socket-cli/.github/workflows/github-release.yml at main · SocketDev/socket-cli · GitHub

View runs

History

195 lines (189 loc) · 8.88 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

run-name: GitHub release

# PRESET — seeded once from template/presets/ (onboarding or first cascade),

# then repo-owned: customize what THIS repo releases. The fleet base actions

# do the heavy lifting — github-release-app-token mints the release App token,

# github-release cuts the immutable 3-step release tied to the pushed tag

# (create --draft → upload assets → edit --draft=false).

# Default flow: push a signed v* tag → this workflow cuts a GitHub Release for

# it. A manual dispatch is a DRY-RUN (prints the cut plan) unless

# `release: true`. Add build steps + assets for whatever this repo ships.

# ORDER RULE: the tag + immutable GH release are the FINAL markers of a

# release — they may only exist AFTER the registry publish is live. A STAGED

# npm package is not published (staging may never be approved), so this

# workflow refuses to cut when the tagged version is not resolvable on its

# registry (npm packument / crates.io sparse index). Registry-less repos

# (private, github-release-only) skip the gate.

on:

workflow_dispatch:

inputs:

release:

description: 'Cut the release for real (false = dry-run plan, the default).'

type: boolean

default: false

tag:

description: 'Tag to release. Required on dispatch (tag pushes use the pushed tag).'

type: string

default: ''

push:

tags:

- 'v*'

permissions:

contents: read

# Fleet no-phone-home posture, lockstep with the FLEET_ENV list in

# .claude/hooks/fleet/_shared/fleet-env.mts (mirror of ci.yml's env block) —

# the release job runs the same telemetry + update-notifier opt-outs, so a

# release build never phones home. OTEL_SDK_DISABLED holds the OpenTelemetry

# exporter that ships in the skillspector security tool's closure inert.

env:

CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1'

COREPACK_ENABLE_PROJECT_SPEC: '0'

DISABLE_TELEMETRY: '1'

DO_NOT_TRACK: '1'

NO_UPDATE_NOTIFIER: '1'

OTEL_SDK_DISABLED: 'true'

jobs:

# Does this repo cut GitHub Releases at all? Read from the repo's own

# settings, never hard-coded here: a member publishing to npm or crates.io

# uses the release as the immutable marker its consumers and provenance

# checks read, while a repo distributing through GHCR alone (the wheelhouse

# and its fleet pack) would only be minting a second name for bytes nobody

# fetches under it. Defaults to enabled, so a member that says nothing keeps

# what it has.

gate:

runs-on: ubuntu-latest

outputs:

enabled: ${{ steps.flag.outputs.enabled }}

steps:

- name: Bootstrap checkout

shell: bash

env:

GITHUB_TOKEN: ${{ github.token }}

REPOSITORY: ${{ github.repository }}

SERVER_URL: ${{ github.server_url }}

TRIGGER_REF: ${{ github.ref }}

run: |

set -euo pipefail

git init -q

git config --local advice.detachedHead false

git remote remove origin 2>/dev/null || true

git remote add origin "${SERVER_URL}/${REPOSITORY}"

FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")

if [ -n "${GITHUB_TOKEN}" ]; then

AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"

git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"

else

git fetch "${FETCH_ARGS[@]}"

git checkout -q --detach FETCH_HEAD

- name: Set up and install

uses: ./.github/actions/fleet/setup-and-install

with:

socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}

payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}

payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}

- name: Read release.github

id: flag

run: node scripts/fleet/release/github/enabled.mts

- name: Say so when the repo opts out

if: steps.flag.outputs.enabled != 'true'

run: |

set -euo pipefail

echo 'release.github is false in .config/repo/socket-wheelhouse.json — this repo does not cut GitHub Releases. Skipping.'

github-release:

needs: gate

if: needs.gate.outputs.enabled == 'true'

runs-on: ubuntu-latest

permissions:

contents: write

steps:

# First step can't call the local ./.github/actions/fleet/checkout

# composite (nothing checked out yet); bootstrap the workspace with the

# same inline git-fetch shape publish-npm.yml uses, so the fleet

# checkout action below can re-check-out at its own depth.

- name: Bootstrap checkout

shell: bash

env:

# Route context through env (no ${{ }} in the shell body —

# zizmor expression-injection). Token authorizes the fetch inline and

# is never persisted to .git/config.

GITHUB_TOKEN: ${{ github.token }}

INPUT_TAG: ${{ inputs.tag }}

REPOSITORY: ${{ github.repository }}

SERVER_URL: ${{ github.server_url }}

TRIGGER_REF: ${{ github.ref }}

run: |

set -euo pipefail

git init -q

git config --local advice.detachedHead false

git remote remove origin 2>/dev/null || true

git remote add origin "${SERVER_URL}/${REPOSITORY}"

# A dispatched tag input wins; otherwise the ref that triggered the run.

FETCH_REF="${TRIGGER_REF}"

if [ -n "${INPUT_TAG}" ]; then

FETCH_REF="refs/tags/${INPUT_TAG}"

FETCH_ARGS=(--no-tags --prune --depth 1 origin "${FETCH_REF}")

if [ -n "${GITHUB_TOKEN}" ]; then

AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"

git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"

else

git fetch "${FETCH_ARGS[@]}"

git checkout -q --detach FETCH_HEAD

- name: Checkout

uses: ./.github/actions/fleet/checkout

with:

ref: ${{ inputs.tag != '' && format('refs/tags/{0}', inputs.tag) || github.sha }}

# Reuse the PR App for a contents:read token scoped to wheelhouse.

# Both credentials enable the private release fallback. Without the

# key, hydration still pulls public GHCR anonymously.

payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}

payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}

# The resolved tag is the single input every later step trusts — it

# feeds the registry-liveness gate as TAG and names the release cut, so

# wrong resolution here silently bypasses the publish-before-release

# order rule. The branch logic lives in the dependency-free

# scripts/fleet/resolve-release-tag.mjs (system Node only — no install

# has run here), where the wheelhouse unit suite regression-tests it;

# byte-parity with the inline predecessor is pinned per scenario.

- name: Resolve tag

id: tag

env:

EVENT_NAME: ${{ github.event_name }}

INPUT_TAG: ${{ inputs.tag }}

REF_NAME: ${{ github.ref_name }}

run: node scripts/fleet/resolve-release-tag.mjs

# Belt-and-braces publish-before-release gate: refuse to cut when the

# tagged version is not actually live on its registry. Runs only when a

# real cut would happen (tag push, or dispatch with release: true) so a

# dry-run plan stays inspectable pre-publish. The branch logic lives in

# the dependency-free scripts/fleet/registry-liveness-gate.mjs (system

# Node only — no install has run here), where the wheelhouse unit suite

# regression-tests it; the inline predecessor was untestable and shipped

# a regressed single-crate-only gate to cargo workspaces in v1.0.13.

- name: Registry publish is live

if: ${{ github.event_name == 'push' || inputs.release }}

env:

TAG: ${{ steps.tag.outputs.tag }}

run: node scripts/fleet/registry-liveness-gate.mjs

- name: Mint release-app token

id: app-token

uses: ./.github/actions/fleet/github-release-app-token

with:

client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID }}

private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}

repositories: ${{ github.event.repository.name }}

owner: ${{ github.repository_owner }}

# Build this repo's release assets here, then list them under the cut

# step's `assets:` (newline-separated paths; each must exist).

- name: Cut immutable GitHub release

uses: ./.github/actions/fleet/github-release

with:

tag: ${{ steps.tag.outputs.tag }}

dry-run: ${{ (github.event_name == 'push' || inputs.release) && 'false' || 'true' }}

token: ${{ steps.app-token.outputs.token }}

socket-cli/.github/workflows/github-release.yml at main · SocketDev/socket-cli · GitHub

Uh oh!

Expand file tree

Breadcrumbs

github-release.yml

Latest commit

History

Breadcrumbs

github-release.yml

File metadata and controls