feat: create-release

.github/workflows/create-release.yaml

@@ -0,0 +1,208 @@
+name: Create Release
+
+# Uses `semantic-release` under the hood, but we did not want to force
+# devs to be pedantic with commit messages, so instead we take GitHub
+# approach and list only merged PRs in the release notes and allow
+# releaser to decide if it’s major, minor or patch release.
+#
+# - Push a commit bumping up a version:
+#   - Version in `package.json` and — if it exists — `version.txt`
+#   - Release notes in `CHANGELOG.md`
+# - Create git version tag
+# - Create GitHub release
+# - Send slack notification
+#
+#
+# # Authentication
+#
+# This workflow needs higher permissions to be able to push to main
+# branch etc. We obtain it using a GitHub app. App needs to have these
+# permissions:
+#
+# - Contents: Read & Write
+# - Issues: Read & Write
+# - Pull requests: Read & Write
+#
+# Install it and and set `CREATE_RELEASE_APP_ID` and
+# `CREATE_RELEASE_APP_PRIVATE_KEY` secrets. Convinent to do so on the
+# organisation level.
+
+on:
+  workflow_call:
+    inputs:
+      release-type:
+        description: 'Type of release (major, minor, patch, or prerelease)'
+        type: string
+        default: 'patch'
+      dry-run:
+        description: 'Dry–run'
+        type: boolean
+        default: false
+
+jobs:
+  release:
+    name: 'Create Release'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+
+    steps:
+      - name: Verify inputs
+        run: |
+          if ! echo "${{ inputs.release-type }}" | grep -qE '^(major|minor|patch|prerelease)$'
+          then
+            echo "::error::Invalid release-type: ${{ inputs.release-type }}. Must be one of: major, minor, patch, prerelease."
+            exit 64 # EX_USAGE
+          fi
+
+          if [ "${{ inputs.release-type }}" = "prerelease" ]
+          then
+            echo "::error::Prerelease not supported (yet)."
+            exit 64 # EX_USAGE
+          fi
+
+      - name: Set environment variables
+        env:
+          ENV_VARS: ${{ secrets.env_vars }}
+        run: |
+          echo "$ENV_VARS" >> "$GITHUB_ENV"
+
+      - name: 'GitHub App token: Token'
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CREATE_RELEASE_APP_ID }}
+          private-key: ${{ secrets.CREATE_RELEASE_APP_PRIVATE_KEY }}
+
+      - name: 'GitHub App token: App Data'
+        id: app-token-data
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          user_id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)
+          echo "user-id=$user_id" >> "$GITHUB_OUTPUT"
+
+      - name: Setup
+        id: setup
+        uses: verkstedt/actions/setup@feat/create-release
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          github-npm-registry-personal-access-token: ${{ secrets.GH_NPM_REGISTRY_PERSONAL_ACCESS_TOKEN }}
+
+      - name: Download semantic-release config
+        id: release-config
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        # Unfortunatelly when using reusable workflows, GitHub doesn’t
+        # expose paths to these workflows in any way, so we need to
+        # hardcode repo and reference and fetch the file manually 🙄
+        run: |
+          config_repo="verkstedt/actions"
+          config_ref="feat/create-release" # TODO DEBUG Change to v1 before merging
+          config_path="create-release/semantic-release.config.mjs"
+
+          release_config_mjs="$RUNNER_TEMP/$( basename "$config_path" )"
+          echo "path=$release_config_mjs" | tee -a "$GITHUB_OUTPUT"
+
+          gh api \
+            -H 'Accept: application/vnd.github.raw' \
+            "/repos/${config_repo}/contents/${config_path}?ref=${config_ref}" \
+            > "$release_config_mjs"
+
+      - name: Release
+        id: release
+        env:
+          # Note: This script doesn’t access steps.*.outputs and
+          # inputs.* directly to make it easier to copy it to separate
+          # file for testing
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          PACKAGE_MANAGER: ${{ steps.setup.outputs.package-manager }}
+          RELEASE_TYPE: ${{ inputs.release-type }}
+          RELEASE_CONFIG_MJS: ${{ steps.release-config.outputs.path }}
+        run: |
+          echo "::group::Install semantic-release plugins"
+          install-plugin-pkgs () {
+            # shellcheck disable=SC2046
+            set -- $(
+              node --input-type=module --eval "
+                const { default: config } = await import(process.argv[1], { assert: { type: 'module' } });
+                process.stdout.write(config.plugins.map(p => p[0]).join('\\n'));
+              " "$RELEASE_CONFIG_MJS"
+            )
+
+            case "$PACKAGE_MANAGER" in
+              yarn)
+                yarn add -D "$@"
+                ;;
+              npm)
+                npm install -D "$@"
+                ;;
+              *)
+                echo "::error::Unsupported package manager: $PACKAGE_MANAGER"
+                exit 69 # EX_UNAVAILABLE
+                ;;
+            esac
+
+            git restore package.json || :
+            git restore package-lock.json || :
+            git restore yarn.lock || :
+          }
+          install-plugin-pkgs
+          echo "::endgroup::"
+
+          echo "::group::Setup git"
+          # Use our GitHub app bot as author of the release commit
+          GIT_AUTHOR_NAME='${{ steps.app-token.outputs.app-slug }}[bot]'
+          GIT_AUTHOR_EMAIL='${{ steps.app-token-data.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
+          export GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
+
+          # Not really semantically true, because semantic-release is
+          # both the author and commiter, but with this we’ll have a
+          # nice info in git of who triggered the release
+          GIT_COMMITTER_NAME="$GITHUB_ACTOR"
+          GIT_COMMITTER_EMAIL="$GITHUB_ACTOR_ID+$GITHUB_ACTOR@users.noreply.github.com"
+          export GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL
+          echo "::endgroup::"
+
+          echo "::group::Run semantic-release"
+          if [ "${{ inputs.dry-run }}" = "true" ]
+          then
+            set -- "$@" --dry-run
+          fi
+          export RELEASE_TYPE
+          export GITHUB_STEP_SUMMARY
+          export GITHUB_OUTPUT # Note: It will add some outputs
+          npx --yes semantic-release --extends "$RELEASE_CONFIG_MJS" "$@"
+          echo "::endgroup::"
+
+      - name: Convert release notes to Slack’s markdown–like markup
+        id: slack-release-notes
+        env:
+          TEXT: ${{ steps.release.outputs.release-notes }}
+        run: |
+          if [ -n "$TEXT" ]
+          then
+            mkdir -p "$RUNNER_TEMP/slackify-markdown"
+            cd "$RUNNER_TEMP/slackify-markdown"
+            echo '{}' > package.json
+            npm install slackify-markdown
+            TEXT=$( node -e 'process.stdout.write(require("slackify-markdown")(process.argv[1]))' "$TEXT" )
+          fi
+
+          {
+            echo 'text<<TEXT_EOL'
+            echo "$TEXT"
+            echo 'TEXT_EOL'
+          } | tee -a "$GITHUB_OUTPUT"
+
+      - name: Notify
+        if: inputs.dry-run != true
+        uses: verkstedt/actions/notify-status@feat/create-release
+        with:
+          status: success
+          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
+          slack-channel-id: ${{ vars.SLACK_CHANNEL_ID }}
+          text: ${{ steps.slack-release-notes.outputs.text }}

README.md

@@ -173,6 +173,13 @@ Template:
 
 When a GH commit URL is included in commit message, link the commit from said comment.
 
+### Create Release
+
+Template:
+<https://github.com/verkstedt/.github/tree/main/workflow-templates/create-release.yaml>
+
+See [create-release.yaml](./.github/workflows/create-release.yaml) for details.
+
 ## Deploying new versions of actions and workflows
 
 You might have noticed that main branch in this repository is called

create-release/README.md

@@ -0,0 +1 @@
+Files used by [`create-release` workflow](../.github/workflows/create-release.yaml).