -Eeuo pipefail
          UPDATED_NOTES=$(gh release view "${REF_NAME}" --json body -q '.body')
          UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-postmaster-${CONTAINER_FLAVOR}-version }}"/"${REF_NAME}"}
          UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-postmaster-${CONTAINER_FLAVOR}-sha }}"/"${DIGEST}"}
          gh release edit "${REF_NAME}" --notes "${UPDATED_NOTES}"
        env:
          DIGEST: ${{ steps.inspect-manifest.outputs.digest }}
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}

  upload-binaries:
    name: 📄 Upload Binaries
    runs-on: ubuntu-latest
    permissions:
      # Please note that this is an overly broad scope, but GitHub does not
      # currently provide a more fine-grained permission for release modification.
      contents: write # is needed to modify a release
    needs: [build]
    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          disable-sudo: true
          egress-policy: audit
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: postmaster
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: UpgradePack
      - name: Upload binaries to release
        run: |
          set -Eeuo pipefail
          gh release upload "${REF_NAME}" ./Postmaster-*-Generic-ELF.tar.gz
          gh release upload "${REF_NAME}" ./Postmaster-*.upg
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}

  comment-released-prs:
    name: Comment on released PRs
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write # is needed by rdlf0/comment-released-prs-action to post comments on PRs
    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit
      - uses: rdlf0/comment-released-prs-action@a81897eaea04a5faa8779d28607826ddb033321a # v3.1.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}