github-workflows/.github/workflows/release.yaml at main · tox-dev/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Release actions
on:
  push:
    tags: ["*"]
permissions:
  contents: read
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false
jobs:
  check:
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: $/install-locked-tools
        with:
          groups: release-check
          venv: .venv
      - name: Check tagged source
        run: .venv/bin/prek run --all-files
  source:
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    outputs:
      previous: ${{ steps.previous.outputs.previous }}
      commit: ${{ github.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: $/install-locked-tools
        with:
          groups: release-notes
          venv: .venv
      - name: Verify tagged source
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          test "$(git rev-parse "refs/tags/$TAG^{commit}")" = "$(git rev-parse HEAD)"
          git merge-base --is-ancestor HEAD origin/main
      - id: previous
        uses: $/select-previous-tag
        with:
          tag: ${{ github.ref_name }}
  contributors:
    needs: source
    runs-on: ubuntu-26.04
    permissions:
      contents: write
    outputs:
      artifact-id: ${{ steps.artifact.outputs.artifact-id }}
    steps:
      - name: Fetch contributor metadata
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          PREVIOUS: ${{ needs.source.outputs.previous }}
        run: |
          set -euo pipefail
          args=(-f "tag_name=$TAG")
          if [[ -n "$PREVIOUS" ]]; then args+=(-f "previous_tag_name=$PREVIOUS"); fi
          gh api -X POST "repos/$GITHUB_REPOSITORY/releases/generate-notes" "${args[@]}" --jq .body \
            >"$RUNNER_TEMP/generated-notes.md"
      - id: artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: generated-notes
          path: ${{ runner.temp }}/generated-notes.md
          if-no-files-found: error
  notes:
    needs: [source, contributors]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    outputs:
      artifact-id: ${{ steps.artifact.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 1
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: $/install-locked-tools
        with:
          groups: release-notes
          venv: .venv
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.contributors.outputs.artifact-id }}
          path: ${{ runner.temp }}
      - uses: $/render-release-notes
        with:
          tag: ${{ github.ref_name }}
          previous: ${{ needs.source.outputs.previous }}
          changelog: CHANGELOG.md
          generated-notes: ${{ runner.temp }}/generated-notes.md
          output: ${{ runner.temp }}/release-notes.md
      - id: artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-notes
          path: ${{ runner.temp }}/release-notes.md
          if-no-files-found: error
  publish:
    needs: [check, source, notes]
    runs-on: ubuntu-26.04
    environment: release
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.notes.outputs.artifact-id }}
          path: ${{ runner.temp }}
      - uses: $/publish-github-release
        env:
          GH_TOKEN: ${{ github.token }}
        with:
          tag: ${{ github.ref_name }}
          commit: ${{ needs.source.outputs.commit }}
          title: ${{ github.ref_name }}
          notes-file: ${{ runner.temp }}/release-notes.md