Finn Evers
f9593f71aa
This changes our approach for creating Zed version bumps with the Zed Zippy identity: With these changes, the Zippy version bumps as well as the tag creations will be verified as per https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#signature-verification-for-bots. This adds an extra layer of security for version bumps and release triggers done by the Zippy identity. Eventually, we can move code more around for this so it happens in the bot itself, but for now, I think its a good and solid interim solution to have this here. Release Notes: - N/A
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
# Generated from xtask::workflows::bump_patch_version
|
|
# Rebuild with `cargo xtask workflows`.
|
|
name: bump_patch_version
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
branch:
|
|
description: Branch name to run on
|
|
required: true
|
|
type: string
|
|
jobs:
|
|
run_bump_patch_version:
|
|
if: github.repository_owner == 'zed-industries'
|
|
runs-on: namespace-profile-16x32-ubuntu-2204
|
|
steps:
|
|
- id: generate-token
|
|
name: steps::authenticate_as_zippy
|
|
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
|
|
with:
|
|
app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
|
|
private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
|
|
- name: steps::checkout_repo
|
|
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
|
|
with:
|
|
clean: false
|
|
ref: ${{ inputs.branch }}
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
- id: bump-version
|
|
name: bump_patch_version::run_bump_patch_version::bump_version
|
|
run: |
|
|
channel="$(cat crates/zed/RELEASE_CHANNEL)"
|
|
|
|
tag_suffix=""
|
|
case $channel in
|
|
stable)
|
|
;;
|
|
preview)
|
|
tag_suffix="-pre"
|
|
;;
|
|
*)
|
|
echo "this must be run on either of stable|preview release branches" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
which cargo-set-version > /dev/null || cargo install cargo-edit -f --no-default-features --features "set-version"
|
|
version="$(cargo set-version -p zed --bump patch 2>&1 | sed 's/.* //')"
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
echo "tag_suffix=$tag_suffix" >> "$GITHUB_OUTPUT"
|
|
- id: commit
|
|
name: bump_patch_version::run_bump_patch_version::commit_changes
|
|
uses: IAreKyleW00t/verified-bot-commit@126a6a11889ab05bcff72ec2403c326cd249b84c
|
|
with:
|
|
message: Bump to ${{ steps.bump-version.outputs.version }} for @${{ github.actor }}
|
|
files: '**'
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
- name: bump_patch_version::run_bump_patch_version::create_version_tag
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
|
|
with:
|
|
script: |
|
|
github.rest.git.createRef({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
ref: 'refs/tags/v${{ steps.bump-version.outputs.version }}${{ steps.bump-version.outputs.tag_suffix }}',
|
|
sha: '${{ steps.commit.outputs.commit }}'
|
|
})
|
|
github-token: ${{ steps.generate-token.outputs.token }}
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ inputs.branch }}
|
|
cancel-in-progress: true
|
|
defaults:
|
|
run:
|
|
shell: bash -euxo pipefail {0}
|