ship/.github/workflows/trigger-release.yaml at main · tenzir/ship · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: Release

on:
  workflow_dispatch:
    inputs:
      intro:
        description: |
          Intro of the release

          The intro should be 1-2 sentences long, must be written in active
          voice, and should clearly communicate the theme of the release to the
          user. Use full sentences and avoid abbreviations.
        required: true
        type: string
      title:
        description: |
          User-facing release title (auto-generated if omitted)
        required: false
        type: string

jobs:
  validate-release-config:
    name: Validate release workflow configuration
    runs-on: ubuntu-latest

    steps:
      - name: Validate release configuration
        env:
          TENZIR_GITHUB_APP_ID: ${{ vars.TENZIR_GITHUB_APP_ID }}
          TENZIR_GITHUB_APP_PRIVATE_KEY: ${{ secrets.TENZIR_GITHUB_APP_PRIVATE_KEY }}
          TENZIR_BOT_GPG_SIGNING_KEY: ${{ secrets.TENZIR_BOT_GPG_SIGNING_KEY }}
        run: |
          if [ -z "$TENZIR_GITHUB_APP_ID" ]; then
            echo "::error::Repository variable 'TENZIR_GITHUB_APP_ID' must be set for release runs."
            exit 1
          fi

          if [ -z "$TENZIR_GITHUB_APP_PRIVATE_KEY" ]; then
            echo "::error::Repository secret 'TENZIR_GITHUB_APP_PRIVATE_KEY' must be set for release runs."
            exit 1
          fi

          if [ -z "$TENZIR_BOT_GPG_SIGNING_KEY" ]; then
            echo "::error::Repository secret 'TENZIR_BOT_GPG_SIGNING_KEY' must be set for release runs."
            exit 1
          fi

  release:
    name: Create GitHub release
    needs: validate-release-config
    permissions:
      contents: write
    uses: ./.github/workflows/release.yaml
    with:
      intro: ${{ inputs.intro }}
      title: ${{ inputs.title }}
      git-add-paths: pyproject.toml uv.lock
      pre-create: |
        uv sync --python 3.12 --dev
        uv run ruff check
        uv run ruff format --check
        uv run mypy
        uv run pytest --durations=10
        uv run tenzir-ship --root changelog validate
        uv build
      post-create: |
        uv lock
      github_app_id: ${{ vars.TENZIR_GITHUB_APP_ID }}
      git_user_name: tenzir-bot
      git_user_email: [email protected]
      sign_commits: true
      sign_tags: true
    secrets:
      github_app_private_key: ${{ secrets.TENZIR_GITHUB_APP_PRIVATE_KEY }}
      gpg_private_key: ${{ secrets.TENZIR_BOT_GPG_SIGNING_KEY }}