.github/workflows/draft_release.yml - main - githubmirror/rsyslog

.github/workflows/draft_release.yml
250 строк8 KB
dependabot[bot]
ci: bump the github-actions group with 6 updates
21 июл 2026, 18:56
21 июл 2026, 18:563b40a2a
# Copyright 2026 Rainer Gerhards and Others
#
# https://github.com/rsyslog/rsyslog
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: draft source release

on:
  push:
    tags:
      - 'v8.*'
  workflow_dispatch:
    inputs:
      tag_name:
        description: Optional tag name for manual draft-release tests
        required: false
        type: string
      target_commitish:
        description: >-
          Optional branch or commit SHA to use when a manual draft release
          must create its tag remotely
        required: false
        type: string
      create_draft_release:
        description: Create or update a draft GitHub release after building
        required: false
        default: false
        type: boolean

concurrency:
  group: >-
    ${{ github.workflow }}-${{ github.event_name }}-${{
    github.ref_name || github.event.inputs.tag_name || github.run_id }}
  cancel-in-progress: false

env:
  # Reuse only the shared make dist helper function from this script.
  # This workflow does not run Debian packaging steps or build .deb artifacts.
  DEBIAN_CI_HELPER: .github/scripts/debian_package_build.sh

jobs:
  build_release_artifacts:
    name: build release artifacts
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'rsyslog/rsyslog' }}
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup make dist build env
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf-archive \
            libestr-dev \
            libglib2.0-dev \
            libgnutls28-dev \
            liblognorm-dev \
            liblz4-dev \
            libnet1-dev \
            librelp-dev \
            libssl-dev \
            libsystemd-dev \
            libtool \
            libtool-bin \
            libyaml-dev \
            libzstd-dev \
            lsof \
            make \
            net-tools \
            pkg-config \
            python3-docutils \
            software-properties-common \
            zstd

      - name: Build maintainer tarball
        run: |
          set -euo pipefail
          rm -f rsyslog-*.tar.gz rsyslog-*.tar.gz.sha256
          # This calls only run_dist_build, which wraps autoreconf/configure/make dist.
          # It does not fetch Debian packaging or invoke any package build steps.
          "$GITHUB_WORKSPACE/$DEBIAN_CI_HELPER" run_dist_build \
            "$GITHUB_WORKSPACE"

      - name: Generate checksum and locate assets
        id: dist_assets
        run: |
          set -euo pipefail
          shopt -s nullglob

          tarballs=(rsyslog-*.tar.gz)
          if [ "${#tarballs[@]}" -ne 1 ]; then
            echo "ERROR: expected exactly one rsyslog-*.tar.gz artifact" >&2
            ls -1 rsyslog-*.tar.gz 2>/dev/null || true
            exit 1
          fi

          dist_tarball="${tarballs[0]}"
          sha256sum "$dist_tarball" > "$dist_tarball.sha256"

          printf 'dist_tarball=%s\n' "$dist_tarball" >> "$GITHUB_OUTPUT"
          printf 'dist_tarball_sha256=%s\n' "$dist_tarball.sha256" >> "$GITHUB_OUTPUT"

      - name: Upload release artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: draft-release-assets
          path: |
            ${{ steps.dist_assets.outputs.dist_tarball }}
            ${{ steps.dist_assets.outputs.dist_tarball_sha256 }}
          if-no-files-found: error

  update_draft_release:
    name: update draft release
    runs-on: ubuntu-latest
    needs: build_release_artifacts
    if: ${{ github.repository == 'rsyslog/rsyslog' && (github.event_name == 'push' || github.event.inputs.create_draft_release == 'true') }}
    permissions:
      contents: write

    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: draft-release-assets
          path: release-assets

      - name: Resolve release tag
        id: release_tag
        env:
          MANUAL_TAG_NAME: ${{ github.event.inputs.tag_name }}
        run: |
          set -euo pipefail

          official_tag_re='^v8\.[0-9]{4}\.[0-9]+$'
          manual_tag_re='^(v8\.[0-9]{4}\.[0-9]+|test-release-.*)$'

          if [ "${GITHUB_EVENT_NAME}" = "push" ]; then
            release_tag="${GITHUB_REF_NAME}"
            if [[ ! "$release_tag" =~ $official_tag_re ]]; then
              echo "ERROR: pushed tag '$release_tag' does not match ^v8\\.[0-9]{4}\\.[0-9]+$" >&2
              exit 1
            fi
          else
            release_tag="${MANUAL_TAG_NAME:-}"
            if [ -z "$release_tag" ]; then
              echo "ERROR: workflow_dispatch requires inputs.tag_name when create_draft_release=true" >&2
              exit 1
            fi
            if [[ ! "$release_tag" =~ $manual_tag_re ]]; then
              echo "ERROR: manual tag '$release_tag' must be an official v8.yymm.patch tag or start with test-release-" >&2
              exit 1
            fi
          fi

          printf 'release_tag=%s\n' "$release_tag" >> "$GITHUB_OUTPUT"

      - name: Validate downloaded assets
        id: asset_paths
        run: |
          set -euo pipefail
          cd release-assets
          shopt -s nullglob

          tarballs=(rsyslog-*.tar.gz)
          checksums=(rsyslog-*.tar.gz.sha256)

          if [ "${#tarballs[@]}" -ne 1 ] || [ "${#checksums[@]}" -ne 1 ]; then
            echo "ERROR: expected exactly one tarball and one checksum file" >&2
            find . -maxdepth 1 -type f -printf '%P\n' | sort
            exit 1
          fi

          sha256sum -c "${checksums[0]}"

          printf 'tarball_path=%s\n' "release-assets/${tarballs[0]}" >> "$GITHUB_OUTPUT"
          printf 'checksum_path=%s\n' "release-assets/${checksums[0]}" >> "$GITHUB_OUTPUT"

      - name: Create or update draft release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ steps.release_tag.outputs.release_tag }}
          TARGET_COMMITISH: ${{ github.event.inputs.target_commitish }}
          TARBALL_PATH: ${{ steps.asset_paths.outputs.tarball_path }}
          CHECKSUM_PATH: ${{ steps.asset_paths.outputs.checksum_path }}
        run: |
          set -euo pipefail

          cat > release-notes.md <<'EOF'
          This draft release includes the maintainer-built `rsyslog-*.tar.gz`
          source tarball produced by `make dist`.

          These uploaded assets are the official source-release artifacts for
          this draft and are distinct from GitHub's auto-generated source
          snapshots.
          EOF

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release edit "$RELEASE_TAG" \
              --draft \
              --title "$RELEASE_TAG" \
              --notes-file release-notes.md
          else
            create_args=(
              "$RELEASE_TAG"
              --draft
              --title "$RELEASE_TAG"
              --notes-file release-notes.md
            )

            if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" >/dev/null 2>&1; then
              create_args+=(--verify-tag)
            else
              if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]; then
                echo "ERROR: expected pushed tag '$RELEASE_TAG' to exist remotely" >&2
                exit 1
              fi
              if [ -z "${TARGET_COMMITISH:-}" ]; then
                echo "ERROR: inputs.target_commitish is required when creating a manual release for a missing tag" >&2
                exit 1
              fi
              create_args+=(--target "$TARGET_COMMITISH")
            fi

            gh release create "${create_args[@]}"
          fi

          gh release upload "$RELEASE_TAG" \
            "$TARBALL_PATH" \
            "$CHECKSUM_PATH" \
            --clobber