ci(release): tag-triggered release.yaml orchestrator + draft-release capstone#36
Merged
Merged
Conversation
…elease_tag passthrough
…rap creates the draft
…oci -> splice||finance -> draft)
Contributor
Scala coverage
|
Contributor
C# coverage
|
Contributor
C# build matrix
|
Contributor
Scala build matrix
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-open
Summary
Implements the tag-triggered release orchestrator (S4 of the release-orchestration umbrella). A thin
release.yamlresolves one version and assembles a complete draft GitHub Release — runtime NuGets, thedpm-codegen-csOCI image, Splice + Daml.Finance DAR NuGets — via one orderedneeds:-chain, then stops. Publishing the Release is a separate, human-gated button.Changes
release.yaml(new) —on: push tags v* + workflow_dispatch{version,dry_run,…}; resolves one version and chainsdraft-bootstrap → runtime-publish → oci-build → (splice ‖ daml-finance) → completevianeeds:/workflow_call. Stops at a COMPLETE DRAFT.finalize-release.yaml(new) — humanworkflow_dispatchpublish button (draft → published). NEVER auto-runs._release-lifecycle.yaml(new) — reusable owning draft bootstrap + finalize (ghCLI); de-dups the two inlinegh release createblocks.publish.yaml— gainsworkflow_call{version,dry_run}+ outputs and a dry-run pack-only path; drops its ownpush: tags(the orchestrator owns tag triggering); attach is upload-only._publish-dar-packages.yaml+ both thin callers (publish-splice.yaml,publish-daml-finance.yaml) — gain arelease_tagseam; DAR attach now runs in dry-run too (nuget push + counter write-back stay gated).build-oci-codegen-cs.yaml— dropspush: tags; attach is upload-only (bootstrap owns creation).Behaviour (blessed decisions)
csharp-publishaction untouched).release_tag.OCI_PUBLISH_ENABLEDdispatch dance, not the rehearsal. The rehearsal draft carries runtime + Splice + Daml.Finance.v*tag push publishes packages to nuget.org + bumps counters immediately, and pushes the OCI image to GHCR; ONLY the GitHub Release stays a draft until a human runs Finalize.Validation
actionlintclean across the whole tree (one pre-existing, unrelatedSC2129style note inbuild-oci's untouchedvalidate-inputsjob remains). Because everyuses:is a local reusable, actionlint resolves each callee and checks the orchestrator'swith:/secrets:against each callee's declared inputs — the integration wiring is machine-verified.yqstructural assertions per file.dry_run=truerehearsal on a throwaway tag → complete draft, no nuget push, no counter bump; the OCI leg via theOCI_PUBLISH_ENABLEDdispatch.Operational preconditions (public repo)
SPLICE_VERSION/DAML_FINANCE_VERSION(unattended tag-push path;workflow_dispatchpasses them as inputs). Daml.Finance further falls back to2.10.0.OCI_PUBLISH_ENABLED='true'— the Splice/Daml.Finance legsneeds: oci-build, and the whole OCI workflow is gated by this var. It is'true'on this repo by design (public owns OCI publishing); documented here so it isn't silently a hole.Deferred (documented, non-blocking)
release.yamlresolve:codegen_cs_versionis documented "dry_run only" but applied unconditionally. Safe on the tag-push path (no such input is passed). Optional fast-follow guard:[ "$DRY" = "true" ] || CGV="${VERSION}".dry_runrehearsal exercises the pack-only attach path, not the realcsharp-publishattach path — confirm runtime nupkgs land on the first real finalize.Topology recorded in internal ADR 0018.