marc
7e59978f07
GitHub's git endpoint rejects a bearer header; it takes the job token as the password of x-access-token, as actions/checkout does. The release tag is also resolved in the job environment.
60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
# Cuts the signed PGXN distribution and publishes it as a GitHub release on
|
|
# version tags (v<major>.<minor>.<patch>), or for an existing tag on manual
|
|
# dispatch. Secret: PGMORBAC_RELEASE_KEY, the Ed25519 private key PEM (content,
|
|
# not a path). The organisation only allows its own actions, so checkout and
|
|
# Node setup are plain shell: git over the job token, and the official Node
|
|
# tarball checked against its published SHA-256.
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Existing version tag to release (e.g. v1.0.1)
|
|
required: true
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
NODE_VERSION: v24.12.0
|
|
RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
|
|
steps:
|
|
- name: Check out the tag
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
|
|
git init -q .
|
|
basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
|
|
git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \
|
|
"https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
|
|
git checkout -q "refs/tags/$RELEASE_REF"
|
|
- name: Install Node
|
|
run: |
|
|
base="https://nodejs.org/dist/$NODE_VERSION"
|
|
file="node-$NODE_VERSION-linux-x64.tar.xz"
|
|
curl -fsSLO "$base/$file"
|
|
curl -fsSL "$base/SHASUMS256.txt" | grep " $file\$" | sha256sum -c -
|
|
mkdir -p "$RUNNER_TEMP/node"
|
|
tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
|
|
rm "$file"
|
|
echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
|
|
- run: npm install --no-audit --no-fund
|
|
- name: Build and sign
|
|
env:
|
|
PGMORBAC_RELEASE_KEY_PEM: ${{ secrets.PGMORBAC_RELEASE_KEY }}
|
|
run: |
|
|
umask 077
|
|
printf '%s\n' "$PGMORBAC_RELEASE_KEY_PEM" > "$RUNNER_TEMP/release-key.pem"
|
|
PGMORBAC_RELEASE_KEY="$RUNNER_TEMP/release-key.pem" node scripts/build-dist.mjs
|
|
- name: Publish
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: node scripts/github-release.mjs
|