Publish Release #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version tag for the release (e.g., 2026-02-16)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| env: | |
| TOFU_VERSION: "1.11.4" | |
| jobs: | |
| validate-modules: | |
| name: Format and Validate Modules | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup OpenTofu | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ env.TOFU_VERSION }} | |
| - name: Initialize and validate all modules | |
| run: | | |
| echo "Initializing and validating all Terraform modules..." | |
| failed_modules="" | |
| for module in modules/*/; do | |
| echo "============================================" | |
| echo "Processing: $module" | |
| echo "============================================" | |
| cd "$module" | |
| echo "Running tofu init..." | |
| if ! tofu init -backend=false; then | |
| echo "::error::tofu init failed for $module" | |
| failed_modules="$failed_modules $module" | |
| cd - > /dev/null | |
| continue | |
| fi | |
| echo "Running tofu validate..." | |
| if ! tofu validate; then | |
| echo "::error::tofu validate failed for $module" | |
| failed_modules="$failed_modules $module" | |
| else | |
| echo "✓ $module validated successfully" | |
| fi | |
| cd - > /dev/null | |
| done | |
| if [[ -n "$failed_modules" ]]; then | |
| echo "::error::The following modules failed validation:$failed_modules" | |
| exit 1 | |
| fi | |
| echo "All modules validated successfully!" | |
| - name: Determine version | |
| id: version | |
| run: | | |
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| VERSION="${{ inputs.version }}" | |
| else | |
| VERSION="${{ github.ref_name }}" | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "Release version: $VERSION" | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| gh release create "$VERSION" \ | |
| --title "$VERSION" \ | |
| --generate-notes \ | |
| $PRERELEASE_FLAG | |
| - name: Download release artifacts for attestation | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| mkdir -p release-artifacts | |
| gh release download "$VERSION" --archive=tar.gz --dir release-artifacts | |
| gh release download "$VERSION" --archive=zip --dir release-artifacts | |
| ls -la release-artifacts/ | |
| - name: Generate provenance attestation | |
| id: attestation | |
| uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 | |
| with: | |
| subject-path: release-artifacts/* | |
| - name: Upload attestation to release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| gh release upload "$VERSION" "${{ steps.attestation.outputs.bundle-path }}" --clobber |