.github/workflows/release.yml - master - githubmirror/salt

.github/workflows/release.yml
296 строк10 KB
Daniel A. Wozniak
Merge branch '3008.x' into merge/3008.x/master-26-06-18
19 июн 2026, 12:00
19 июн 2026, 12:00213565b
name: Release
run-name: "Release (branch: ${{ github.ref_name }}; version: ${{ inputs.salt-version }})"

on:
  workflow_dispatch:
    inputs:
      salt-version:
        type: string
        required: true
        description: >
          The Salt version to get from staging to publish the release.
          DO NOT prefix the version with a "v" (use 3006.0, not v3006.0).
          For prereleases use the PEP 440 form WITHOUT a hyphen
          (use 3008.0rc1, not 3008.0-rc1).
          The Python sdist/wheel and the GitHub tag/release will use this
          string verbatim (e.g. "salt-3008.0rc1.tar.gz" / "v3008.0rc1").
          The RPM "Version:" and the Debian changelog stanza substitute
          "rc" for "~rc" so prereleases sort before the GA version
          (e.g. "3008.0~rc1" < "3008.0").
      skip-salt-pkg-download-test-suite:
        type: boolean
        default: false
        description: Skip running the Salt packages download test suite.

env:
  COLUMNS: 190
  CACHE_SEED: SEED-3  # Bump the number to invalidate all caches
  RELENV_DATA: "${{ github.workspace }}/.relenv"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  RAISE_DEPRECATIONS_RUNTIME_ERRORS: "1"

permissions:
  contents: write  # To be able to publish the release
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.repository }}
  cancel-in-progress: false

jobs:

  check-requirements:
    name: Check Requirements
    runs-on: ubuntu-22.04
    environment: release-check
    steps:
      - name: Check For Admin Permission
        uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2
        with:
          require: admin
          username: ${{ github.triggering_actor }}

  prepare-workflow:
    name: Prepare Workflow Run
    runs-on:
      - ubuntu-24.04
    env:
      USE_S3_CACHE: 'false'
    environment: release
    needs:
      - check-requirements
    outputs:
      salt-version: ${{ steps.setup-salt-version.outputs.salt-version }}
      cache-seed: ${{ steps.set-cache-seed.outputs.cache-seed }}
      latest-release: ${{ steps.get-salt-releases.outputs.latest-release }}
      releases: ${{ steps.get-salt-releases.outputs.releases }}
      nox-archive-hash: ${{ steps.nox-archive-hash.outputs.nox-archive-hash }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0  # Full clone to also get the tags to get the right salt version

      - name: Set up Python 3.14
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ env.CACHE_SEED }}

      - name: Pretty Print The GH Actions Event
        run:
          tools ci print-gh-event

      - name: Setup Salt Version
        id: setup-salt-version
        uses: ./.github/actions/setup-salt-version
        with:
          salt-version: "${{ inputs.salt-version }}"
          validate-version: true

      - name: Get Salt Releases
        id: get-salt-releases
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tools ci get-releases

      - name: Set Cache Seed Output
        id: set-cache-seed
        run: |
          tools ci define-cache-seed ${{ env.CACHE_SEED }}

      - name: Get Hash For Nox Tarball Cache
        id: nox-archive-hash
        shell: bash
        run: |
          HASH=$(python3 .github/scripts/hash-files.py \
            'requirements/**/*' \
            'cicd/golden-images.json' \
            'noxfile.py' \
            'pkg/common/env-cleanup-rules.yml' \
            '.github/workflows/build-deps-ci-action.yml')
          echo "nox-archive-hash=${HASH}" | tee -a "$GITHUB_OUTPUT"

  release:
    name: Release v${{ needs.prepare-workflow.outputs.salt-version }}
    if: ${{ always() && ! failure() && ! cancelled() }}
    runs-on: ubuntu-24.04
    env:
      USE_S3_CACHE: 'false'
    needs:
      - prepare-workflow
    environment: release
    steps:
      - name: Clone The Salt Repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ssh-key: ${{ secrets.GHA_SSH_KEY }}

      - name: Set up Python 3.14
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}

      - name: Configure Git
        shell: bash
        run: |
          git config --global --add safe.directory "$(pwd)"
          git config --global user.name "Salt Project Packaging"
          git config --global user.email saltproject-packaging@vmware.com
          git config --global user.signingkey 64CBBC8173D76B3F
          git config --global commit.gpgsign true

      - name: Setup GnuPG
        env:
          SIGNING_GPG_KEY: ${{ secrets.SIGNING_GPG_KEY }}
          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
        run: |
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          export GNUPGHOME
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          passphrase-file ${GNUPGHOME}/passphrase
          EOF
          echo "${SIGNING_PASSPHRASE}" > "${GNUPGHOME}/passphrase"
          echo "${SIGNING_GPG_KEY}" | gpg --import -

      - name: Download Release Patch
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p artifacts/release
          gh release download \
            -D artifacts/release \
            -p 'salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch' \
            v${{ needs.prepare-workflow.outputs.salt-version }}

      - name: Apply The Release Patch
        run: |
          git am --committer-date-is-author-date artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch
          rm artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch

      - name: Tag The v${{ needs.prepare-workflow.outputs.salt-version }} Release
        run: |
          git tag -m "Release v${{ needs.prepare-workflow.outputs.salt-version }}" -as v${{ needs.prepare-workflow.outputs.salt-version }}

      - name: Push tag
        run: |
          git config user.name "GitHub Actions"
          git config user.email "github-actions@users.noreply.github.com"
          git push origin v${{ inputs.salt-version }}
          git push

  publish-pypi:
    name: Publish to PyPi
    if: ${{ always() && ! failure() && ! cancelled() && github.event.repository.fork != true }}
    needs:
      - prepare-workflow
      - release
    environment: release
    runs-on: ubuntu-24.04
    env:
      USE_S3_CACHE: 'false'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Python 3.14
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}

      - name: Setup GnuPG
        run: |
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          EOF

      - name: Download PyPi Artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p artifacts/release
          gh release download \
            -D artifacts/release \
            -p 'salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz' \
            v${{ needs.prepare-workflow.outputs.salt-version }}

      - name: Publish to PyPi
        env:
          TWINE_PASSWORD: "${{ secrets.TWINE_PASSWORD }}"
        run: |
          tools pkg pypi-upload artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz

  publish-draft:
    name: Publish Relase v${{ needs.prepare-workflow.outputs.salt-version }}
    if: ${{ !cancelled() && always() }}
    runs-on: ubuntu-22.04
    needs:
      - check-requirements
      - prepare-workflow
      - release
      - publish-pypi
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Publish Release v${{ needs.prepare-workflow.outputs.salt-version }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit v${{ inputs.salt-version }} --draft=false

  set-pipeline-exit-status:
    # This step is just so we can make github require this step, to pass checks
    # on a pull request instead of requiring all
    name: Set the ${{ github.workflow }} Pipeline Exit Status
    if: ${{ !cancelled() && always() }}
    runs-on: ubuntu-22.04
    needs:
      - check-requirements
      - prepare-workflow
      - release
      - publish-pypi
      - publish-draft
    steps:
      - name: Get workflow information
        id: get-workflow-info
        uses: im-open/workflow-conclusion@fce18569e28a9f2ed1feca1e6d4251e6a7365fdc # v2

      - run: |
          # shellcheck disable=SC2129
          if [ "${{ steps.get-workflow-info.outputs.conclusion }}" != "success" ]; then
            echo 'To restore the release bucket run:' >> "${GITHUB_STEP_SUMMARY}"
            echo '```' >> "${GITHUB_STEP_SUMMARY}"
            echo 'tools pkg repo restore-previous-releases' >> "${GITHUB_STEP_SUMMARY}"
            echo '```' >> "${GITHUB_STEP_SUMMARY}"
          fi

      - name: Set Pipeline Exit Status
        shell: bash
        run: |
          if [ "${{ steps.get-workflow-info.outputs.workflow_conclusion }}" != "success" ]; then
            exit 1
          else
            exit 0
          fi